CMMC 2.0 (Cybersecurity Maturity Model Certification) applies to companies in the DoD supply chain that handle Controlled Unclassified Information (CUI). NIST 800-171 obligations apply now; CMMC Level 2 certification timing is under review (third-party CMMC Phase 2 certification is suspended pending review as of July 2026). The level that will apply (Level 1, 2, or 3) depends on the sensitivity of the CUI you handle — Securafy keeps you NIST 800-171 compliant and certification-ready.
Level 1 covers 17 basic cybersecurity practices and allows self-assessment. Level 2 covers all 110 NIST SP 800-171 practices and requires a third-party C3PAO assessment for most contracts. Securafy supports both — and can help you determine which level applies to your specific DoD work.
Most organizations require 6–12 months to achieve Level 2 readiness from initial gap assessment to C3PAO assessment. Securafy conducts the gap assessment, prioritizes remediation, implements required controls, builds the SSP and POA&M, and prepares you for the C3PAO assessment. Organizations with stronger existing controls can move faster.
Book your complimentary 47-point assessment. No obligation. Securafy engineers respond within 10 minutes, 24/7.
Soteria Award 2024 · Zero Ransomware Incidents · 35+ Years of Excellence