CMMC 2.0 (Cybersecurity Maturity Model Certification) is the U.S. Department of Defense’s mandatory cybersecurity framework for contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). It differs from NIST 800-171 self-attestation because CMMC 2.0 Level 2 requires third-party C3PAO assessment every three years, with pass/fail stakes for contract eligibility. The framework applies to all Defense Industrial Base (DIB) contractors, subcontractors, and suppliers — approximately 200,000 organizations — ranging from small manufacturers to major primes. Successful certification requires a System Security Plan (SSP), Plan of Action & Milestones (POA&M), implemented NIST 800-171 controls, continuous monitoring, and SPRS score reporting. Armorstack guides defense contractors nationwide through the full CMMC 2.0 lifecycle: gap analysis, control implementation, SSP authoring, C3PAO coordination, and continuous monitoring — typically achieving Level 2 assessor-readiness within 90 days for mid-market contractors.
CMMC 2.0 Compliance
Compliance Without the Consulting Tax.
A managed CMMC program built for defense contractors and DoD subcontractors who need to clear the assessment, keep contracts flowing, and stop paying $400/hour for a binder that goes stale the day it’s delivered.
The Framework
What CMMC 2.0 Actually Requires
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the Department of Defense’s mechanism for verifying that contractors and subcontractors handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) have implemented prescribed security controls. The final rule (32 CFR Part 170) took effect December 16, 2024, and contractual flow-down through DFARS clause 252.204-7021 began phased enforcement on November 10, 2025. If CMMC language appears in a solicitation, you cannot be awarded the contract without the corresponding certification on file.
CMMC 2.0 collapses the original five-level model into three. Level 1 (Foundational) covers the 17 basic safeguarding controls in FAR 52.204-21 and is satisfied by annual self-attestation. Level 2 (Advanced) requires implementation of all 110 controls in NIST SP 800-171 Rev. 2 across 14 control families; most Level 2 contracts require a triennial third-party assessment by a Certified Third-Party Assessor Organization (C3PAO), with a narrow self-assessment carve-out for non-prioritized acquisitions. Level 3 (Expert) layers a subset of NIST SP 800-172 enhanced controls on top and is assessed directly by the Defense Contract Management Agency’s DIBCAC.
The practical difference between self-attestation and assessment is liability. A signed self-attestation in the Supplier Performance Risk System (SPRS) by a senior official invokes the False Claims Act — the DOJ’s Civil Cyber-Fraud Initiative has already produced multi-million-dollar settlements against contractors who misrepresented their score. Assessment is more rigorous but transfers the verification burden off your senior official’s signature line.
Service Tiers
Three Levels. Three Managed Packages.
Pick the tier that matches your contract requirements. Each is a continuous managed service — not a one-time project.
Foundational Hygiene Package
17 basic safeguarding controls (FAR 52.204-21). Annual self-attestation in SPRS.
- •Scope: Contractors handling Federal Contract Information (FCI) only — no CUI.
- •Who needs it: Subs and primes on basic federal acquisitions without CUI markings.
- •Includes: Access control, identification & authentication, media protection, physical safeguards, system integrity, baseline configuration management.
- •Deliverable: SPRS-ready attestation packet, annual recertification.
Starting at
from $X,XXX/mo
Advanced Compliance Package
110 controls across NIST SP 800-171 Rev. 2. Triennial C3PAO assessment for prioritized contracts.
- •Scope: Any contractor that creates, processes, stores, or transmits CUI.
- •Who needs it: The vast majority of DoD primes, subs, and supply-chain participants. If your contract references DFARS 252.204-7012, you almost certainly need Level 2.
- •Includes: All 14 NIST 800-171 families — Access Control, Awareness & Training, Audit & Accountability, Configuration Management, Identification & Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System & Communications Protection, System & Information Integrity.
- •Deliverable: Implemented control baseline, full SSP, POA&M, audit evidence repository, C3PAO prep, and on-site sit-in support during assessment.
Starting at
from $X,XXX/mo
Expert Defense Package
All 110 NIST 800-171 controls plus a selected subset of NIST SP 800-172 enhanced controls. DIBCAC-led government assessment.
- •Scope: Programs handling CUI tied to the most sensitive DoD priorities and Advanced Persistent Threat (APT) protection.
- •Who needs it: Contractors on critical programs designated by the DoD program office — typically a small percentage of the DIB.
- •Includes: Level 2 baseline plus advanced threat-hunting, deception technology, segmentation, dual-authorization controls, and 24×7 SOC monitoring against APT TTPs.
- •Deliverable: DIBCAC-ready evidence package, continuous control validation, advanced security operations.
Starting at
from $X,XXX/mo
The Delivery Model
What Armorstack Actually Delivers
A managed program — not a binder. Every control is implemented in your environment, monitored by our SOC, and audit-ready on demand.
SSP Generation & Maintenance
A System Security Plan that mirrors the actual environment, mapped control-by-control to NIST SP 800-171 Rev. 2. Living document — updated every quarter and on every material system change. No copy-paste templates.
POA&M Tracking
Plan of Action & Milestones management for every “Other Than Satisfied” control. Owners, target close dates, evidence of progress, and routine remediation reviews — managed inside the same workflow we use for SOC ticketing.
110-Control Implementation
Hands-on engineering across all 14 NIST 800-171 families — MFA rollouts, FIPS 140-validated cryptography, audit logging, CUI segmentation, incident response runbooks, and the policy stack to back it up. We build it and we operate it.
Continuous Monitoring & Evidence-on-Demand
SENTRY SOC monitors control effectiveness 24×7. Audit evidence — logs, screenshots, configuration baselines, training records — is queryable on demand. When the C3PAO asks for proof, we hand it over the same day.
C3PAO Assessment Prep & Sit-In Support
A pre-assessment dry run against the CMMC Assessment Process (CAP), an interview prep cycle for your senior official and system owners, and a senior Armorstack engineer in the room (or on the call) for every day of the C3PAO assessment. We answer the technical questions so your team can run the business.
The Comparison
Why Armorstack vs. a CMMC Consultant
Consultants leave the binder. We operate the program.
| Dimension | Traditional CMMC Consultant | Armorstack Managed CMMC |
|---|---|---|
| Pricing model | $250–$500/hour, billable, scope creep is the business model | Fixed monthly subscription tied to your level and CUI scope |
| Engagement model | Point-in-time gap assessment + binder hand-off, then they’re gone | Continuous program — the controls are operated, not just documented |
| SSP/POA&M ownership | Drafted, delivered, then your team owns updates forever | Maintained by Armorstack as part of the subscription, every quarter |
| SOC integration | None — they don’t operate a SOC. You buy that separately. | SENTRY SOC enforces controls 24×7 and produces the audit evidence |
| Evidence on assessment day | You scramble to assemble logs, screenshots, training records | Queryable evidence repository — pulled on demand, in front of the C3PAO |
| Engineering depth | GRC analysts who write policies but don’t touch infrastructure | 24+ years of infrastructure operations behind every control |
| Reassessment cycle | Quote a new project every three years | Triennial recertification included — no re-engagement fee |
Frequently Asked
CMMC, answered straight.
Do I need CMMC if I’m a subcontractor? +
How long does CMMC implementation take? +
What’s the difference between CMMC Level 1 and Level 2? +
Will my existing IT environment need to change? +
Can Armorstack act as our External Service Provider for CUI? +
What happens during a C3PAO assessment? +
How does CMMC interact with FedRAMP? +
What’s the cost of getting it wrong? +
Live Enforcement
CMMC 2.0 enforcement is live.
Get a no-cost CMMC readiness assessment in 30 days. We’ll scope your CUI boundary, score you against all 110 NIST 800-171 controls, and deliver a defensible POA&M with a fixed-price path to certification.
Start My CMMC Readiness Assessment