Ultimate Guide To CMMC 2.0: The Paperback That Demystifies Defense Contract Compliance

What the guide walks you through

The book takes the certification journey in the order you will actually live it. It starts with orientation: what CMMC 2.0 is, how it differs from the original five-level model, and how the three current levels map to the kind of information your contracts touch. Federal Contract Information puts you in Level 1 territory with its fifteen basic safeguarding requirements and an annual self-assessment. Controlled Unclassified Information moves you to Level 2 and the 110 security requirements of NIST SP 800-171, assessed either by self-assessment or by a certified third-party assessment organization depending on the contract. The highest-sensitivity programs add Level 3 requirements on top. Petronella Technology Group consults on all three levels, and the book treats all three seriously rather than pretending every reader is a Level 1 shop.

From there it gets practical. How to scope your environment so you are not dragging your entire network into an assessment that only needs to cover where sensitive data actually lives. How to run a gap assessment against the controls honestly, score it, and report your score in the Supplier Performance Risk System, which contracting officers check before award. How to build the two documents that carry an assessment: the System Security Plan that describes how each control is met, and the Plan of Action and Milestones that tracks what is not yet done. How to prepare for the assessment itself, what assessors ask for, and the evidence habits that make the difference between a smooth review and a stalled one.

Two threads run through every chapter. The first is mistake avoidance: the guide catalogs the errors that reliably delay certifications, from scoping the environment wrong, to treating the System Security Plan as a copy-paste exercise, to discovering mid-assessment that a cloud service in the data path was never evaluated. The second is cost control. The book's stated goal is to save readers thousands of dollars in unnecessary consulting fees by showing which parts of the journey a motivated contractor can genuinely handle internally, and which parts justify bringing in help. That candor about where consultants add value, written by someone who runs a consultancy, is the reason the book converts readers into informed clients rather than confused ones.

Where CMMC stands right now, and why the book still matters

CMMC has never stood still, and 2026 proved it again. On July 13, 2026 the Department of War announced the immediate suspension of the program's Phase II requirements, which had been scheduled for November 2026, while it conducts a comprehensive review aimed at reducing barriers for small and non-traditional businesses. Headlines about that suspension have led some contractors to conclude that CMMC is going away. Read the announcement carefully and it says the opposite: all Phase I self-assessment requirements remain firmly in place. Contractors handling Federal Contract Information still self-assess annually. Contractors handling Controlled Unclassified Information still assess against NIST SP 800-171 and still report their scores in SPRS. The contractual obligation to protect covered defense information under DFARS 252.204-7012 never paused at all.

That is precisely why a fundamentals-first guide holds its value through program turbulence. The Ultimate Guide To CMMC 2.0 is anchored in the NIST SP 800-171 control set and the practical work of scoping, gap assessment, documentation, and evidence, and none of that changed in July. Whatever shape the reformed program takes, the contractors who did the underlying security work will be ready for it, and the ones who used the pause as an excuse will be scrambling again. The book's advice on getting ahead of requirements while competitors wait is arguably more relevant during a review period than it was before one.

For the current state of the program and what it means for your contracts, pair the book with our continuously updated CMMC compliance services hub and the write-up of our own 110/110 SPRS Level 2 self-assessment, which shows the full process applied to a real organization: ours.

Book details

About the author

Craig Petronella founded Petronella Technology Group, Inc. in 2002 and has spent more than two decades securing businesses that cannot afford to get it wrong: defense contractors, medical practices, law firms, and manufacturers. He is a CMMC Registered Practitioner, a Cisco CCNA and Certified Wireless Network Expert, a licensed Digital Forensic Examiner (NC license 604180-DFE), and MIT-certified in AI and Blockchain. The firm he leads is a CMMC-AB Registered Provider Organization (RPO #1449) whose entire consulting team holds the CMMC Registered Practitioner credential, and it has held a BBB A+ rating since 2003.

The Ultimate Guide To CMMC 2.0 is one of more than a dozen books Craig has written on cybersecurity and compliance, a catalog that has reached Amazon best-seller status and spans ransomware defense, HIPAA compliance, and practical IT guidance for business owners. Browse the full collection on the books page, or read more about Craig's background and credentials.

Buying for a team, a prime, or a supply chain

A meaningful share of orders for this book are not single copies. Primes buy it for the subcontractors whose compliance posture affects their own contracts. Contracts managers buy copies for engineering leads so that CMMC conversations start from shared vocabulary. MSPs and consultants hand it to clients as a primer before an engagement begins, because a client who understands scoping and SPRS scoring wastes far fewer billable hours. The checkout supports up to ten copies per order with free US shipping on all of them; for larger quantities, distributor questions, or anything international, call (919) 348-4912 and we will sort it out directly.

And if reading the book convinces you that your environment needs more than a book, that is what the firm behind it does all day: gap assessments, remediation, enclave architecture, and assessment preparation through our CMMC readiness assessment. The book will have already taught you exactly what to ask us.

The vocabulary the book will make second nature

Part of what makes CMMC intimidating is that the conversation arrives pre-loaded with acronyms, and every one of them carries contractual weight. These are the terms the guide grounds you in, because you cannot scope, budget, or negotiate around words you cannot define.

FCI, Federal Contract Information, is information provided by or generated for the government under contract that is not intended for public release. If you hold a DoD contract at all, you almost certainly handle FCI, and FCI is what puts you in scope for Level 1. CUI, Controlled Unclassified Information, is the more sensitive tier: unclassified information that law or policy requires you to safeguard, from technical drawings to export-controlled data. CUI is what triggers Level 2 and the full NIST SP 800-171 control set. NIST SP 800-171 itself is the publication that defines the 110 security requirements for protecting CUI in nonfederal systems; it is the backbone of Level 2 and the yardstick every assessment measures against.

SPRS, the Supplier Performance Risk System, is the government database where your self-assessment score lives, on a scale that runs from negative 203 to a perfect 110. Contracting officers can and do look before award. The SSP, System Security Plan, is the document that describes your environment and states how each control is implemented; the POA&M, Plan of Action and Milestones, is its honest companion, listing what is not yet done and when it will be. A C3PAO is a certified third-party assessment organization, the only kind of body that can conduct a Level 2 certification assessment. An RPO, Registered Provider Organization, is a consultancy vetted by the CMMC ecosystem's accreditation body to advise contractors; Petronella Technology Group holds RPO #1449. The book puts each of these in context so that when a prime, an assessor, or a consultant uses them, you are evaluating the sentence rather than decoding it.

How readers get the most from it: read once, then work it

The guide is short enough to read in an evening, and that first pass is worth doing cover to cover just to build the map. The value compounds on the second pass, when you read with your own environment in mind and turn chapters into actions. A rhythm that works for many contractors: spend the first week on scoping, drawing the boundary around where FCI and CUI actually live and flow in your business, because every later decision inherits from that boundary. Spend the next stretch on the gap assessment, walking the controls honestly against what you actually do today rather than what your policies say. Then move to documentation, getting a real System Security Plan and POA&M on paper, and score yourself for SPRS. Only after that does it make sense to decide what to remediate in-house, what to re-architect, and what to bring in help for.

Worked that way, the book functions as the agenda for your first quarter of compliance effort. Teams that read it together report the least friction: when the owner, the contracts manager, and the IT lead share the same mental model of what an assessor will ask, the internal arguments get shorter and the budget conversations get concrete. That is also why multi-copy orders are common enough that the checkout supports them directly.

What compliance actually buys you

The book's subtitle promises access to millions in government contracts, and it is worth being precise about what that means, because it is not marketing gloss. The Department of Defense obligates enormous sums to private contractors every year, and the flow-down structure of defense work means those dollars reach machine shops, electronics manufacturers, logistics firms, software teams, and engineering consultancies far below the prime level. What gates a smaller company out of that work is rarely capability. It is eligibility: the self-assessment never filed, the SPRS score a prime will not accept, the security questionnaire that goes unanswered because nobody knows what the honest answer would reveal. Compliance work is eligibility work.

Seen through that lens, a $17.99 book and the internal effort it organizes are not a cost center; they are the cheapest business-development spend a defense supplier can make. The contractor who can answer a prime's security questionnaire the same week it arrives, show a defensible SPRS score, and produce a System Security Plan on request is simply an easier company to award work to. That is the position the guide is designed to move you toward, and the reason it frames every control discussion in terms of contracts won rather than boxes checked. Compliance done grudgingly is overhead. Compliance done deliberately is a moat, because every competitor who put it off is now behind you in a queue that got longer while they waited.

Beyond the last page: templates and the ComplianceArmor® bot

The guide does not strand you at the back cover. Inside, readers will find pointers to templates and insider strategies for accelerating the documentation work, and details on ComplianceArmor® Bot, the AI-powered CMMC compliance assistant available separately from Petronella Technology Group for readers who want interactive help working through the process the book describes. The book stands alone, and nothing in it requires buying anything else; the additional resources exist for the readers who finish it and want to keep moving at the same pace. That progression, from a $17.99 paperback, to self-service tooling, to a full ComplianceArmor® compliance documentation platform subscription or a consulting engagement, is deliberate: you engage at exactly the depth your environment, timeline, and budget actually require, and not one step earlier than the work demands.

Paperback, Kindle, or the free copy: which should you get?

The paperback on this page is the edition most buyers want: a physical working copy you can mark up, hand across a desk, and keep next to the contract file, shipped free anywhere in the US for $17.99. The Kindle edition on Amazon suits readers who want it on a screen in the next five minutes. And if you are a Department of Defense contractor or subcontractor, you may not need to pay at all: our free CMMC book program ships qualifying DIB organizations a paperback at our expense, because a contractor who understands the process described in this book tends to become a client when the process gets hard. The paid page you are reading exists for everyone that program does not fit: consultants and MSPs, students and career-changers studying for security roles, primes ordering copies for their supply chain, and anyone who would simply rather buy the book than fill out a qualifying form. Same book, same 111 pages, whichever door you come through.