CMMC and NIST 800-171 are not the same thing. Most contractors need both.

NIST SP 800-171 is the control set. It defines the 110 security requirements you must implement to protect Controlled Unclassified Information. CMMC is the assessment framework used to evaluate whether those requirements have actually been implemented. For most organizations handling CUI the destination is CMMC Level 2, assessed against those same 110 requirements. You do not choose between them; if one applies to you, so does the other.

It is decided by what data you handle under the contract. Federal Contract Information alone generally points at Level 1. Controlled Unclassified Information points at Level 2, which is where most Defense Industrial Base contractors land, and which is assessed against the 110 requirements in NIST SP 800-171. Level 3 builds on NIST SP 800-172 and is aimed at organizations supporting the most sensitive programs. The contract language decides it, not the size of your company, so send us the clause rather than guessing from revenue.

It is your self-assessment score against NIST SP 800-171, maintained in the Supplier Performance Risk System and visible to the contracting officers deciding whether you are eligible to bid. It is also affirmed by a named senior official, which makes it a representation to the government rather than an internal metric. A score entered optimistically and never corrected is a different category of problem to an incomplete program, and it attaches to that individual. If yours is stale or was generous, correcting it is the right move.

The honest answer on a first call is a range rather than a date, because the driver is rarely the framework. It is how much of your CUI is already contained, how much evidence already exists, and how much of your team's week is available. What we can tell you quickly is how big your scope really is once someone looks at where the CUI actually goes, and that single answer moves the timeline more than anything else on this page.

Not necessarily, and plenty of contractors do not. The enclave exists for organizations whose CUI has nowhere defensible to sit today, typically because it is spread across ordinary email, laptops and file shares. If your CUI is already contained in a boundary you can describe and defend, the Compliance App on its own is the right answer and we will tell you that. The enclave narrows your CMMC assessment boundary; it does not replace the program that runs inside it.

No. Greypike does not perform CMMC certification assessments. We prepare you for the assessment, maintain the program between assessments, manage evidence and documentation, and operate a compliant environment for CUI. Formal assessments are conducted by authorized C3PAOs. That separation keeps the assessment independent, and it means we have no commercial reason to tell you anything other than where you actually stand.

No. Neither CMMC Level 2 nor NIST SP 800-171 requires penetration testing, and this is one of the most common and most expensive misunderstandings in the defense market. CMMC Level 3 builds on NIST SP 800-172, where testing features far more prominently. You may still choose to test for other reasons, but check the source before you buy one on the strength of a Level 2 requirement that does not exist. See what actually requires a penetration test.

That is the case the platform is built for. Most Defense Industrial Base contractors under a few hundred people have no compliance team at all, and CMMC lands on an IT manager, a program manager, a facility security officer or the owner. Requirements arrive as assigned tasks with an owner, a due date and a definition of done, so nobody has to translate control language into work, and a credentialed practitioner reviews what gets submitted before an assessor sees it.