CMMC Guides for Defense Contractors and Their Suppliers

CMMC 2.0 folds NIST SP 800-171 into a certification that flows down the whole defense supply chain. Level 1 is a self-assessment against the basic safeguarding requirements; Level 2 is the full set of 800-171 controls, assessed by a certified third party for most contractors; Level 3 adds requirements from 800-172 and a government-led assessment. The articles here cover what each level demands, how to determine which one a contract requires, and how to scope the environment that handles CUI so the assessment stays bounded.

We also cover the practical path: the SPRS score, the System Security Plan and Plans of Action, the role of an enclave, and how CMMC work overlaps with SOC 2 or ISO 27001 for suppliers that need both. Every guide is written for companies without a security department, because that describes most of the supply chain.