SOC 2
Type II
Achieved
3
CMMC maturity levels
110
NIST 800-171 practices at Level 2
DoD
Contracts require CMMC
2025
Full enforcement underway
CMMC Scoping & CUI Boundary Definition
Overscoping your CMMC boundary means implementing 110 security requirements across systems that do not touch CUI, an enormous and unnecessary cost. Underscoping means your assessment fails because CUI systems were excluded. We define your CUI boundary precisely: which systems store, process, or transmit CUI, which are connected to those systems, and which can be isolated or removed from scope to minimize compliance burden before assessment work begins.
CMMC Gap Assessment Against NIST SP 800-171
Most defense contractors significantly overestimate their NIST SP 800-171 compliance score, until a formal assessment reveals the gaps. CMMC Level 2 requires all 110 practices to be implemented with no POA&Ms accepted for critical controls. We assess your current state against every requirement, document findings with specific evidence, and deliver a prioritized remediation plan that is realistic about what needs to be fixed before your C3PAO assessment can succeed.
System Security Plan (SSP) Development
The SSP is the first thing a C3PAO assessor reviews, and an incomplete or inconsistent SSP signals that your program is not ready, regardless of what your actual controls look like. It must accurately describe your environment, detail how each of the 110 practices is implemented, and be supported by verifiable evidence. We draft and finalize your SSP to the format and standard C3PAOs and DCSA use for assessment, so the document works for you rather than against you.
Technical Remediation & Control Implementation
For many defense contractors, the gap between current state and CMMC Level 2 is predominantly technical, missing MFA on privileged accounts, insufficient audit logging, unmanaged configurations, or no formal incident response capability. We implement the specific controls your gap assessment identifies: multi-factor authentication, access management, audit and accountability, configuration management, incident response, and media protection. Every remediation action maps to its practice number, so you can track exactly how your compliance score improves.
C3PAO Assessment Readiness
Going into a C3PAO assessment without a pre-assessment review is how organizations discover critical gaps at the worst possible time, during a paid formal assessment with a contract deadline approaching. We conduct a full pre-assessment review, assemble your complete evidence package, and brief your team on what assessors will ask, how to respond, and which systems and personnel will be in scope. When the C3PAO arrives, your team is prepared and your evidence is organized.
Ongoing CMMC Compliance Maintenance
CMMC certification is not a one-time achievement. Annual affirmations are required, your environment changes, and a lapse in posture between assessments can invalidate your certification before the next contract renewal. We provide ongoing compliance support: monitoring controls for drift, reviewing significant system changes against CMMC requirements, and preparing your annual self-assessment affirmation so your certification stays current and your contract eligibility is never at risk.
Understanding CMMC
What every defense contractor handling CUI needs to know
What is CMMC?
The Cybersecurity Maturity Model Certification is a DoD program requiring defense contractors and subcontractors to demonstrate cybersecurity compliance before contract award. CMMC 2.0 has three levels: Level 1 (basic cyber hygiene, 17 practices), Level 2 (advanced, 110 practices aligned to NIST SP 800-171), and Level 3 (expert, based on NIST SP 800-172). Most contracts involving CUI require Level 2.
Who does it apply to?
CMMC applies to all DoD prime contractors and subcontractors at any tier that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). If your organization receives, generates, or stores CUI as part of DoD work, or if you are a sub to a prime that does, CMMC applies to you. Subcontractors must meet the same level as their prime's contract requires.
Why does it matter?
Without the required CMMC level, your organization cannot be awarded DoD contracts that mandate it, and cannot be included in a prime contractor's supply chain on those contracts. DoD is expanding CMMC requirements across solicitations. Organizations that wait until a specific contract requires it typically do not have enough time to achieve compliance before the award date.
How does certification work?
Level 1 and some Level 2 contracts allow annual self-assessment with a senior official affirmation submitted to SPRS. Most Level 2 contracts require a third-party assessment by a C3PAO, an accredited Certified Third-Party Assessment Organization. Level 3 requires a government-led assessment. All levels require annual affirmation regardless of assessment type.
What Makes Us Different From Others
- NIST SP 800-171 Expertise CMMC Level 2 is NIST SP 800-171. We know every practice requirement and the evidence C3PAOs look for in assessments.
- Scoping Reduces Cost An over-scoped CMMC boundary means compliance cost for systems that do not need it. Correct scoping from day one keeps the program manageable.
- SSP Written to Assessment Standards We write System Security Plans that C3PAOs can assess against without clarification delays: clearly mapped to practice numbers, with evidence pointers.
- Technical Remediation Included We do not just identify gaps: we close them. Technical remediation is part of our CMMC engagement, not a separate service.
- SPRS Score Documentation We calculate and document your NIST SP 800-171 assessment score for SPRS submission: required for all DoD contractors handling CUI.
garrisonOne walked us through our first security assessment and built a remediation roadmap that mapped directly to our compliance goals. We hit our SOC 2 Type II milestone on schedule and the auditor said it was one of the cleaner first-time audits they had seen.
Client results
See how we have helped
Manufacturing
Distributor — Network Security Assessment
Full network penetration test and security assessment for a regional distributor ahead of cyber insurance renewal. Coverage secured at preferred rates.
Network
Fully assessed
Insurance
Coverage secured
CMMC
Readiness achieved
Industry focus
Industries we serve
Related Services: All Compliance | NIST CSF | Penetration Testing | Cybersecurity Consulting
Frequently asked questions
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is the DoD's framework for ensuring cybersecurity across the Defense Industrial Base. Organizations that handle Federal Contract Information (FCI) must meet CMMC Level 1. Organizations that handle Controlled Unclassified Information (CUI) must meet CMMC Level 2, which aligns to NIST SP 800-171's 110 security requirements.
What is the difference between CMMC Level 1 and Level 2?
CMMC Level 1 covers 15 basic cybersecurity practices from FAR 52.204-21 and can be self-assessed annually. CMMC Level 2 covers all 110 practices in NIST SP 800-171 Revision 2 and requires either annual self-assessment or triennial third-party assessment by a C3PAO depending on the sensitivity of the programs involved.
What is a C3PAO?
A C3PAO (Certified Third-Party Assessment Organization) is an organization accredited by the Cyber AB to conduct official CMMC Level 2 assessments. If your contract requires a certified CMMC Level 2 assessment rather than a self-assessment, your assessment must be conducted by an accredited C3PAO.
What is the System Security Plan (SSP)?
The System Security Plan is the primary documentation artifact for CMMC and NIST SP 800-171 assessments. It describes your information system boundary, the security requirements applicable to your environment, and how each requirement is implemented. The SSP is reviewed by assessors as the foundation of any CMMC Level 2 assessment.
What is SPRS and why does it matter?
The Supplier Performance Risk System (SPRS) is the DoD portal where contractors submit their NIST SP 800-171 self-assessment scores. Contracting officers check SPRS scores before awarding contracts. Organizations that have not submitted a score or have a very low score face increased scrutiny or may be disqualified.
How long does CMMC preparation take?
Preparation time depends heavily on your starting posture. Organizations with mature IT practices and existing security controls can be C3PAO-ready in three to six months. Organizations starting from scratch with significant gaps typically need nine to twelve months. A gap assessment in the first two weeks gives you an accurate timeline.
Resources
Company
Contact
- US: 4752 Euclid Rd Suite 11,
Virginia Beach, VA 23462 - India: Orchard Street, Sector 61,
Gurgaon, Haryana - Phone: (301) 825-5518
- info@garrisonone.com
