Level 1, Level 2 or Level 3
The level is set by your contract, not chosen by you. Level 1 covers basic protection of Federal Contract Information, Level 2 is where most suppliers land, and Level 3 applies to the highest priority programs.
WHY ITS
The Work Between the Clause and the Assessment
Your contract says what you have to meet. It does not say how, who does it, or what proof is supposed to look like. That is the part ITS carries.
Scope Before Spend
We work out what information you actually hold and where it moves, because scope is what decides the cost of everything that comes after it.
Practices That Are Running
Access control, multifactor authentication, logging, patching, training and incident response, implemented and then operated rather than written down and hoped for.
Evidence a Stranger Can Read
The System Security Plan, the plan of action and the records kept current as a by-product of the work, so an assessor reads a file instead of interviewing your staff.
CMMC 2.0 does not invent new security requirements. Level 2 is the 110 practices of NIST SP 800-171, and what CMMC adds is proof: an assessment, on a schedule, by someone other than you.
We are not going to re-answer the questions our own articles already answer well: CMMC and NIST 800-171 compared, what an RP, a CCP and a CCA each do, and how long certification takes.
WHAT CMMC REQUIRES
Six Decisions Your Contract Has Already Made
CMMC 2.0 is a verification program layered on a control set that already existed. These are its own moving parts, in the order they matter to a supplier.
Program structure summarized from the Department of Defense's CMMC documentation and the DFARS clauses ITS cites in its own published CMMC articles.
The 110 Practices
Level 2 assesses the 110 practices of NIST SP 800-171. There is no separate CMMC control catalogue to learn, which is the good news buried inside the acronym.
CUI and FCI Scoping
Which systems hold Controlled Unclassified Information, which hold Federal Contract Information, and which hold neither. Everything downstream, price included, follows from that answer.
System Security Plan and POA&M
A written plan describing how each requirement is met, and a plan of action for the ones that are not met yet. Both are living documents, and an assessor reads them first.
Your SPRS Score
The self-assessment expressed as a number and submitted to the Supplier Performance Risk System. Because you grade yourself, the score is only ever as good as your reading of the requirements.
Self-Assessment or a C3PAO
Level 1 is self-assessed. Level 2 is normally assessed by an authorized third party, and only a C3PAO can certify it. ITS operates your controls, which is exactly why ITS cannot be your assessor.
CLIENT RESULTS
What Clients Say About Working With Us
Two ITS clients on what changed once somebody owned the security work. Neither is a defense supplier, and we are not going to imply otherwise.
ITS led significant, transformational changes at Eastern Plumas Health Care to ensure we weren’t susceptible to attacks. Looking back, prior to that partnership, we had a lot of risks on campus. I’m glad nothing happened, but I’m even more proud that after implementing those systems, we’ve avoided data breaches and HIPAA violations throughout our five-year partnership.
We always get a technician or an engineer that can solve the problem remotely and we have very little downtime. We’ve had a couple of times where we have had an employee that is prevented from working, and when we call in and we escalate quickly, we always have someone readily available to solve the problem.
Find Out Which Level Your Contract Actually Names
A scoping call, an honest read on where you stand against the practices that level requires, and a written plan of action. No obligation at the end of it.