CUI
Controlled Unclassified Information, such as technical drawings or specifications marked by the government. Where CUI is stored, processed or transmitted defines the scope of your assessment.
For defense contractors and suppliers
CMMC in your ITReady when the contract asks for it
Since November 10, 2025, the Department of Defense can require a CMMC status as a condition of contract award. Suppliers that handle Federal Contract Information or Controlled Unclassified Information need to show that their IT meets the required controls. We help you prepare and implement the technical requirements, so your assessment does not fail on the basics.
Where CMMC stands today
The Cybersecurity Maturity Model Certification program is set out in 32 CFR Part 170, which took effect on December 16, 2024. The contract rule in the DFARS took effect on November 10, 2025. Since then, CMMC requirements can appear in solicitations and contracts.
Phase 1 is in force: contracts mainly require a Level 1 or Level 2 self-assessment, a score in SPRS and an annual affirmation, on top of the existing DFARS 252.204-7012 duties. Phase 2, which would have required Level 2 assessments by an authorized third-party assessment organization (C3PAO) for many contracts from November 10, 2026, was suspended by the Department on July 13, 2026, pending a review of the program. The contracting officer sets the required level for each contract, so check each solicitation.
The three CMMC levels
| Level 1 | Federal Contract Information. 15 basic requirements from FAR 52.204-21, annual self-assessment and affirmation. |
| Level 2 | Controlled Unclassified Information. 110 requirements from NIST SP 800-171 Rev. 2, self-assessment or C3PAO assessment every three years, plus annual affirmation. |
| Level 3 | CUI in high-priority programs. Level 2 by a C3PAO plus 24 requirements from NIST SP 800-172, assessed by the government (DCMA DIBCAC). |
Which level applies is stated in the solicitation. Prime contractors pass the requirement down to subcontractors that handle the same type of information.
Terms you will hear
SPRS score
Your NIST SP 800-171 self-assessment score in the Supplier Performance Risk System. It runs from minus 203 to 110, and each unmet requirement lowers it by 1, 3 or 5 points.
POA&M
A plan of action and milestones for open requirements. Level 1 does not allow one. At Level 2 you need at least 88 of 110 points for a conditional status, only certain requirements may be open and everything must be closed within 180 days.
System Security Plan
The SSP describes your environment, its boundaries and how each requirement is met. Without a current SSP, no assessment can succeed.
External service providers
If an IT provider manages systems that handle CUI, its services are part of your assessment scope. We document our responsibilities in a shared responsibility matrix.
Annual affirmation
A senior official of your company confirms each year in SPRS that the requirements are still met. That makes CMMC a responsibility of management, not only of IT.
Where Level 2 assessments often fail
These technical points cost the most points and are among those that typically cannot be left open on a POA&M:
- Multi-factor authentication for all network access and for privileged accounts
- FIPS-validated encryption for CUI at rest and in transit
- A clear boundary around the systems that handle CUI, documented in the SSP
- Audit logging with review and protection of the logs
- Removal of access when people leave or change roles
- Malware protection and patching on a fixed schedule
- Controlled remote access and separate admin accounts
- An incident response capability that has been tested
How we work with you
- 01
Scoping
Together we determine where FCI and CUI live and which systems are in scope. A smaller, well-defined enclave often reduces cost and effort considerably.
- 02
Gap assessment
We compare your environment with the 110 requirements of NIST SP 800-171 and calculate a realistic SPRS score. The security assessment starts at $7,900 and is credited toward the follow-up project.
- 03
Implementation
We implement the technical requirements, such as MFA, encryption, logging and device management, and write the technical parts of your SSP.
- 04
Evidence and operation
We keep systems and evidence current for your self-assessment or your C3PAO assessment and for the annual affirmation.
Our role
FNLY IT is not a C3PAO and not a Registered Practitioner Organization. We do not conduct CMMC assessments and do not issue a CMMC status. We help you prepare and implement the technical requirements. The assessment is done by you, a C3PAO or the government, depending on your level.
Experience with manufacturers and suppliers
Industrial supplier, international · 2,000 users, Germany
Introduction of an identity and access management solution, a cleanup of file shares and a self-service password reset for employees.
Result: Password tickets dropped from almost 300 to 10 per week, which freed the help desk for other requests.
Updated:
FAQ
Frequently asked questions
When does CMMC apply to my contracts?
The DFARS rule took effect on November 10, 2025, and Phase 1 applies: self-assessments, SPRS scores and annual affirmations. The Department suspended Phase 2, the planned start of mandatory C3PAO assessments on November 10, 2026, on July 13, 2026 while it reviews the program. The NIST SP 800-171 requirements under DFARS 252.204-7012 still apply, and the solicitation states the level you need.
Which CMMC level do I need?
If you only handle Federal Contract Information, Level 1 usually applies. If you handle Controlled Unclassified Information, you need Level 2, either as a self-assessment or a C3PAO assessment. Level 3 applies only to selected high-priority programs. Your contract or your prime contractor tells you which level is required.
What is an SPRS score?
It is the result of your self-assessment against the 110 requirements of NIST SP 800-171, entered in the Supplier Performance Risk System. The maximum is 110. Each unmet requirement subtracts 1, 3 or 5 points, so the score can go as low as minus 203.
Can I pass CMMC with open items?
At Level 1, no. At Level 2 you can receive a conditional status if you reach at least 88 of 110 points and the open items are allowed on a plan of action and milestones. All open items must be closed within 180 days, and a closeout assessment confirms it.
Is FNLY IT a C3PAO or RPO?
No. We are neither a C3PAO nor a Registered Practitioner Organization, and we do not conduct assessments. We help you prepare and implement the technical requirements and keep the evidence ready for your assessment.
Does my IT provider count toward my assessment?
If the provider manages systems that store, process or transmit CUI, or that protect them, its services are part of your assessment scope. That is why we document in a shared responsibility matrix which requirements we cover and which remain with you.
How long does CMMC preparation take?
It depends on your starting point and scope. Many small suppliers need several months to close the gaps to NIST SP 800-171. Third-party assessments are on hold for now, but the underlying requirements and your self-assessment score already count, so it pays to start before a contract asks for it.
CMMC
Let us look at your CMMC readiness
Tell us which contracts you hold or bid on and where CUI is handled today. We will tell you what your path to the required level looks like.