CMMC Compliance Services for Defense Suppliers

No, and no MSP can. Level 2 certification comes only from an assessment by an authorized C3PAO (CMMC Third-Party Assessment Organization), and Level 3 assessments are government-led. Our role is everything before and after that visit: scoping, gap assessment against NIST 800-171, remediation, documentation, and the managed security that keeps you assessment-ready. The separation between preparers and assessors is deliberate — be wary of anyone who blurs it.

The data decides. Federal contract information (FCI) generally means Level 1 — 15 basic safeguarding requirements with an annual self-assessment and executive affirmation. Controlled unclassified information (CUI) generally means Level 2 — the 110 requirements of NIST SP 800-171, with C3PAO assessment for most contracts and self-assessment allowed for a smaller set. Level 3 adds 24 requirements from NIST SP 800-172 with government-led assessment, for the most sensitive programs. Your solicitation states the required level.

For most small suppliers, the honest answer is quarters, not weeks. The 110 requirements include policy, documentation, and evidence work as well as technical fixes — and while the November 2026 third-party phase-in was suspended in July 2026, the underlying NIST 800-171 obligation under DFARS 252.204-7012 never paused. Starting after a solicitation names CMMC is usually starting late.

It depends almost entirely on scope — which is why scoping comes first. Many suppliers save real money with an enclave strategy: concentrating CUI into a contained, hardened environment so the 110 controls apply to one enclave instead of the whole company. The managed-security base is Secure IT at $250 per user per month, and CMMC/DFARS work carries a published +25% uplift on the per-user plan and per-server management — $312.50 per user — covering the system security plan, plan of action and milestones, and assessment support. The one-time 800-171 gap assessment and remediation projects are quoted in writing after the initial gap read.

The System Security Plan is the document that explains how your environment meets each of the 110 requirements — it is the artifact your assessor works from, alongside a plan of action for open items (POA&M) and your SPRS score. That score carries a senior official's affirmation, which is a legal statement the Department of Justice's Civil Cyber-Fraud Initiative has shown it takes seriously. We help build and maintain all three so they reflect reality.

If FCI or CUI flows down to you, yes. Primes are required to flow CMMC requirements to subcontractors, and many are already asking for SPRS scores and remediation plans ahead of contract deadlines because their own awards depend on the answers. A machine shop with one drawing of CUI on a shared drive is in scope.

Short answer: no. Under DFARS 252.204-7012, a cloud that stores, processes or transmits CUI must be FedRAMP Moderate authorized, or validated as FedRAMP Moderate equivalent by a third-party assessor. CRC Cloud's private cloud is neither. Datacenter credentials like SOC 2 and ISO 27001 are facility facts. They do not satisfy that rule, and a provider who implies otherwise is setting you up to fail. CUI belongs in an environment built for it, such as Microsoft 365 GCC High — and what we do is run that environment for you.

We prepare it, close the gaps we find, and organize the evidence. The goal is that the assessment becomes a confirmation rather than a discovery exercise — but it is an independent judgement, and we will never call it a formality. If the assessor still flags something, we remediate it fast. Our private cloud is the right home for everything that never touches CUI. Splitting the two is usually the cheapest way to shrink your scope.

Far less than most suppliers assume, and the rule is specific. Under 32 CFR 170.21, a plan of action and milestones is not permitted at all for a Level 1 self-assessment. At Level 2 you may only carry one if your assessment score is at least 0.8 of the total — 88 of the 110 requirements — and nothing on the plan is worth more than 1 point under the CMMC scoring methodology. Since 3-point and 5-point requirements make up most of the hard ones, they must be genuinely met before the assessor scores them.

There is one narrow exception: CUI encryption (SC.L2-3.13.11) may go on the plan if you are encrypting but not yet with a FIPS-validated module. Six 1-point requirements are barred outright — external connections, control of public information, the System Security Plan itself, escorting visitors, physical access logs, and managing physical access. And a plan only earns you Conditional status: a closeout assessment must confirm the items are closed within 180 days of the conditional status date, or that status expires.

For a certification assessment the closeout must be done by an authorized C3PAO. In practice this means the plan is for the last few loose ends, not a way to defer the work.

Yes, and you should expect that of any provider worth hiring. Under 32 CFR 170, an external service provider is in scope when controlled unclassified information or security protection data is processed, stored or transmitted on its systems. Security protection data is the second trigger people miss — the logs, alerts, vulnerability findings, backup metadata and identity records that our monitoring and management tools hold. That means we are usually in scope even on engagements where no CUI ever reaches us.

The rule requires our relationship and the services we provide to be described in your System Security Plan, and it requires us to give you a customer responsibility matrix: a line-by-line statement of which of the 110 requirements we implement, which you implement, and which are shared and how. We produce that matrix as a named deliverable of the engagement, we keep it current as the environment changes, and we hand it to your assessor with the evidence behind it. If a provider cannot give you one, they are not ready to support a CMMC assessment.