CMMC is reshaping how defense contractors handle CUI. A plain-English overview of the certification levels and where small contractors should start.
Update, September 29, 2026: the Department of War has paused CMMC Phase 2, including the third-party assessments described below, while it reviews the program. The underlying NIST SP 800-171 and DFARS requirements still apply. See CMMC Phase 2 Is Paused. Your Requirements Aren’t. on our Insights page for details, and where CMMC stands today for the latest.
The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense’s framework for verifying that contractors adequately protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). For small contractors, CMMC 2.0 is no longer a future concern — it is increasingly a condition of bidding on DoD work.
CMMC 2.0 simplifies the original model into three levels. Level 1 (Foundational) requires 15 basic cyber hygiene practices and is self-assessed for contractors handling only FCI. Level 2 (Advanced) aligns with NIST SP 800-171 and requires a third-party assessment for contracts involving CUI. Level 3 (Expert) builds on 800-171 with a subset of NIST SP 800-172 controls and is reserved for the most sensitive CUI, assessed directly by the government.
For most small defense contractors, the practical target is Level 2 — which means implementing and documenting all 110 NIST SP 800-171 controls. That is where organizations tend to stall: not because the technology is exotic, but because the documentation, evidence, and ongoing maintenance are demanding. Auditors want to see that controls are not just in place but operating and reviewed.
A realistic path forward starts with a gap assessment. Identify which 800-171 controls you already meet, which you partially meet, and which are missing entirely. From there, build a remediation roadmap that prioritizes the highest-risk gaps — access control, incident response, and CUI handling — and establish the evidence habits you will need at assessment time.
Freedom Tech helps defense contractors align their technology, security controls, and documentation with CMMC and NIST 800-171 so they can bid with confidence. We focus on the compliance and technology side that makes you contract-ready — not on filing your SAM.gov registration. If CMMC is on your horizon, the time to start is before the solicitation arrives. Take our free CMMC Readiness Check, or book a 10-minute call to talk through where you stand.
