CMMC 2.0 · Levels 1, 2 and 3 · US defence supply chain

CMMC 2.0 certification consulting for defence contracts you can win and keep.

Meet the CMMC level your US Department of War contract names, first time, on your timeline: a Level 1 or Level 2 self-assessment affirmed in SPRS, or a Level 2 certification assessment by an authorised C3PAO where a solicitation or your prime requires one. Sterling's expert and experienced consultants trace where your FCI and CUI live, put the NIST SP 800-171 Rev 2 requirements in place with your IT team, write the system security plan and stay with you through the assessment and every affirmation after it, in 60+ countries. We ensure successful certification for our clients.

Book a free discovery call Start the free readiness check

Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
A team of expert and experienced defence supply-chain cybersecurity consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not assess or certify; your senior official affirms a self-assessment, and an authorised C3PAO or DCMA DIBCAC assesses where your contract requires it

CMMC 2.0 at a glance

Purpose: Verifying that contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) on their own systems before the Department awards them work
Relevant to: Prime contractors and subcontractors at every tier, in the US and abroad, that process, store or transmit FCI or CUI for a DoW contract
Edition: 32 CFR Part 170 since 16 December 2024, the DFARS rule since 10 November 2025; Level 2 is NIST SP 800-171 Rev 2. Phase 1 applies; Phase 2 suspended on 13 July 2026 pending review
Certification: Levels 1 and 2 (Self): self-assessment in SPRS, affirmed by a senior official. Level 2 (C3PAO): certification assessment by an authorised C3PAO. Level 3: DCMA DIBCAC
Sterling's role: Scoping, gap analysis, system security plan and remediation with your team, Effivity, training, self-assessment and C3PAO readiness, then Sustain™
Cost and timing: Total investment for CMMC depends on the current maturity of your processes and security controls, the scope, locations and number of employees. The process typically takes 2 to 12 months

8,100+ client engagements in 60+ countries.

CMMC 2.0 client experience

What it is

What is CMMC 2.0 and what is it used for?

The Cybersecurity Maturity Model Certification (CMMC) is how the US Department of War (DoW, written DoD in the regulations) checks that contractors protect two kinds of unclassified information on their own systems: Federal Contract Information (FCI), provided by or generated for the government under a contract and not meant for public release, and Controlled Unclassified Information (CUI), which law, regulation or government-wide policy requires to be safeguarded although it is not classified. Contractors already had to protect both, under FAR 52.204-21 and DFARS 252.204-7012; CMMC adds a status in the Supplier Performance Risk System (SPRS) that a contracting officer must see before award.

The model has three levels. Level 1 covers FCI with the 15 basic safeguarding requirements of FAR 52.204-21, self-assessed every year. Level 2 covers CUI with the 110 security requirements of NIST SP 800-171 Revision 2, assessed every three years either by the contractor itself or by a CMMC Third-Party Assessment Organization (C3PAO), with an affirmation every year. Level 3 adds 24 enhanced requirements selected from NIST SP 800-172 and is assessed by the government's own assessors, DCMA DIBCAC, once Final Level 2 (C3PAO) status is in place for the same scope. The programme is widely known as CMMC 2.0; the rule itself calls it the CMMC Program.

Current rules and status. The CMMC Program rule, 32 CFR Part 170, took effect on 16 December 2024; the DFARS rule (DFARS Case 2019-D041, 48 CFR) followed on 10 November 2025 and started Phase 1, in which applicable solicitations call for Level 1 (Self) or Level 2 (Self). Phase 2, due on 10 November 2026 to add Level 2 (C3PAO) as a condition of award, was suspended by the Department on 13 July 2026, which also set up a CMMC reform task force. Implementation is paused in Phase 1, whose self-assessment requirements remain in place, and the Department says it will enforce NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments meanwhile. Both rules remain in the Code of Federal Regulations as of September 2026; expect changes from the review and read each solicitation for the level it names. CMMC after the Phase 2 suspension: what applies now

Who it is for

Who needs CMMC 2.0 certification?

CMMC reaches well beyond the primes named on DoW programmes. It applies to every contractor and subcontractor, at any tier, that will process, store or transmit FCI or CUI on its own systems in performing a DoW contract, unless the purchase is solely of commercially available off-the-shelf (COTS) items. Organisations come to Sterling for CMMC from four starting points:

A solicitation names a CMMC level. The notice provision DFARS 252.204-7025 tells you the level the contract will require, and the clause 252.204-7021 holds you to it. No award can go to an offeror without a current CMMC status at that level in SPRS, and the same check applies before options and extensions.
A prime contractor has flowed the requirement down to you. Primes pass the applicable CMMC level and assessment type to every subcontractor that will handle FCI or CUI. A machine shop receiving CUI drawings can be in scope without ever holding a DoW contract.
You supply the US defence industrial base from outside the United States. The rule makes no exception for location, and the Department says it intends foreign companies supporting US warfighters to be equipped to safeguard FCI and CUI. Agree the level and scope with your prime before you plan around a date.
You hold ISO/IEC 27001 or a SOC 2 report and a prime still asks for CMMC. Neither is a CMMC status. Your ISMS gives you policies, risk assessment and internal audit to build on, but the 110 requirements are assessed one by one, including specifics such as FIPS-validated encryption of CUI.

The intended benefit is continued eligibility and CUI that is genuinely protected. Both depend on a scope that follows the information and controls that operate every day.

Business benefits

How CMMC 2.0 supports defence contract eligibility and CUI protection

A CMMC programme pays back at award, at every option and on every ordinary day your CUI stays where it should. We start from the contracts you want to keep and the systems your customers' information passes through.

Eligible at awardA current status in SPRS at the level the solicitation names, so nothing delays the award.
Options exercised, not lostStatus and affirmations kept current, because SPRS is checked again before options and extensions.
A stronger place in primes' supply chainsPrimes must flow the requirement down, and a subcontractor with its status and evidence ready is the easier choice.
A smaller, cheaper scopeCUI kept to the systems and people that need it, so fewer assets carry the full weight of the assessment.
An affirmation your senior official can signEvidence for each requirement kept current, so the Affirming Official's annual statement rests on records rather than reassurance.
Ready for whatever the review decidesControls and evidence mapped to NIST SP 800-171 Rev 2, the basis the Department still enforces, whatever form the next check takes.

Measure what the programme changes: requirements met, POA&M items open and days to closeout, CUI found outside the intended boundary, and affirmations made on time. The status in SPRS is the outcome; those numbers show whether it will hold.

Requirements

What are the main CMMC 2.0 requirements?

CMMC has no management-system clauses. Each level is a fixed set of security requirements, and the assessment asks whether each is met across the assets in scope. Level 2 is identical to the 110 requirements of NIST SP 800-171 Revision 2, in the 14 families CMMC calls domains, shown with their NIST section numbers. The table is a plain-language map; your assessment works from the full requirement text.

Requirement	What it requires of you	What it looks like in practice
Scope Assessment boundary	Identify every asset that processes, stores or transmits FCI or CUI, and what protects those assets, before any requirement is assessed	At Level 2, assets sorted into CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets such as operational technology and test equipment, and Out-of-Scope Assets, with a network diagram and CUI flow map
Level 1 Basic safeguarding of FCI	Meet the 15 requirements of FAR 52.204-21 on the systems holding FCI; self-assess yearly, with no plan of action allowed	Access only for authorised users, processes and devices, identification and authentication, media sanitised before disposal, physical access and visitors controlled, boundaries monitored, public-facing systems on separate subnetworks, flaws corrected promptly, and malware protection updated and scanning
3.1 · 3.5 Access Control; Identification and Authentication	Limit who and what can reach CUI, and establish identity before access	Least privilege, separation of duties, controlled remote and wireless access, session locks, CUI kept off public and unapproved external systems, and multi-factor authentication for privileged accounts and network access
3.2 · 3.9 · 3.10 Awareness and Training; Personnel Security; Physical Protection	Make people aware of their duties, screen them, and protect the places where CUI is handled	Awareness and role-based training including insider threat, screening before access, access removed when people leave or move, escorted visitors, physical access logs and controlled access devices
3.4 · 3.7 · 3.8 Configuration Management; Maintenance; Media Protection	Keep systems in a known, approved state, maintain them under control and protect CUI on every medium	Baselines and inventories, change control, only essential functions and approved software, supervised maintenance, and media marked, access-restricted, encrypted in transport and sanitised before reuse or disposal
3.3 · 3.6 · 3.14 Audit and Accountability; Incident Response; System and Information Integrity	Record what happens on your systems, handle incidents, and correct flaws before they are exploited	Audit logs created, protected and reviewed, incident handling that is tracked, reported and tested, flaws remediated on time, malicious code blocked, alerts acted on and systems monitored for attack and unauthorised use
3.13 System and Communications Protection	Protect CUI at the boundary and in transit, and keep apart what should be apart	Boundary protection that denies by default, public-facing components on separate subnetworks, no split tunnelling for remote devices, FIPS-validated cryptography protecting the confidentiality of CUI, and CUI protected at rest
3.11 · 3.12 Risk Assessment; Security Assessment	Assess risk and your own controls periodically, and document how the system meets each requirement	Periodic risk assessments and vulnerability scans with remediation, control assessments, plans of action, ongoing monitoring, and a system security plan describing the boundary, the environment and how each requirement is met
Level 3 Enhanced requirements from NIST SP 800-172	Meet 24 selected enhanced requirements, with parameters the Department sets, on top of Final Level 2 (C3PAO) status for the same scope	Ten domains, with seven requirements in risk assessment alone: threat-informed risk management, threat awareness training, round-the-clock security operations and incident response, and the isolation and integrity of security-critical components; assessed by DCMA DIBCAC every three years

What does useful CMMC evidence look like?

A system security plan that matches the configured environment, an asset inventory with categories, a CUI flow map, policies and procedures, configuration baselines, access reviews, multi-factor settings, log reviews, an incident response test, vulnerability scans with remediation, training records and any POA&M with its dates. We keep the records the requirements call for and nothing for show, in Effivity from the first workshop, so the score you enter rests on evidence an assessor can open.

CMMC Level 2 requirements explained, domain by domain

Assessment process

How do you get CMMC 2.0 certified?

Strictly, only the Level 2 (C3PAO) and Level 3 (DIBCAC) assessments are certification assessments; Level 1 and Level 2 (Self) are self-assessments your own senior official affirms. The route is the same until the final step: put the requirements in place, then have them assessed. Sterling prepares you and supports you through it; the C3PAO or DIBCAC reaches its own result, and only your Affirming Official affirms.

01
Confirm the level, the assessment type and the information in scope.Read the solicitation notice or the prime's flow-down, confirm Level 1, Level 2 (Self), Level 2 (C3PAO) or Level 3, and trace where FCI and CUI enter, are stored and leave.
02
Gap analysis: score every requirement for your level against the scope.The gap analysis categorises the assets, tests each requirement against its evidence, calculates the score and agrees fixes, owners and dates, starting with items that can never wait on a POA&M.
03
Write the system security plan and remediate.Multi-factor authentication, FIPS-validated encryption, logging, configuration baselines, access reviews, an enclave where it shrinks the scope, and an SSP that describes what is really configured.
04
Self-assess before anyone else does.Sterling runs a mock assessment against the evidence, recalculates the score and prepares any POA&M within the rule's limits, while there is time to fix what fails.
05
Complete the assessment your contract requires.Enter self-assessment results in SPRS and have your Affirming Official affirm them, or engage an authorised C3PAO, whose results reach SPRS through CMMC eMASS. Level 3 follows with DCMA DIBCAC once Final Level 2 (C3PAO) status is in place.
06
Close out, affirm every year and reassess on time.Close any POA&M within 180 days, affirm annually, reassess every year at Level 1 and every three years at Levels 2 and 3, and keep the scope current as contracts change.

Check the route, not only the price. Confirm any C3PAO on the Cyber AB's CMMC Marketplace, ask which level, assessment type and scope a quotation covers, and keep implementation and assessment apart. Treat a ready-made SSP or a promised score of 110 with suspicion; your Affirming Official, not the consultant, makes the affirmation. How to choose a credible CMMC provider · The certification buyer's checklist

Cost

How much does CMMC 2.0 certification cost?

There is no list price for CMMC. A twenty-person supplier handling only FCI faces a different programme from a manufacturer whose engineering network carries CUI across three sites. Cost follows scope: how many assets and people touch CUI, and how far today's controls are from your level. What we promise is a proposal with every component visible and our fee fixed.

Cost component	What affects it
Consulting and implementation	The level, the size of the CUI scope, current maturity, the number of sites and legal entities, and how much of the work your team takes on (Design™ or Drive™)
Self-assessment and affirmation	Internal time to score each requirement, enter results in SPRS and brief the Affirming Official; no external assessor is involved at Level 1 or Level 2 (Self)
C3PAO or DIBCAC assessment	Where Level 2 (C3PAO) is required, the C3PAO quotes by scope, asset count, locations and complexity; Level 3 is assessed by DCMA DIBCAC
Remediation and technology	Multi-factor authentication, FIPS-validated encryption, logging, endpoint protection, a CUI enclave or a cloud service meeting requirements equivalent to the FedRAMP Moderate baseline, and IT staff or provider time
Software and learning	Included in a Sterling engagement: Effivity for the SSP, the POA&M and the evidence, and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal
Continued support	Annual affirmations, POA&M closeout, the three-yearly reassessment, scope changes and whatever the reform review changes, under Sustain™ and Revise™

What moves the price

How many assets, users and sites touch CUI today
Whether CUI can be confined to an enclave or runs through the whole network
The level and assessment type: self-assessment, C3PAO or Level 3
Cloud and managed service providers inside the scope
The solicitation or prime's date, and how much your IT team or provider can carry

What a Sterling proposal always shows

Deliverables, responsibilities, assumptions and exclusions, written down
Any C3PAO fee kept separate, so the whole programme cost can be compared
Effivity, training and Academy access itemised at no additional cost
Payment milestones linked to deliverables rather than dates
One all-inclusive proposal. No surprises, ever

Timeline

How long does CMMC 2.0 certification take?

Longer than most suppliers expect, because the time goes into the controls, not the assessment. A small Level 1 scope can often be ready in two to three months. A Level 2 programme from a low starting point typically takes six to twelve months, longer on large networks: multi-factor authentication and FIPS-validated encryption rolled out, logs reviewed, an SSP that matches the system, and enough operating history for credible evidence. Anything left on a POA&M must then close within 180 days. We plan backwards from the bid or the prime's date and track every requirement in Effivity.

Phase	What determines the pace
Scope and gap analysis	Access to IT staff or your provider, network diagrams, the contracts that show where FCI and CUI arrive, and existing policies
SSP and remediation	The number of requirements not met, technology lead times, enclave or cloud decisions and change windows
Evidence and self-assessment	Controls operating long enough to produce records, the mock assessment, the score and any POA&M decision
Assessment and closeout	SPRS entry and affirmation, the C3PAO's availability where one is required, and closeout of any POA&M within 180 days

If a bid date or a prime's deadline is fixed, tell us at the start. Sometimes the right route is a tighter CUI boundary first, widened once the controls inside it hold. A status date promised before anyone has traced where your CUI goes is optimism, not planning.

Challenges

Common CMMC 2.0 implementation challenges

CMMC programmes stall on the same five problems. Each has a practical answer.

CUI has spread across the whole network.

Drawings in e-mail, specifications on shared drives, CUI on laptops at home: when CUI is everywhere, every asset is in scope. We trace where it flows, shrink the boundary, often to an enclave, and categorise what remains as the rule defines.

The system security plan describes intentions, not the system.

An assessor compares the SSP with what is actually configured. We write it from the configured environment and keep it current as the system changes; the SSP is one of the requirements that can never be left on a POA&M.

Cloud services and managed service providers sit inside the scope.

A commercial cloud offering can hold CUI only if it meets security requirements equivalent to the FedRAMP Moderate baseline and its provider meets paragraphs (c) to (g) of DFARS 252.204-7012, and the tools and services that protect your CUI assets are Security Protection Assets within scope. We map each provider and write the shared responsibilities into the SSP.

Some gaps cannot wait on a POA&M.

The rule allows a POA&M only above a minimum score, only for one-point requirements (with one encryption exception), never for six excluded requirements, and only for 180 days. We rank your gaps against those limits, so the ones that must close before assessment close first.

Nobody owns the annual affirmation.

The Affirming Official, the senior person responsible for compliance, affirms after each assessment and every year after; a status lapses without it. We keep the calendar, the evidence and a short briefing for the official in Effivity, so the statement is made on facts.

Your engagement

What your CMMC 2.0 engagement includes

Your agreed scope brings together what a defensible CMMC status needs, from the first CUI flow map to the assessment and the affirmations after it. One team carries it, under one all-inclusive proposal.

Level, scope and gap analysis
The level and assessment type confirmed, CUI flows traced, assets categorised, and every requirement scored against evidence, with fixes, owners and dates.
System security plan, policies and procedures
Written from your configured environment on Sterling's own template sets, requirement by requirement, with your IT team or provider.
Effivity ISO & GRC software
Your SSP, POA&M, asset inventory, access reviews and evidence run in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement, and internal auditor training for the team that checks the requirements, as applicable to your standard.
Mock assessment, scoring and POA&M
Every requirement tested against its evidence, the score calculated, and any plan of action kept within the rule's limits.
SPRS, affirmation and assessment support
SPRS entries made with your team and the Affirming Official briefed; for Level 2 (C3PAO), help choosing an authorised C3PAO and support through assessment and closeout.

CMMC status rests on your own affirmed self-assessment or on the C3PAO or DCMA DIBCAC assessment; Sterling does not assess.

How we deliver

How Sterling supports your CMMC 2.0 implementation

Every CMMC engagement runs on Sterling OS™, our delivery operating system: five phases, each with deliverables, decision owners and evidence. Choose the support level your IT capacity calls for; the method, the software and the accountability stay the same.

01
Design™Guided implementation: your IT team closes the gaps with Sterling's scoping method, SSP structure, policy templates, workshops and coaching.
02
Drive™Fully managed consulting: Sterling consultants carry the agreed scoping, documentation and assessment preparation alongside your IT team or provider.
03
Sustain™After the assessment: affirmations, POA&M closeout, periodic control checks, new assets and users brought into scope, and the next assessment prepared before the status lapses.
04
Automate™The programme running in Effivity: asset inventory, SSP, POA&M, access reviews, log-review and incident records, training and affirmation dates in one workspace.
05
Revise™Changes to the programme itself, such as the outcome of the 2026 reform review, a step from Level 2 (Self) to Level 2 (C3PAO) or Level 3, and changes in scope, sites or contracts.

In the first week we agree who leads, when the working session meets, what is delivered and who decides. Progress is then tracked requirement by requirement, so a gap that will not close in time is visible months before an assessor could find it.

How Sterling OS™ works

Often combined with

Standards organisations pair with CMMC 2.0

Effivity · CMMC 2.0 compliance software, included in every engagement

How Effivity helps you fulfil, automate and simplify the requirements of CMMC 2.0 and NIST SP 800-171 Rev 2.

Every Sterling CMMC engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so the asset inventory, the system security plan, the POA&M, access reviews, log and incident records, training and the affirmation calendar sit in one place. For Sterling consulting clients, the Effivity subscription is included with the engagement, at no additional cost.

Included in every engagement See Effivity

Scope

Assets, categories and CUI flows

Every asset in scope with its owner, location and category, linked to the CUI flow map, so a new laptop or cloud tool is categorised before it holds CUI.

Security Assessment

System security plan and plans of action

The SSP maintained requirement by requirement with approvals and review dates, and each POA&M item tracked against the 180-day clock to closure.

Access Control

Accounts, privileges and multi-factor authentication

Joiner, mover and leaver approvals, privileged accounts listed and reviewed, remote access recorded, and the multi-factor authentication status of every system that reaches CUI.

Configuration Management

Baselines, inventories and changes

Approved configuration baselines, authorised software and change requests with their security review, so the configuration an assessor finds is the one the SSP describes.

Audit and Accountability

Log reviews and audit records

Scheduled log reviews assigned, completed and signed off, with anomalies raised as actions, so every review leaves a trace.

Incident Response

Incidents, reports and response tests

Security incidents recorded, tracked and reported, and response tests planned, run and learned from.

Risk Assessment

Risk assessments and vulnerability scans

Periodic risk assessments, scan results and remediation deadlines in one register, with overdue fixes visible to management early.

Affirmation

Scores, affirmations and reassessment dates

The current score, each SPRS entry, the Affirming Official's annual affirmation and the next assessment date in one calendar, with reminders before anything lapses.

What this means at the audit

A C3PAO assessor works through the requirements with your SSP beside the evidence: the asset inventory, the access list and multi-factor settings, a sample of log reviews, the last incident response test, the scan results and the POA&M. In Effivity each is a screen with owners, dates and evidence attached, not an export assembled the week before. Afterwards Sustain™ runs in the same workspace, so the annual affirmation starts from a system that kept running.

Effivity for CMMC: the guide Effivity on effivity.com

In your engagement

Subscription included with the engagement, at no additional cost
Configured by your Sterling consultant within the agreed scope
Your inventories, plans and records migrated, not retyped
Admin and user training for your team
Modules for ISMS, QMS and more when you add ISO/IEC 27001, ISO 9001 or other standards

CMMC 2.0 client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for CMMC 2.0 are available on request. The client feedback wall lists every letter by standard.

Programmes with CMMC 2.0 in scope

How an integrated defence supply-chain programme runs.

All case studies

01
Aerospace and defence supplier: CMMC Level 2 on an AS9100 and ISO/IEC 27001 system
CMMC is commonly implemented beside the management systems a defence supplier already runs: AS9100 or ISO 9001 for quality, and ISO/IEC 27001 for information security. In such a programme the CUI scope, the system security plan and the 110 requirements sit inside the ISMS, so risk assessment, internal audit and corrective action serve both, and one evidence base in one Effivity workspace supports the certification audits, the CMMC assessment and every affirmation.
How integrated programmes run

Sterling Academy · CMMC 2.0 e-learning

Train every employee on CMMC 2.0, not just the IT team.

Sterling Academy trains the whole workforce and the people who run the controls through e-learning: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

CMMC 2.0 awareness for every employee: what FCI and CUI are, how CUI is marked and handled, and how to report an incident
Practitioner courses for IT administrators, the security lead and the people who approve access and changes
Internal auditor training for the people who check the requirements between assessments, as applicable to your standard, as part of the engagement
Learner progress by department, and training records ready for the assessor
New starters trained before they reach CUI, so the records stay current for every affirmation
Questions from learners answered by a Sterling consultant

Keep exploring

Explore more about CMMC 2.0

Watch a video on how to implement CMMC here.
Watch a video on CMMC requirements here.

CMMC 2.0 resources

Services for CMMC 2.0

Why Sterling

Want successful CMMC 2.0 certification? Come to Sterling.

Whether you are a single machine shop receiving CUI drawings or a group with engineering sites in several countries, Sterling helps you draw the CUI boundary tight, meet the requirements inside it and keep them met, through the practical conflicts: legacy machines the plant depends on, cloud tools bought outside IT, and a prime's deadline that will not move.

Security programmes in 60+ countries since 2003

Information security and management system programmes delivered for manufacturers, engineering firms, technology companies and service businesses, with one engagement team answerable for your whole CUI scope.

All-inclusive proposal

Consulting, Effivity, training and Academy access in one proposal, with any C3PAO fee shown separately. No surprises, ever.

Controls your IT team can run

Configuration baselines, access reviews, log reviews and patching built into the way your IT team or provider already works, so the score you affirm this year is still true next year.

Expert and experienced consultants

Consultants with information security and management system experience across sectors and countries since 2003, who test each requirement against the evidence an assessment asks for before any assessor sees it.

Sterling vs the rest: the full comparison Explore CMMC 2.0 client experience

The Sterling Promise

What our CMMC 2.0 certification success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until your agreed CMMC outcome is achieved at the level and assessment type in your engagement, supporting remediation, the system security plan, the self-assessment and affirmation, and, where required, the C3PAO assessment and any POA&M closeout. Clear explanations, practical delivery, included software and employee learning make the protection last beyond the assessment date.

The engagement identifies the level, the assessment type, the CUI scope, the outcome and the responsibilities. Your organisation supplies accurate information, gives access to the systems in scope and makes the agreed changes, and your Affirming Official alone decides what to affirm. The C3PAO or DCMA DIBCAC conducts any certification assessment and determines its result. Our commitment concerns the agreed support, not every future contract award, a year without incidents or the outcome of the Department's reform review.

After certification

What happens after CMMC 2.0 certification?

A CMMC status is not a certificate on a wall; it is a record in SPRS that a contracting officer checks before an award and before an option. Level 1 is reassessed every year, Levels 2 and 3 every three years, and at every level your Affirming Official affirms each year; a status lapses when that affirmation is missed. A conditional status also expires unless its POA&M is closed within 180 days.

Between assessments the scope moves: new engineers, a new cloud tool, another site, a contract with a different kind of CUI. Under Sterling OS™ Sustain™ we keep the SSP, the inventory and the evidence current with you and plan the next assessment; under Revise™ we adjust the programme when the Department's review changes the rules.

FAQs

Frequently asked questions about CMMC 2.0

What is the difference between CMMC Level 1, Level 2 and Level 3?

Level 1 covers FCI: the 15 requirements of FAR 52.204-21, self-assessed and affirmed every year, results in SPRS, no plan of action allowed. Level 2 covers CUI: the 110 requirements of NIST SP 800-171 Rev 2, assessed every three years by you, Level 2 (Self), or by an authorised C3PAO, Level 2 (C3PAO), as the solicitation specifies, and affirmed yearly. Level 3 adds 24 requirements from NIST SP 800-172, assessed every three years by DCMA DIBCAC, and needs Final Level 2 (C3PAO) status for the same scope first.

Is CMMC 2.0 still required after the July 2026 Phase 2 suspension?

Yes, at Phase 1. On 13 July 2026 the Department of War suspended Phase 2, which was to begin on 10 November 2026 and add Level 2 (C3PAO) as a condition of award, and set up a reform task force. It states that the Phase 1 self-assessment requirements remain in place and that NIST SP 800-171 Rev 2 will be enforced through self-assessments and select government-led assessments during the review. The rules remain published, so read each solicitation and flow-down for the level it names, and expect changes when the review concludes.

Do subcontractors and suppliers outside the United States need CMMC?

If they will process, store or transmit FCI or CUI on their own systems for a DoW contract, yes. The requirement flows down to every tier, with the level and assessment type set for each subcontract, and the rule makes no exception for location. Agree the level and scope with your prime early. Sterling supports suppliers from offices in 21 countries.

Can we self-assess Level 2, or do we need a C3PAO?

The solicitation or your prime decides. Phase 1 calls for Level 1 (Self) or Level 2 (Self) in applicable solicitations; Phase 2, which was to add Level 2 (C3PAO) as a condition of award, is suspended. Where a C3PAO assessment is required, only an authorised C3PAO can conduct it. The 110 requirements are the same either way, so prepare once, to the evidence standard a third party would expect.

What score do we need, and can we use a plan of action (POA&M)?

Final status needs every requirement for your level met. At Level 2 a conditional status with a POA&M is possible if your score is at least 88 of 110 (80%), every open item is worth one point, with one exception for encryption in place but not FIPS-validated, and none of six excluded requirements is open: control of external connections, control of CUI on publicly accessible systems, the system security plan, escorting visitors, physical access logs and management of physical access. The POA&M must close within 180 days or the conditional status expires. Level 1 allows no POA&M.

What is SPRS, and what does the annual affirmation involve?

SPRS, the Supplier Performance Risk System, is where self-assessment results and affirmations are entered and where contracting officers check CMMC status before an award or an option, using the CMMC unique identifiers the offeror provides; C3PAO results reach it through CMMC eMASS. Your Affirming Official affirms after each assessment and every year after; miss the annual affirmation and the status lapses.

Which revision of NIST SP 800-171 does CMMC use?

Revision 2, published in February 2020 and updated in January 2021. The CMMC rule incorporates it by reference, Level 2 is identical to its 110 requirements, and the Department says it is enforcing Rev 2 during the review. If you also align to a later NIST revision for other customers, keep a mapping back to Rev 2 so your CMMC assessment is not affected.

Is Sterling a C3PAO, and does Sterling issue CMMC status?

No. Sterling is a consultancy: we prepare your organisation, check the evidence and support you through the assessment. Your Affirming Official affirms a self-assessment, a C3PAO authorised by the Cyber AB, the CMMC accreditation body, conducts a Level 2 certification assessment, and DCMA DIBCAC conducts Level 3. The Cyber AB also registers Registered Practitioner Organizations (RPOs) to advise on implementation, and it bars an individual who helped implement a company's controls from assessing that company.

What do you need to prepare a CMMC proposal?

The level and assessment type in the solicitation or flow-down, the FCI or CUI involved, the sites, legal entities and number of users in scope, who runs your IT, any SPRS entry, SSP or POA&M you already have, and your deadline. That is enough for a scoped, all-inclusive proposal; there is no need to begin the self-assessment first.

Before the first call

Prepare a useful CMMC 2.0 readiness brief

You do not need a system security plan before the first discussion. Bring a short account of the contracts, the information and the systems involved. Seven questions are enough:

Which solicitation, contract or prime is asking, for which level and assessment type, and by when? Or, if nobody has asked yet, which DoW work do you expect to bid for?
What FCI or CUI do you receive or create, from whom, and in what form: drawings, specifications, reports, source code?
Where does it live: which networks, laptops, cloud services, file shares and e-mail systems, at which sites?
How many people and devices can reach it, and are any of them outside the United States or outside your own company?
Who runs your IT, your own team or a managed service provider, and which security tools are already in place?
Have you entered a score or an affirmation in SPRS before, and do you have a system security plan or a POA&M today?
Do you hold ISO/IEC 27001, AS9100, a SOC 2 report or another certificate the programme can build on?

With these answers we can scope the programme and price it accurately. They prepare a conversation, not a scored assessment, and nothing you tell us is an affirmation.

Don’t be fooled by certification scams

If no C3PAO assessed it, it is not CMMC 2.0 certification.

A CMMC status is worth having when it sits in SPRS at the level your contract names and the requirements behind it are really met. The market also sells substitutes: "CMMC certified" badges from firms that are not C3PAOs, software sold as instant compliance, pre-written system security plans describing somebody else's network, and consultants who offer to assess the controls they built. They cost less, until a prime asks for evidence or an incident shows what was never there.

How to choose a credible CMMC provider

Ask who will assess, and at which level. Only an authorised C3PAO conducts a Level 2 certification assessment and only DCMA DIBCAC a Level 3 assessment; check any C3PAO on the Cyber AB's CMMC Marketplace.
Keep the people who build apart from the people who assess. The Cyber AB does not allow an individual who helped implement a company's controls to assess the same company.
Ask how every requirement will be tested before anyone affirms. The affirmation comes from your own senior official, so a consultant's optimism becomes your organisation's statement to the Department.
Identify who carries each task, which fees belong to the C3PAO, and what support exists when requirements are found not met or a POA&M has to close within 180 days.
Ask where the evidence will live and what your people will learn. Affirmations come round every year; without records and training, each one starts from memory.
Walk away from "CMMC certified in 30 days", "guaranteed 110" and badges with no status behind them in SPRS. The programme verifies requirements that operate, not documents that exist.

All ten warning signs of shortcut certification

What genuine CMMC 2.0 status always involves

A scope that follows the FCI and CUI, with assets categorised as the rule defines them
The requirements of your level in place across the scope and described in a system security plan
An accurately scored self-assessment, or an assessment by an authorised C3PAO or DCMA DIBCAC
Results in SPRS, entered directly or passed on from CMMC eMASS
An affirmation by your senior official after each assessment and yearly
A POA&M only where the rule allows one, closed within 180 days
Reassessment every year at Level 1 and every three years at Levels 2 and 3

Sterling's position. Sterling does not assess, certify or affirm, and is not a C3PAO. We consult, train and prepare you; you affirm your own self-assessment, and an authorised C3PAO or DCMA DIBCAC conducts any certification assessment. We do not sell status without controls, we do not put unchecked scores in front of your Affirming Official, and we tell you when an offer you have received is a shortcut.

Holding a CMMC badge, a pre-written SSP or an offer that sounds too easy? Send it to us and we will tell you, at no charge, whether it would stand up to a prime's check.

Keep exploring

More on CMMC 2.0 and related standards

More in Automotive, aerospace, rail & defence

Talk to a consultant

Plan your CMMC 2.0 certification with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Achieve CMMC 2.0 status for the first timeUnderstand cost, scope and timingPrepare for a Level 2 (C3PAO) certification assessmentMeet a prime contractor's CMMC flow-down

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice