CMMC 2.0
Compliance
CMMC 2.0 is now enforced in DoD contracts. Ohio defense contractors and manufacturers who handle CUI must achieve certified compliance — or lose their contracts. Securafy delivers CMMC Level 1 and Level 2 readiness programs built for Ohio's defense industrial base.
All DoD contractors and subcontractors must achieve CMMC certification by 2025. Non-compliance means losing federal contracts permanently.
What Is CMMC 2.0?
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the DoD's framework for ensuring that defense contractors adequately protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It became enforceable in DoD contracts beginning in late 2024.
CMMC 2.0 streamlined the original five levels into three: Level 1 (Foundational — 17 practices), Level 2 (Advanced — 110 practices aligned to NIST SP 800-171), and Level 3 (Expert — 110+ practices aligned to NIST SP 800-172). Most Ohio defense contractors and manufacturers need Level 1 or Level 2.
The critical change: CMMC 2.0 requires third-party certification (C3PAO assessment) for most Level 2 contracts. Self-attestation alone is no longer sufficient for contracts involving CUI. Organizations that prematurely claim compliance without proper controls face False Claims Act liability.
"CMMC isn't a checkbox — it's a certification. Ohio defense contractors need to start their readiness program 12–18 months before their next contract renewal."
CMMC 2.0 Level Requirements
Level 1 — Foundational
17 practices from FAR 52.204-21. Protects Federal Contract Information (FCI). Annual self-attestation allowed. Covers basic cyber hygiene: access control, identification, media protection, physical protection, system communications, and system integrity.
Level 2 — Advanced
110 practices aligned to NIST SP 800-171. Required for contracts involving Controlled Unclassified Information (CUI). Tri-annual third-party assessment (C3PAO) required for most contracts. Covers 14 security domains including access control, audit, configuration management, incident response, and supply chain risk.
Level 3 — Expert
110+ practices aligned to NIST SP 800-172. Required for contracts involving the most sensitive CUI on DoD's highest-priority programs. Government-led assessments. Applies to a small subset of the defense industrial base.
System Security Plan (SSP)
All levels require a documented System Security Plan describing how you meet each practice. Level 2+ also requires a Plan of Action & Milestones (POA&M) tracking unmet requirements. These documents are reviewed by assessors.
Flow-Down Requirements
Prime contractors must flow CMMC requirements down to their subcontractors. If you receive CUI from a prime, you need the same level of certification as the prime. Subcontractor gaps can disqualify a prime's contract.
Scoping — What's In Your CUI Environment?
Defining your CMMC scope — the systems, people, and facilities that handle CUI — is one of the most critical (and misunderstood) steps. Incorrect scoping leads to either over-investment or audit failure.
CMMC Level 2 Security Domains
Level 2 maps to all 14 NIST SP 800-171 domains. Each domain contains specific practices your organization must implement and document.
| Domain | Practices (Level 2) | Common Gaps |
|---|---|---|
| Access Control (AC) | 22 practices | Least privilege enforcement, CUI access logging, remote access controls |
| Audit & Accountability (AU) | 9 practices | Centralized log collection, retention policies, review processes |
| Configuration Management (CM) | 9 practices | Baseline configurations, change control, unauthorized software blocking |
| Identification & Authentication (IA) | 11 practices | MFA enforcement, password complexity, privileged account management |
| Incident Response (IR) | 3 practices | Documented IRP, reporting to DoD DCSA, post-incident lessons learned |
| Maintenance (MA) | 6 practices | Controlled remote maintenance, sanitization before maintenance |
| Media Protection (MP) | 9 practices | CUI marking, portable media controls, sanitization procedures |
| Personnel Security (PS) | 2 practices | Screening procedures, termination procedures |
| Physical Protection (PE) | 6 practices | Facility access controls, visitor management, CUI workspace controls |
| Risk Assessment (RA) | 3 practices | Periodic risk assessments, vulnerability scanning cadence |
| Security Assessment (CA) | 4 practices | System security plans, POA&M management, control testing |
| System & Communications Protection (SC) | 16 practices | Network segmentation, encryption, boundary protection |
| System & Information Integrity (SI) | 7 practices | Malicious code protection, security alerting, software patching |
| Supply Chain Risk Management | Varies | Vendor vetting, software provenance, hardware integrity |
CMMC Readiness for manufacturers
Securafy is a CMMC-AB registered Registered Practitioner Organization (RPO), meaning our consultants are trained and authorized to assist with CMMC readiness — though we do not perform the final C3PAO certification assessment.
CMMC Scoping & Gap Assessment
We define your CUI environment, identify in-scope systems and assets, map your current practices against all 110 NIST 800-171 requirements, and produce a scored gap analysis with remediation priorities.
System Security Plan (SSP) Development
We write your complete SSP — the primary document reviewed by C3PAO assessors — documenting how each practice is implemented, partially implemented, or planned in your environment.
POA&M Management
We track all practice gaps in a Plan of Action & Milestones, with remediation timelines and responsible owners. We manage the POA&M actively through to closure — not just document it.
Technical Control Implementation
We implement the technical controls required by Level 2 — MFA, network segmentation, endpoint protection, SIEM, patch management, encryption, and access control — all maintained ongoing.
C3PAO Assessment Preparation
Before your certification assessment, we conduct a mock assessment against all 110 practices, identify remaining gaps, and prepare your team for assessor interviews and documentation reviews.
Ongoing CMMC Maintenance
Certification must be maintained. We provide continuous monitoring, quarterly control testing, policy updates, and annual reassessment readiness to keep your certification valid through your 3-year cycle.
CMMC 2.0 FAQ
Securafy for CMMC-Subject Manufacturers
Protect Your DoD Contract Eligibility
A complete briefing for manufacturers handling Controlled Unclassified Information (CUI) or subject to CMMC 2.0 / NIST SP 800-171. Understand exactly what Level 2 certification requires, what Securafy delivers, and how we protect the contracts your business depends on.
- CMMC 2.0 Level 1, 2 & 3 requirements explained
- All 110 NIST 800-171 practices — what they mean
- How Securafy implements and documents every control
- SSP development and POA&M management
- C3PAO assessment readiness process
- DoD contract protection and audit defense
★ Soteria Award — Most Trusted MSP in North America 2024
CMMC 2.0 requires DoD contractors handling Controlled Unclassified Information to implement and certify cybersecurity practices across three levels. Level 2 mandates all 110 NIST SP 800-171 controls and a third-party C3PAO assessment. Securafy delivers gap assessments, System Security Plan development, all 110 controls implemented and documented, and full C3PAO readiness for Ohio defense contractors and manufacturers.
Ready to Become
Audit-ready?
Securafy builds and maintains compliance programs for Columbus and Cleveland, businesses nationwide. Prevention-First. Compliance-Ready. Award-Winning.
Official Regulatory Resources
FREE · 30 MINUTES · NO SALES PITCH
See Exactly Where You're Exposed.
Before an Attacker Does.
Our free 47-point network and security assessment gives you a prioritised remediation report in plain language — no obligation, no upsell.
★ Soteria Award — Most Trusted MSP in North America 2024 · 30-Day Risk-Free Trial · 10-Minute Response Guarantee
Frequently Asked Questions
