Know Your CMMC Readiness Before You Affirm in SPRS

A CMMC (Cybersecurity Maturity Model Certification) assessment evaluates your organization's cybersecurity practices against DoD requirements. If you handle Federal Contract Information (FCI), Level 1 applies: an annual self-assessment against the 15 FAR 52.204-21 requirements, affirmed in SPRS. If you handle Controlled Unclassified Information (CUI), Level 2 applies: the 110 NIST SP 800-171 requirements, assessed by self-assessment or by a C3PAO depending on the contract. Our readiness assessment shows where you stand before you affirm in SPRS or schedule a C3PAO.

Timing depends on the size of your CUI boundary and how much documentation you already have. We confirm the delivery schedule in writing with your fixed-scope quote, before any work starts.

Our assessment covers CMMC Level 2, which aligns with all 110 NIST SP 800-171 security requirements. This is the level required for most defense contractors handling CUI. We also address Level 1 (the 15 FAR 52.204-21 requirements) as a subset. Level 1 is a self-assessment; there is no certification at Level 1.

A C3PAO is an organization authorized by the Cyber AB to conduct CMMC Level 2 certification assessments. Petronella Technology Group, Inc. is not a C3PAO. We are a Registered Provider Organization (RPO #1449): we prepare you, identify gaps, and help you fix them, so you walk into a self-assessment or a C3PAO assessment knowing where you stand.

You'll receive a prioritized remediation roadmap with estimated timelines and costs for each gap. During your 60-minute consultation, a CMMC Registered Practitioner on our team will walk you through the findings and answer questions. If you need help implementing fixes, we offer managed remediation services.

Absolutely. We handle all assessment data in our secure environment. All documents are encrypted in transit and at rest. We sign NDAs before any engagement and follow strict data handling procedures aligned with NIST 800-171 ourselves.

CMMC Phase 1 is in effect: DoD solicitations can require a current Level 1 or Level 2 self-assessment affirmed in SPRS. Phase 2, which would add C3PAO certification requirements, was suspended on July 13, 2026 (Department of War memo 26-P-1023) pending CMMC Reform Task Force review. DFARS 252.204-7012 and SPRS score reporting remain in force, so if you hold or plan to bid on DoD contracts, an accurate readiness picture matters now.