Government Contractors: CMMC Requirements & Assessments

CMMC is now mandatory for most Department of Defense (DOD) contractors. Non-compliance means losing contracts. Here's what you need to know about CMMC levels and penetration testing requirements.

What is CMMC?

CMMC stands for Cybersecurity Maturity Model Certification. It's a mandatory compliance framework for DOD contractors and subcontractors handling classified information or Controlled Unclassified Information (CUI).

Key facts:

CMMC Levels and Requirements

CMMC has 3 levels. Your required level depends on the data you handle:

Level 1: Foundational (NIST SP 800-171 Basic)

Requirement: Self-assessment, no third-party certification needed

What it means: You complete the CMMC Level 1 model (17 practices from NIST SP 800-171) and self-attest you're compliant. No auditor verification required.

Who needs it: Basic contracts that don't require CUI protection, or organizations starting their CMMC journey

Cost: Low (self-assessment only)

Penetration Testing: Not explicitly required, but recommended to validate controls

Level 2: Advanced (NIST SP 800-171 with processes)

Requirement: C3PAO (Certified CMMC Professional Organization) assessment every 3 years

What it means: You implement 110 practices across 5 domains. A C3PAO auditor evaluates your implementation and validates compliance every 3 years.

Who needs it: Most DOD contractors handling CUI. Most new contracts require Level 2 minimum.

Cost: $15,000-$50,000 for initial assessment depending on organization size

Penetration Testing: Required as part of C3PAO assessment. Assessors conduct limited penetration testing to validate security controls.

Level 3: Expert (NIST SP 800-171B with advanced processes)

Requirement: C3PAO assessment annually

What it means: You implement 171 practices plus advanced controls for threat intelligence, incident response, and advanced monitoring. Annual third-party assessment required.

Who needs it: Only organizations handling classified information or in critical roles (defense contractors with classified access)

Cost: $30,000-$100,000+ annually for assessment

Penetration Testing: Comprehensive penetration testing required annually, including advanced attack scenarios and red team exercises

CMMC Domains and Control Categories

CMMC controls are organized into 5 domains:

1. Access Control

Who can access what, and when

2. Asset Management

Inventory and protection of hardware and software assets

3. Data Protection

Protecting information, especially CUI

4. Defense and Recovery

Detecting and responding to incidents, maintaining backups and recovery capability

5. Identification and Authentication

Verifying who users are and what systems they access

CMMC Assessment Process

The assessment process differs by level:

Level 1: Self-Assessment (No C3PAO Required)

Timeline: 2-4 weeks

Limitation: Self-assessment has no credibility. DOD is moving away from Level 1 contracts.

Level 2: C3PAO Initial Assessment (3-Year Cycle)

Timeline: 2-3 months from start to certification

Phase 1: Preparation (Weeks 1-2)

Phase 2: On-Site Assessment (Weeks 3-6)

Phase 3: Report and Remediation (Weeks 7-10)

Level 3: C3PAO Annual Assessment

Similar to Level 2 but more intensive, occurring annually instead of every 3 years. More thorough penetration testing and advanced control validation required.

Penetration Testing in CMMC Assessments

Penetration testing is a key part of C3PAO assessments:

Level 2 Testing

Limited scope, targeting critical systems:

Level 3 Testing

Comprehensive testing more similar to professional penetration tests:

Common CMMC Gaps and How to Address Them

Multi-Factor Authentication (MFA)

Requirement: MFA on all remote access and privileged accounts

Common gap: MFA is optional or not used consistently

Fix: Mandate MFA for all remote access (VPN, RDP), email, and administrative accounts. Use hardware tokens (FIDO2) for highest security.

Patch Management

Requirement: Formal process with documented timeline for patching

Common gap: Ad-hoc patching, no process documentation

Fix: Establish formal patch management: inventory systems, track vulnerabilities, test patches, deploy on schedule (30-60-90 days by severity).

System Monitoring and Logging

Requirement: Comprehensive logging of all user activity, system changes, and security events

Common gap: Limited logging, no centralized log management, logs not retained

Fix: Implement centralized logging (SIEM), monitor for security events, set up alerting, retain logs for at least 1 year.

Encryption

Requirement: Encryption of CUI in transit (HTTPS/TLS) and at rest

Common gap: Encryption not applied to all CUI, weak encryption algorithms

Fix: Identify all systems handling CUI, encrypt data in transit with TLS 1.2+, encrypt data at rest using AES-256 or better.

Access Control

Requirement: Principle of least privilege—users have only the access they need

Common gap: Users have excessive privileges, shared accounts, no regular access reviews

Fix: Implement principle of least privilege, eliminate shared accounts, conduct quarterly access reviews.

Incident Response

Requirement: Documented incident response procedure and capability

Common gap: No written incident response plan, no incident response team designated

Fix: Develop written incident response plan, designate response team, test with tabletop exercises at least annually.

Vulnerability Management

Requirement: Regular vulnerability scanning and remediation

Common gap: Infrequent scanning, no vulnerability tracking or remediation timeline

Fix: Implement quarterly vulnerability scanning, track vulnerabilities, prioritize by severity, remediate on documented timelines.

Cost of CMMC Compliance

CMMC has real costs:

Level 1

Level 2

Level 3

But: Without CMMC certification, you can't bid on DOD contracts. The cost of compliance is far less than the lost revenue from ineligibility.

Timeline for CMMC Compliance

DOD has extended CMMC deadlines multiple times. Current timeline:

If you're a government contractor without CMMC certification, you should start now. The assessment process takes 2-3 months minimum. Don't wait until your contract renewal requires it.

Roadmap: How to Get CMMC Certified

Step 1: Assess Your Current State (Weeks 1-2)

Conduct a gap analysis against CMMC Level 2 (or 3 if you handle classified info):

Step 2: Develop Implementation Plan (Weeks 3-4)

Create a roadmap to close gaps:

Step 3: Implement Controls (Weeks 5-12+)

Execute your plan. Typical timeline is 2-4 months depending on gaps.

Step 4: Select C3PAO and Schedule Assessment (Weeks 8-10)

Don't wait until implementation is 100% complete. Work with your C3PAO to schedule assessment once you're close. They can provide guidance on final gaps.

Step 5: Conduct C3PAO Assessment (Weeks 11-14)

The assessment typically takes 2-3 weeks on-site, plus reporting time.

Step 6: Remediate Findings (Weeks 15-16+)

Address any findings the assessor identifies. This usually takes 2-4 weeks.

Step 7: Receive Certification

Once all findings are remediated, you're certified for 3 years (Level 2) or 1 year (Level 3).

Working With External Penetration Testers

You don't need to hire a C3PAO to prepare for CMMC. Before your C3PAO assessment, consider hiring an external penetration tester to validate your controls:

External penetration testing is a smart investment before your CMMC assessment.

Start Your CMMC Compliance Journey

Sheepdog Cyber Defense helps government contractors prepare for CMMC with gap assessments, penetration testing, and remediation support.

Schedule Your CMMC Assessment