CMMC 2.0 readiness assessment

The information decides, and the solicitation confirms. If you only handle FCI, Level 1 applies. If you handle CUI, Level 2 applies, and the solicitation states whether a self-assessment or a C3PAO certification assessment is required. Level 3 is identified by the DoD for specific programs. Readiness reads your contracts, your CUI flows and the clauses your prime flows down, and gives you a written answer rather than a guess.

No. Level 2 certification assessments are performed only by C3PAOs authorized by the Cyber AB, and Level 3 assessments only by DIBCAC. CyberlySecure is not a C3PAO and holds no Cyber AB designation. That separation works in your favor: a C3PAO can’t consult for a company it assesses, so readiness and assessment have to come from different firms anyway, and we stay on your side throughout.

Both measure the same 110 requirements and the same NIST SP 800-171A objectives. In a self-assessment, you score yourself and your senior official affirms the result in SPRS. In a certification assessment, an independent C3PAO examines your documents, interviews your people and tests your systems before issuing a status. The contract decides which one you face, but the preparation is identical: a self-assessment that wouldn’t survive a C3PAO is a liability, not a shortcut.

Sometimes. At Level 2, you can reach Conditional status if your score meets the minimum the rule sets — 88 of a possible 110 points — and every open item is one the rule allows on a POA&M. Higher-weighted requirements generally can’t be deferred, and conditional status expires unless a POA&M close-out assessment confirms the gaps are closed in the window the rule sets. Level 1 allows no POA&M at all. Readiness tells you early which gaps you must close before the assessment, not after.

Not necessarily. Any cloud service that stores, processes or transmits CUI must be FedRAMP Moderate authorized or meet FedRAMP Moderate equivalency as the DoD defines it, and export-controlled data adds its own restrictions on who can access it. Many companies move CUI to a government cloud tenant; others keep it in a tightly scoped enclave or a different authorized service. Readiness weighs those options against your contracts, your data and your people.

CMMC Level 2 assesses against Rev 2, as the program rule specifies, and the DoD has kept DFARS contracts on Rev 2 for now through a class deviation. For now, build and assess to Rev 2, and note where Rev 3 changes the picture so the work carries forward when the requirement eventually moves.

That the company meets, and continues to meet, the requirements of the level it claims. Affirmations are entered in SPRS at the assessment, at least annually afterward and after a POA&M close-out. Because an inaccurate affirmation can create False Claims Act exposure, the official needs evidence, not reassurance — readiness gives them the record behind the signature.

It already can. The DFARS rule took effect on November 10, 2025, and the DoD is bringing requirements in over four rollout periods that begin on November 10 of 2025, 2026, 2027 and 2028. From November 10, 2026, applicable solicitations can require Level 2 (C3PAO) certification as a condition of award. Your solicitations and your prime’s flow-downs say exactly which level and assessment type apply; readiness reads them with you and tells you what that means for your next bid.

It can. From the start of the rollout, the DoD may require a CMMC status before it exercises an option, and from full implementation on November 10, 2028, CMMC requirements apply to option periods on applicable contracts generally. A contract you already hold can bring CMMC with it at its next option, so the status you need is the one your next option calls for, not only your next new award.

DFARS 252.204-7021 requires a prime to flow the CMMC requirement down to every subcontractor that will process, store or transmit FCI or CUI, at the level that matches the information that subcontractor receives. The prime also has to confirm you hold that status before awarding the work. If you will receive only FCI, Level 1 is your requirement even when your prime needs Level 2. Readiness pins down what you actually receive, so you build to the right level rather than the highest one mentioned.

If your MSP or MSSP provides security functions to the CUI environment, yes: its tools, people and access are Security Protection Assets inside your assessment. A provider that is not a cloud service provider does not need its own CMMC status to support you, but your assessor will examine what it does on your behalf. A customer responsibility matrix that matches the provider’s own documentation is the evidence that holds this together, and readiness builds it with you and your provider.

ITAR and EAR govern who may access the data, generally limiting it to US persons unless a license allows otherwise, and constrain where it is stored and who supports the systems that hold it. CMMC does not replace those rules; it sits beside them. That shapes your cloud tier, your support providers and your access controls. Readiness maps where export-controlled data goes and checks your boundary and providers against both sets of obligations; your export-compliance counsel remains the authority on licensing.

They are different service tiers, and they differ in the authorizations they carry, where data is stored, who can support it and whether they are built for export-controlled data. Which fits depends on the CUI you hold, whether ITAR or EAR data is involved and what your contracts and primes require. Readiness compares your data with each tier’s published documentation and the DoD’s FedRAMP Moderate equivalency requirements. CyberlySecure sells no licenses, so the answer follows your data, not a reseller margin.

Correct it. Update your SPRS entry to a score you can support, put a plan behind the open requirements and make sure your next affirmation rests on evidence. An inflated score left in place is the exposure; a corrected score with a credible plan is a position you can defend. Talk to counsel about any past affirmation. Readiness rebuilds the score requirement by requirement so the new number holds when someone checks it.

Final Level 2 (C3PAO) status for the same assessment scope. Level 3 then adds 24 requirements selected from NIST SP 800-172, aimed at advanced persistent threats, and DIBCAC performs the assessment. Level 3 applies only to programs the DoD identifies in the solicitation, and a company that faces it goes through both assessments in sequence. Readiness prepares both, on one consistent scope.

No. The rule does not require readiness work or any particular provider for it. But a C3PAO assessment is a single examination with consequences for award, and a self-assessment carries a senior official’s affirmation to the government. Finding your gaps beforehand, with people on your side of the table, is how you avoid learning about them from the assessor or from a contracting officer.

Build to Rev 2. It is the version 32 CFR Part 170 names for CMMC Level 2, and the one your assessor will test against; moving CMMC to Rev 3 would take a change to the rule. Rev 3 reorganizes the requirements and adds organization-defined parameters, so readiness notes where your controls already meet its wording, and the move costs less when it comes.

Because an assessor has to be independent of the work it judges. A C3PAO may not assess a company it has provided CMMC consulting to, and DIBCAC is part of the DoD itself. The separation protects you as well: the people helping you find and fix gaps sit on your side of the table, and the people deciding your status come to it fresh.

No. Nothing in the rule requires your preparation to come from a Cyber AB-registered provider; what an assessor weighs is your evidence, not who helped you build it. To be clear about where CyberlySecure stands: it holds no Cyber AB designation. It is not a C3PAO and not a Registered Practitioner Organization. That keeps the line clean: the firm preparing you is never the firm deciding your status.

Level 1 (Self) is renewed every year with a fresh self-assessment and affirmation. Level 2 and Level 3 statuses run on a triennial cycle, with an affirmation every year in between. Conditional status lasts only for the close-out window the rule sets. A significant change to the environment you were assessed on can also call for a new assessment, which is why affirmation upkeep tracks change, not just the calendar.

Three kinds of evidence for every assessment objective: documents they examine, such as policies, the SSP and records; people they interview; and systems they test. The CMMC Assessment Guide for each level sets out the objectives and the methods. A requirement is met only when every objective behind it is met, which is why readiness works at the objective level rather than the headline of each requirement.

Partly. Policies, risk assessments, access reviews and logging built for SOC 2 or ISO 27001 often answer many CMMC requirements. But CMMC adds a CUI-specific boundary, FIPS-validated cryptography, DFARS incident reporting and evidence at the level of each assessment objective, and a SOC 2 report or ISO certificate is not accepted in place of a CMMC assessment. Readiness maps what you have so you build only what is missing.