If you cannot find information about a compliance topic, please contact us for free support.
What is CMMC Compliance?
Let’s Cut Through the Confusion
If you’re a defense contractor and you’ve heard about CMMC, you’re probably thinking: “Great, another compliance hoop to jump through.” We get it. But here’s the thing—CMMC is actually a big deal, and understanding it now will save you headaches (and money) down the road.
The Simple Answer to CMMC Compliance
CMMC stands for Cybersecurity Maturity Model Certification. It’s the Department of Defense’s way of making sure everyone in the defense supply chain is protecting sensitive information. Think of it as a security clearance, but for your company’s IT systems.
Why Does CMMC Exist?
Here’s the reality: foreign adversaries have been stealing sensitive defense information for years by targeting contractors—especially small ones. The DoD realized they couldn’t just trust everyone to handle cybersecurity on their own anymore. So they created CMMC to verify that contractors actually have proper security measures in place.
It’s not about bureaucracy (well, not entirely). It’s about protecting our national security and making sure sensitive defense information doesn’t end up in the wrong hands.
Who Needs CMMC?
The short answer: If you do business with the DoD, you need CMMC.
The longer answer: It depends on what kind of information you handle:
- Just public information? You might not need certification at all.
- Federal Contract Information (FCI)? You’ll need CMMC Level 1.
- Controlled Unclassified Information (CUI)? You’ll need CMMC Level 2.
FCI is basic information related to a contract—things like contract terms, pricing, delivery schedules. CUI is more sensitive stuff—technical data, blueprints, specifications, and anything marked with distribution statements.
The Three Levels Explained
Level 1: Foundational
This is the entry level. It covers 17 basic cybersecurity practices—things like using antivirus software, changing default passwords, and limiting who can access your systems. Most small contractors handling FCI will need this level.
You can self-attest for Level 1 (meaning you certify your own compliance), but you need to actually implement the controls. Don’t just check boxes.
Level 2: Advanced
This is the big one. It requires all 110 security controls from NIST SP 800-171. This is for contractors handling CUI. You’ll need a third-party assessment organization (C3PAO) to verify your compliance.
Level 2 is no joke—it requires real investment in your cybersecurity infrastructure, policies, and training.
Level 3: Expert
This is for contractors working on the most sensitive programs. Unless you’re in that world, you probably don’t need to worry about Level 3 yet.
What This Means for Your Business
You Can’t Just Wing It
Gone are the days of self-certifying NIST 800-171 compliance on your word alone. CMMC requires actual assessments and proof.
It’s Going to Cost Money
Between implementing security controls, fixing gaps, documentation, and the assessment itself, you’re looking at real costs. For small contractors, Level 1 might run a few thousand dollars. Level 2 can easily hit $20K-$100K+ depending on your current state.
You’ll Need It to Bid
CMMC requirements are being written into new DoD contracts. No certification = no contract. It’s that simple.
There Are Deadlines
The DoD is phasing CMMC into contracts now. The exact timeline keeps shifting, but the message is clear: get certified sooner rather than later.
What You Actually Need to Do
Step 1: Figure out your level Look at the types of information you handle. FCI or CUI? That determines whether you need Level 1 or Level 2.
Step 2: Do a gap assessment Compare your current security practices against the CMMC requirements. Where do you fall short?
Step 3: Create a plan of action Document what you need to fix and in what order. Prioritize the big gaps first.
Step 4: Implement the controls Actually do the work—update your systems, create policies, train your team, document everything.
Step 5: Get assessed For Level 1, you can self-attest (for now). For Level 2, you’ll need to hire a C3PAO to conduct the official assessment.
Step 6: Get certified Pass your assessment and receive your CMMC certificate, which is good for three years.
Common Questions
“Can’t I just hire someone to handle this?” Yes and no. You can hire consultants to help you prepare, but your team needs to actually implement and maintain the controls. You can’t outsource accountability.
“What if I’m a subcontractor?” You still need CMMC if you handle FCI or CUI. Prime contractors will flow down CMMC requirements to their supply chain.
“How long does it take?” It varies wildly. If you’re already doing cybersecurity well, maybe a few months. If you’re starting from scratch, expect 6-12 months or more.
“What happens if I don’t get certified?” You won’t be able to bid on contracts that require CMMC. Eventually, that will be most DoD contracts.
The Bottom Line
CMMC isn’t going away. It’s the new reality for defense contractors. The sooner you start preparing, the better positioned you’ll be to keep winning contracts.
Yes, it’s work. Yes, it costs money. But think of it as an investment in your company’s future—and as doing your part to protect national security.
Need help getting started? That’s what we’re here for. CMMC doesn’t have to be overwhelming when you have someone in your corner who speaks your language.
Free tools
Get to an honest number faster
You will run this more than once: after any material change to your environment, and again before every annual affirmation. Both are free, and both are yours to keep.
Neither is a certified assessment, and neither pretends to be.
The audit is gone. The liability isn't.
Greypike runs the environment your CUI lives in and owns the compliance outcome that proves it's protected. If you are not certain your environment supports the score sitting in SPRS next to your CAGE code, that is the conversation to have.
Talk to Greypike about SPRS Attestation Assurance