CMMC 2.0 Certification Readiness — Defense Industrial Base Compliance
CMMC is the US Department of Defense's mandatory cybersecurity certification programme for the Defense Industrial Base — any contractor or subcontractor that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) in a DoD supply chain. CMMC 2.0 simplified the original five-tier model into three levels: Level 1 (Foundational, 17 practices, annual self-assessment) for FCI, Level 2 (Advanced, 110 practices aligned to NIST SP 800-171) for CUI, and Level 3 (Expert, built on NIST SP 800-172) for the highest-priority programmes, assessed directly by the government.
Mutex Systems runs CMMC 2.0 Level 1 and Level 2 readiness programmes — NIST SP 800-171 gap assessment, System Security Plan (SSP) and Plan of Action & Milestones (POA&M) build, and preparation for the C3PAO third-party assessment required for critical Level 2 programmes.
- Category
- Compliance Framework
- Jurisdiction
- United States
- Issuing Body
- US Department of Defense (DoD), administered via the Cyber AB (Cyber Accreditation Body)
- Current Version
- CMMC 2.0 — the DoD's final rule took effect in late 2024/early 2025, with the CMMC contract clause being phased into DoD acquisitions over the following years
- Who It's For
- Defense Industrial Base primes and subcontractors of any size that process, store, or transmit Federal Contract Information or Controlled Unclassified Information as part of a DoD contract — a requirement that flows down through the full supply chain, not just direct DoD contractors.
Core Domains
A Practical Compliance Path
- 01
CUI Scoping & Data Flow Mapping
Identify exactly which systems, personnel, and subcontractors touch CUI or FCI — the scope of assessment follows the data, not the org chart.
- 02
NIST SP 800-171 Gap Assessment
Assess current practice against all 110 Level 2 controls (or the 17 Level 1 controls for FCI-only environments), producing a scored gap list.
- 03
SSP & POA&M Build
Document how each control is implemented in the System Security Plan, with a Plan of Action & Milestones tracking remediation for anything not yet fully in place.
- 04
Self-Assessment or C3PAO Preparation
Support annual self-assessment submission for Level 1 and most Level 2 programmes, or full preparation ahead of a C3PAO third-party assessment for critical Level 2 programmes.
Scoped to Where CUI Actually Lives, Not the Whole Network
CMMC readiness starts with rigorous CUI data-flow scoping, because assessment effort and enclave-boundary decisions both follow directly from where Controlled Unclassified Information actually flows — getting scope wrong is the single most common cause of a failed or needlessly expensive assessment.
- CUI and FCI data-flow mapping across systems, personnel, and the subcontractor supply chain before any control work begins
- NIST SP 800-171 gap assessment and SSP/POA&M build scoped to the actual assessment level required by the contract
- Preparation support ahead of C3PAO third-party assessment for critical Level 2 programmes
All 110 NIST SP 800-171 Controls, With Evidence Linked at the Control Level
grComply loads NIST SP 800-171's full control set as the backbone of CMMC Level 2 readiness, so the SSP is generated from live, linked evidence rather than written once and left to drift out of sync with reality before the C3PAO assessment.
- Each of the 110 controls carries its own evidence links and completion status, giving a live view of SSP accuracy instead of a document nobody has opened since it was drafted
- The POA&M is tracked as a structured, dated remediation plan inside the platform, with the same raise / respond / review / close workflow used for formal audit observations
- Hybrid agentless and agent-based scanning evidences technical controls — access control, audit logging, configuration management — directly against the environment holding CUI
- Private and on-premise deployment options matter here more than almost anywhere else — DIB contractors handling CUI often need the compliance platform itself to meet the same data-locality expectations as the systems it tracks
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About CMMC
What is the difference between CMMC Level 1 and Level 2?
Level 1 (Foundational) applies to contractors handling only Federal Contract Information and requires 17 basic safeguarding practices, verified through annual self-assessment. Level 2 (Advanced) applies where Controlled Unclassified Information is involved and requires all 110 practices from NIST SP 800-171 — most Level 2 programmes allow self-assessment, but contracts involving the most critical CUI require a third-party C3PAO assessment instead.
Does CMMC apply to subcontractors, or only prime DoD contractors?
It applies to the full supply chain. If FCI or CUI flows down to a subcontractor at any tier, that subcontractor must meet the CMMC level appropriate to the information it handles — a prime contractor cannot satisfy the requirement on behalf of its subcontractors. This flow-down obligation is one of the most commonly underestimated aspects of CMMC scoping.
What is a C3PAO and when is one required?
A C3PAO (CMMC Third-Party Assessment Organization) is an accredited body authorised to conduct formal CMMC Level 2 certification assessments. A C3PAO assessment is required for Level 2 programmes the DoD designates as involving its most critical CUI; other Level 2 programmes and all Level 1 programmes are eligible for self-assessment instead.
How is CMMC related to NIST SP 800-171?
CMMC Level 2 is built directly on NIST SP 800-171 — the same 110 security controls form the assessment basis for both. Where NIST SP 800-171 has historically been a self-attested contractual requirement (via DFARS clauses), CMMC adds a formal assessment and certification layer — either self-assessment or third-party C3PAO assessment, depending on the programme — on top of the same underlying control set.
Can Mutex Systems support CMMC 2.0 readiness for our organisation?
Yes. Mutex Systems runs CUI/FCI data-flow scoping, NIST SP 800-171 gap assessment, SSP and POA&M build, and preparation support ahead of self-assessment or C3PAO third-party assessment for Level 1 and Level 2 CMMC programmes.
Ready to Start Your CMMC Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.