Question 1

What CMMC level do I need for my organization?

Accepted Answer

The required CMMC level depends on the type of information you handle: Level 1 for Federal Contract Information (FCI) only, Level 2 for Controlled Unclassified Information (CUI), and Level 3 for CUI on high-priority programs requiring enhanced protection. If your CUI involves certain Defense categories, you'll need a C3PAO assessment rather than a self-assessment.

Question 2

Can I do a CMMC Level 2 self-assessment?

Accepted Answer

Most contractors cannot do self-assessments. Self-assessments are only allowed for CUI that falls completely outside the National Archive's CUI Registry Defense Organizational Index Grouping. Approximately 95% of defense contractors handling CUI will require third-party C3PAO assessments rather than self-assessments.

Question 3

How many contractors will be impacted by CMMC?

Accepted Answer

By Year 4 of implementation, 337,968 total entities are projected to be impacted. Level 1 self-assessment covers 209,540 entities (62%), Level 2 self-assessment covers 6,759 entities (2%), Level 2 C3PAO certification covers 118,289 entities (35%), and Level 3 DIBCAC certification covers 3,380 entities (1%).

Question 4

How long does CMMC certification take?

Accepted Answer

The timeline varies based on your current security posture and target level. Typically, organizations need 6-18 months to prepare for assessment if they've already implemented NIST SP 800-171 controls. An accelerated approach can significantly reduce this timeline through efficient gap remediation and documentation development.

Question 5

Do CMMC requirements flow down to subcontractors?

Accepted Answer

Yes, CMMC requirements flow down to subcontractors who will process, store, or transmit FCI or CUI. The subcontractor needs the appropriate CMMC level for the type of information they'll handle. You'll need to verify your subcontractors' CMMC status before contract award.

Question 6

What happens if I have a Conditional CMMC status?

Accepted Answer

Conditional status is allowed for Levels 2 and 3 for up to 180 days. You must successfully close out your Plan of Action and Milestones (POA&M) within this timeframe to achieve Final status. This allows you to bid on contracts while addressing minor gaps, but you must achieve Final status to maintain the contract.

Question 7

How often do I need CMMC assessments?

Accepted Answer

Level 1 requires annual self-assessments. Level 2 assessments (self-assessment or C3PAO) are required every 3 years. Level 3 assessments by DIBCAC are required every 3 years. All levels require annual affirmations in SPRS.

Question 8

What about existing contracts?

Accepted Answer

Contracting officers have discretion to add CMMC requirements to existing contracts. CMMC requirements will definitely apply to contract modifications, option exercises, and period of performance extensions. It's best to prepare now rather than risk losing contract opportunities later.

Question 9

Can you help if we've already started our CMMC journey?

Accepted Answer

Absolutely! Our à la carte services allow you to engage us at any point in your CMMC journey. Whether you need help with specific gaps, documentation, or assessment preparation, we can tailor our services to complement your existing efforts.

Question 10

What about C3PAO scheduling and the actual audit?

Accepted Answer

We help coordinate with C3PAO assessors and provide ongoing support throughout the scheduling process. C3PAO availability can vary significantly (often 6-12+ months). Our Fast Track Program gets you fully audit-ready within 3 months, allowing you to operate compliantly while waiting for your official assessment.

CMMC Level Assessment

CMMC Level Assessment