Helping you secure DoD contracts by becoming CMMC compliant
Ensure Basic Cyber Hygiene and the Protection of FCI and/or CUI Data
Get Expert IT Advice Whenever You Need It
Produce Parts, Systems and Components for the DoD
The Cybersecurity Maturity Model Certification (CMMC) program is an assessment framework and certification program that was created to standardize compliance set by the National Institute of Standards and Technology. It was designed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) that is handled, stored and/or processed by Defense Industrial Base (DIB) contractors. This data could be anything from financial, legal, intelligence, infrastructure, export controls or other information. The CMMC Program final rule (32 CFR Part 170) took effect December 16, 2024, and the contract requirement (48 CFR / DFARS 252.204-7021) took effect November 10, 2025.
If you’re a cyber security contractor looking to work with the Department of Defense, you’ll need a CMMC certification. Any organization in the DoD supply chain that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) — including prime contractors and subcontractors — needs the appropriate level of CMMC. The required level is set by each contract, and DoD is phasing CMMC into solicitations and contracts over four phases that began November 10, 2025.
The CMMC Program final rule (32 CFR Part 170) became effective December 16, 2024, and the rule that puts CMMC requirements into contracts (48 CFR / DFARS 252.204-7021) became effective November 10, 2025. DoD is implementing CMMC in four phases:
Because requirements are already showing up in contracts, organizations that want to keep bidding should begin preparing now rather than waiting for full implementation.
What is required depends on the level. Level 1 (and a limited subset of Level 2) is met through an annual self-assessment, while most Level 2 requirements are verified by an accredited third-party assessor (C3PAO) and Level 3 is assessed by the government (DIBCAC).
Under the current CMMC Program there are three levels of certification (the earlier model had five). Again, the required level you’ll need to complete depends on your particular contract, but it’s good practice to achieve the highest level of certification that is feasible for your organization.
The following chart from National Defense Magazine published early cost estimates for CMMC. Remember, the prices below are rough estimates for the total cost of CMMC as actual costs vary based on the size of your environment, your CUI scope and how much remediation is needed.
Estimated assessment and compliance costs by level are as follows:
Level 1 (annual self-assessment): roughly $4,000–$6,000 per year
Level 2 (C3PAO third-party certification): roughly $105,000+ over a three-year cycle for the assessment and required affirmations; total program cost for a typical small-to-midsize business, including gap assessment and remediation, commonly runs $50,000–$300,000+
Level 3 (government/DIBCAC assessment): Level 2 costs plus roughly $40,000+ for the additional requirements, and significantly more for larger, complex environments
It’s also important to note that the cost of CMMC compliance is different from the cost of CMMC certification. Compliance is a separate cost that the DoD expects its supply chain to comply with.
Cybersecurity Maturity Model Certification can quickly become expensive and confusing. Arclight can help you keep costs down and achieve certification as quickly as possible. Book a CMMC meeting today.
As a defense contractor, to be CMMC compliant means you have achieved the standardized processes, practices and approaches set by the CMMC framework.
Assessing the gap between current practices and CMMC compliance is a crucial first step for contractors to understand how close they are to certification. CMMC assessment and remediation reviews current systems and processes that may not meet DoD guidelines. A third party or MSP will look at:
Most importantly, a CMMC assessment and remediation helps contractors pinpoint risk areas, determine certification costs and prioritize tasks.
Below are the basic requirements for the three CMMC certification levels – and what kind of clearance each one gives to defense contractors.
CMMC Level 1 (Foundational)
Level 1 covers basic cyber hygiene and is intended to safeguard Federal Contract Information (FCI). It requires the 15 basic safeguarding requirements found in FAR 52.204-21, verified through an annual self-assessment and an affirmation by a senior company official.
CMMC Level 2 (Advanced)
Level 2 protects Controlled Unclassified Information (CUI) and requires implementing all 110 security requirements of NIST SP 800-171 Revision 2. For most contracts, Level 2 must be verified by an accredited third-party assessment organization (C3PAO) every three years; a limited subset of programs may be allowed to self-assess.
CMMC Level 3 (Expert)
Level 3 is for the highest-priority programs and the most sensitive CUI. It builds on the 110 requirements of NIST SP 800-171 and adds a subset of 24 enhanced requirements from NIST SP 800-172. Level 3 is assessed by the government — specifically the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) — rather than by a third party.
To prepare for CMMC you’ll first need to assess the level of certification required for your organization. Next, you will have to determine how close your current practices come to the compliance framework. Preparing for CMMC certification can be challenging, time consuming and expensive. Hiring a third party or MSP can help you streamline your path to compliance while keeping unnecessary costs down.
Arclight Group supports CMMC readiness by offering comprehensive assessments and specific recommendations to achieve certification. We specialize in helping businesses prepare for CMMC certification and increase the chances of successful certification: set up a meeting.
Choose an IT partner that cares as much as you do. Rely on ArcLight’s real-time experience and knowledge of the Cybersecurity Maturity Model Certification eco-system to assist your organization in preparing for your CMMC assessment; helping you avoid potential failure with your assessment. Gain insight into the protocols and training necessary to involve your organization in the DoD contract supply chain with our in-depth preparation services.
"*" indicates required fields