CMMC 2.0 · The certification path
Who needs CMMC Level 2 certification, and how a supplier gets there.
Level 2 covers the 110 requirements of NIST SP 800-171 for any supplier that handles Controlled Unclassified Information. Whether you self-assess or need a C3PAO depends on your contract. We prepare you for either; the assessment itself is done by a C3PAO or by you.
AccuSights is not a C3PAO, is not affiliated with the Cyber AB or the Department of Defense, and does not certify or guarantee certification. We prepare you for your CMMC assessment; we do not conduct it. Third-party assessments are subject to DoD and Cyber AB rules as published, which may change.
Which assessment your contract asks for
Four ways to meet CMMC, set by the clause in your contract.
- Level 1, self-assessmentFor suppliers that handle only Federal Contract Information. The 15 basic safeguards of FAR 52.204-21, assessed by you every year, with an annual affirmation.
- Level 2, self-assessmentFor CUI where the contract allows it. The 110 requirements of NIST SP 800-171, assessed by you every three years and scored in SPRS, with an annual affirmation.
- Level 2, certification by a C3PAOFor CUI where the contract requires a third party. The same 110 requirements, assessed by an authorized C3PAO every three years, with an annual affirmation.
- Level 3, assessment by DIBCACFor the most sensitive programs. Builds on a Level 2 certification and adds requirements from NIST SP 800-172, assessed by the government.
The path, step by step
From not knowing where the CUI is to an assessment you expect to pass.
- 1. Find the CUIWhere Controlled Unclassified Information enters, lives and leaves. The boundary you draw here sets the size of everything after it.
- 2. Measure the gapEach of the 110 requirements checked against your environment, with the evidence an assessor would ask for.
- 3. Write the System Security PlanHow every requirement is met in your environment. It is the first document an assessor reads.
- 4. Close what is openMulti-factor authentication, logging, FIPS-validated encryption, policies: the fixes in the order that raises your score most.
- 5. Score it in SPRSA score of 110, or at least 88 with only eligible 1-point items on a POA&M closed within 180 days.
- 6. Rehearse the assessmentA mock assessment with the same evidence requests, interviews and findings language, while there is still time to fix what it finds.
- 7. The assessment itselfYou book the C3PAO, or self-assess where the contract allows. We sit beside you; we do not assess.
- 8. Keep it currentAn annual affirmation by a senior official, and evidence kept up to date so the next cycle is a review, not a rebuild.
Which packages prepare you for it
The packages that take you along that path.
CMMC Level 2 Gap Readiness Package
Defense manufacturers, engineering and design firms, and IT and service suppliers of 10 to 300 people handling CUI
CMMC Self-Assessment and SPRS Score Calculation
Suppliers who need a current, defensible SPRS score now and a clear path toward Level 2 later
Mock Audit Package: SOC 2, HIPAA or CMMC
Organizations within 90 days of a SOC 2 audit, an OCR inquiry or a C3PAO assessment, and any leadership team that wants to know before it counts
Questions we get about CMMC certification
Do you certify CMMC?
Do we need a C3PAO now, or can we self-assess?
What happens if we score below 88?
How long does it take?
CMMC pages: CMMC 2.0 overview · Certification path · What drives the cost · The 12-item checklist
Next step
Thirty minutes, an engineer, a written scope for CMMC.
Book the call and leave with where your CUI is, which assessment your contracts ask for, and a fixed-fee scope for the work. Or leave your details and an engineer replies within one business day.
The regulator has the final say. We help interpret, scope and get you ready; we do not certify.