Home / Services / CMMC

CMMC Assessments

CMMC Assessments for the Defense Industrial Base

Independent, objective CMMC Level 2 certification assessments from an authorized C3PAO, for defense contractors and subcontractors that handle Controlled Unclassified Information.

Request a Consultation Speak with Our Team

Independence Integrity A stronger defense tomorrow

Level 3EXPERTLevel 2ADVANCEDLevel 1FOUNDATIONAL

What is CMMC and NIST SP 800-171?

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense program that verifies contractors protect sensitive federal information. It is codified at 32 CFR Part 170 and reaches contracts through DFARS clause 252.204-7021. CMMC doesn’t add new security requirements; it verifies existing ones.

  • Level 1 draws on the 15 safeguarding requirements in FAR 52.204-21.
  • Level 2 draws on the 110 requirements in NIST SP 800-171.
  • Level 3 adds selected requirements from NIST SP 800-172.

Who does CMMC apply to?

Prime contractors and subcontractors in the Defense Industrial Base that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The required level is set in the solicitation and flows down the supply chain.

Outside defense, agencies, universities, and private companies often require NIST SP 800-171 in their own agreements.

CMMC maturity levels

Three Levels. A Stronger, More Secure Defense Industrial Base.

CMMC sets three levels of cybersecurity requirements, based on the type of information a contractor handles and the associated risk. Your contract sets the level.

Level 1

Foundational

Annual self-assessment of basic safeguarding practices for companies that handle only Federal Contract Information (FCI).

Assessed by
Your organization, annually
Requirements
15, from FAR 52.204-21
POA&Ms
Not permitted

Level 2

Advanced

Assessment by an authorized C3PAO every three years, with an annual affirmation, for companies that handle Controlled Unclassified Information (CUI).

Assessed by
A C3PAO, every 3 years, or self-assessment where the contract allows
Requirements
110, from NIST SP 800-171
POA&Ms
Limited, closed within 180 days

Level 3

Expert

Government-led assessment by DIBCAC for companies that handle highly sensitive CUI and face elevated risk.

Assessed by
DIBCAC, every 3 years
Requirements
Level 2 plus selected NIST SP 800-172
POA&Ms
Limited, closed within 180 days

Key information types

Understanding FCI and CUI

The type of information you handle decides which level applies.

FCI: Federal Contract Information

Information provided by or generated for the government under a contract that is not intended for public release. Protecting only FCI points to Level 1.

CUI: Controlled Unclassified Information

Information the government requires to be safeguarded or controlled under law, regulation, or policy. Handling CUI points to Level 2 or Level 3.

Our assessment process

A Clear Path to Compliance

  1. 1

    Engage

    We start with a conversation about your contracts, the information you handle, and the level you need.

  2. 2

    Plan

    We confirm the assessment boundary, schedule, and evidence requests. Your team is responsible for scoping and for having evidence ready.

  3. 3

    Assess

    Our certified assessors review documentation and evidence, interview your staff, and validate each requirement against NIST SP 800-171, using the assessment objectives in NIST SP 800-171A.

  4. 4

    Report

    You receive the assessment results, including any requirement that was not met.

  5. 5

    Certification status

    For Level 2 certification assessments, we upload the results to CMMC eMASS, and your certification status is then reflected in SPRS.

Get started

Request a Consultation

Tell us about your contracts and environment, and a partner will be in touch.

We use your details only to respond to your request. See our Privacy Policy.

Who it applies to

Built for the Defense Industrial Base

CMMC requirements apply across the defense supply chain, wherever FCI or CUI is processed, stored, or transmitted.

  • Prime defense contractors

    Organizations with direct contracts from the Department of Defense.

  • Subcontractors

    Companies that support prime contractors and handle FCI or CUI. Requirements flow down at every tier.

  • Suppliers

    Manufacturers and suppliers that provide products or services under DoD contracts.

  • Service providers

    IT, cloud, and other providers that process, store, or transmit FCI or CUI for defense contractors.

Our certified assessors

Experienced. Independent. Trusted.

Our CMMC assessments are led by assessors who hold the CMMC Certified Assessor credential.

  • Mark Larson

    Partner

    CISSP, CISA, QSA, CMMC Lead Certified Assessor (Lead CCA), CCP, ISO 27001 Lead Auditor

    Specializes in SOC examinations, after six years at Ernst & Young and leadership roles in internal audit, technology, and security.

  • Lois Colby

    Partner

    CPA, CIA, CISA, CCSK, CMMC Lead Certified Assessor (Lead CCA), ISO 42001 Lead Auditor, ISO 27001 Lead Auditor

    Specializes in SOC, HIPAA, ISO, CMMC, and CSA STAR audits, with a career that began at Ernst & Young in 1989.

  • Richard Rieben

    Partner

    CISSP, CCSFP, CHQP, GSNA, QSA, CySA+, SecurityX, CMMC Lead Certified Assessor (Lead CCA), CCP

    HITRUST practice lead with over 20 years in IT and cybersecurity, leading HITRUST, SOC, CMMC, PCI DSS, and NIST assessments.

  • Naomi Bell

    Managing Director

    CPA, CISA, PMP, CMMC Certified Assessor (CCA), ISO 27001 Lead Auditor

    More than 10 years as an IT auditor in the private and government sectors, performing SOC audits, NIST 800-171 assessments, and ISO/IEC 27001 certification audits.

  • The Cyber AB Authorized C3PAO mark: view our listing in the Cyber AB Marketplace (opens in a new tab)

    Authorized C3PAO

    Linford & Company is an authorized C3PAO for CMMC Level 2 certification assessments.

Frequently asked questions

Common Questions About CMMC Assessments

What is a C3PAO?

A CMMC Third-Party Assessment Organization (C3PAO) is a firm accredited by the Cyber AB to perform CMMC Level 2 certification assessments. Linford & Company is an authorized C3PAO. A C3PAO is not the same as a FedRAMP 3PAO: the two programs have separate requirements and separate oversight.

Which CMMC level do we need?

Your contract determines it. Level 1 applies when you handle only Federal Contract Information (FCI). Level 2 applies when you handle Controlled Unclassified Information (CUI), and the contract specifies whether a self-assessment or a C3PAO certification is required. Level 3 applies to a smaller set of programs and is assessed by the government.

How long is a Level 2 certification valid?

Three years. A senior official must also affirm continued compliance after each assessment and annually.

Can we have open items and still pass?

At Levels 2 and 3, a limited set of requirements can be placed on a Plan of Action and Milestones (POA&M), which must be closed within 180 days. Level 1 does not allow POA&Ms.

What drives the effort of an assessment?

Mostly your environment. The size of the boundary, the number of systems, people, and providers in scope, and how well documented your controls are all matter.

From the blog

Learn more from our auditors

Visit the blog →

Ready to strengthen your compliance posture?

Let's Build a More Secure Tomorrow

Talk with a partner about your CMMC level, scope, and timeline.

Request a Consultation