If you handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), CMMC is becoming a condition of winning — and keeping — DoD work. We scope, assess, and remediate your program against NIST SP 800-171 so you are ready for assessment, with a Microsoft-first approach built on Entra ID, Azure, and Zero Trust.
The DoD's Cybersecurity Maturity Model Certification — three levels, matched to the data you handle
For companies handling Federal Contract Information only. The 15 basic safeguarding practices in FAR 52.204-21, verified by annual self-assessment with results posted to SPRS.
For companies handling Controlled Unclassified Information. All 110 security practices in NIST SP 800-171 — and, for applicable contracts, certification by an authorized C3PAO assessment organization.
For the most sensitive CUI, adding selected NIST SP 800-172 practices against advanced persistent threats. Level 3 assessments are performed by the government's DIBCAC — we help Level 2 clients build toward it.
Where CUI actually lives decides what must comply. A tight boundary — often a dedicated enclave — can shrink the systems, people, and cost in scope dramatically. We scope before we sell you anything else.
The exact deliverables a C3PAO assessor will ask to see
FCI/CUI data-flow mapping, assessment boundary definition, and — where it cuts scope and cost — a CUI enclave design using Microsoft Azure, Entra ID, and virtual desktop patterns.
A control-by-control assessment against NIST SP 800-171 (Level 2) or FAR 52.204-21 (Level 1): what is implemented, what is partial, what is missing — with evidence, not opinions.
The formal SSP documenting your boundary, systems, and how each required practice is implemented — the document every assessment starts from.
A Plan of Action & Milestones for every gap, with owners and dates — plus your SPRS score calculated and ready to post, so contracting officers see an honest, current number.
Hands-on implementation of the technical and administrative controls: MFA and Conditional Access in Entra ID, endpoint and logging controls, incident response, security awareness training, and the full policy set.
A mock assessment against the official assessment objectives, evidence review, and coordination with an authorized C3PAO of your choice — so the real assessment holds no surprises.
Most of Level 2 is identity, endpoints, and logging — the stack we work in every day
Entra ID Conditional Access and MFA cover the identification, authentication, and access-control families. Microsoft Defender and Azure logging support audit, system integrity, and incident response. For CUI workloads, we advise on commercial Azure vs. GCC / GCC High — and when an enclave keeps your main environment out of scope entirely.
• Scope FCI/CUI and draw the assessment boundary
• Run the gap analysis and calculate your SPRS score
• Document the SSP and POA&M
• Implement controls, Microsoft stack first
• Mock-assess, fix, then hand off to your C3PAO
From first scoping call to assessment-ready in four phases — exact duration depends on your scope and starting point
FCI/CUI mapping, boundary definition, control-by-control gap analysis, and your initial SPRS score.
System Security Plan, POA&M with owners and dates, and the policy and procedure set mapped to each practice.
Technical and administrative control implementation — identity, endpoints, logging, incident response, training — with evidence collected as we go.
Mock assessment, final evidence review, C3PAO coordination — then ongoing monitoring and annual affirmations so compliance does not decay after the assessment.
Common questions answered
Yes, if FCI or CUI flows down to you. CMMC requirements flow down through the supply chain: your prime must ensure subcontractors handling FCI/CUI meet the level the contract requires. Expect to be asked for your SPRS score and, increasingly, your certification status before award.
No — and be cautious with anyone who offers to both prepare and certify you. Certification assessments are performed only by authorized C3PAOs, and a firm cannot assess a client it prepared. We prepare you, then coordinate with a C3PAO of your choice for the assessment itself.
It depends on the data in your contracts. FCI only means Level 1: the 15 FAR 52.204-21 practices and an annual self-assessment. Handling CUI means Level 2: all 110 NIST SP 800-171 practices, with third-party C3PAO certification for applicable contracts under the phased rollout. Scoping is how we confirm which applies to you.
Your self-assessment score against the NIST SP 800-171 practices, calculated with the DoD scoring methodology (starting at 110, with deductions per missing practice) and posted to the Supplier Performance Risk System. Contracting officers use it to evaluate supplier risk. We calculate yours as part of the gap analysis — honestly, including a negative starting score if that is where you are.
It depends on your scope and starting controls. A small, well-scoped environment with Microsoft 365 already in place moves far faster than a sprawling on-premises network. That is why we scope and gap first: you get a realistic timeline in the POA&M, not a generic promise.
Not always. GCC High is required in specific cases (for example, certain export-controlled data), but many contractors meet Level 2 in commercial Microsoft cloud with the right configuration — or in a dedicated enclave. We evaluate your contract types and data first, then advise, so you do not buy the most expensive option by default.
Build a comprehensive security and compliance program
The same controls, mapped once — SOC 2 for your commercial buyers.
An ISMS that shares evidence and controls with your CMMC program.
Senior security leadership to run compliance day to day.
Start with scoping and a gap analysis — know exactly where you stand before Phase 2 deadlines reach your contracts.
s@onpointe.us | (201) 720-1663