CMMC Level 1, 2 and 3 by RPO #1449.

What CMMC compliance actually requires

CMMC 2.0 has three levels. Level 1 is annual self-attestation against 17 basic safeguarding controls. Level 2 is the one most defense subcontractors actually need: a C3PAO-led assessment of all 110 NIST SP 800-171 controls, with a numeric SPRS score posted to the DoD's Supplier Performance Risk System. Level 3 stacks a subset of NIST SP 800-172 controls on top for contracts touching the most sensitive CUI.

If your prime contractor has flowed down a DFARS 252.204-7012 clause and you handle Controlled Unclassified Information, you need Level 2. Start with our CMMC compliance guide if you want the full lay of the land before scoping work. If you want the short version of where your gaps are right now, run the CMMC compliance checklist and the SPRS calculator in the same sitting.

Our CMMC engagement, step by step

We are a CMMC-AB Registered Practitioner Organization, RPO #1449. Every engineer assigned to your engagement is a CMMC-RP. We do not certify and we do not assess. C3PAOs do that, by design. What we do is take you from "we have a CUI flow-down clause" to "we are ready for the assessor" without burning twelve months of internal time figuring out what each control actually requires.

A typical engagement opens with a CMMC gap assessment against all 110 controls, including CUI boundary scoping and an SPRS score baseline. From there we close the technical gaps that almost always block Level 2: multifactor authentication on every required path (3.5.3), session lock and termination (3.1.10), risk assessment cadence (3.11.1), FIPS-validated encryption, audit logging that actually correlates, and the configuration management baseline. We author the System Security Plan and Plan of Action & Milestones, organize the evidence library, then run a mock C3PAO assessment against the same Conformity Assessment Procedures the real assessor will use.

If Level 2 is not the right scope for you

Not every contractor needs the full Level 2 path. Some only handle FCI and qualify for Level 1 self-attestation. Some can shrink scope dramatically by moving CUI into a separate enclave instead of certifying their whole tenant. Some are evaluating whether a managed-tenant offering is cheaper than building their own. We walk through those tradeoffs honestly in CMMC alternatives, and we do not pretend a Level 2 engagement is mandatory when it is not.