If you're a small business contracting with the Department of Defense, or planning to, CMMC is no longer a future consideration. The Cybersecurity Maturity Model Certification (CMMC) 2.0 framework has been phased into DoD contracts, with requirements flowing down to subcontractors. Understanding which level applies to your work, what it requires, and how to get there is now a prerequisite for competing in the DoD market.
This guide explains the three CMMC levels in plain language, walks through the assessment process, and identifies the mistakes small businesses most commonly make when trying to comply. It's not a technical implementation guide, it's an introduction for business owners and BD leaders who need to understand what CMMC means for their pursuit strategy and federal proposals.
What Is CMMC and Why Does It Exist?
The Cybersecurity Maturity Model Certification is a DoD framework that verifies defense contractors have implemented adequate cybersecurity controls to protect sensitive government information. It was created in response to repeated, high-profile data breaches targeting DoD supply chain contractors who were handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) without adequate protections.
CMMC 2.0 (the current version) consolidates five original maturity levels into three, and aligns directly with NIST SP 800-171 cybersecurity standards. The key distinction from previous self-attestation regimes: some levels require third-party certification, you can no longer simply certify your own compliance and check a box on a representation.
The Three CMMC Levels
Foundational, 17 Practices
Level 1 covers basic cyber hygiene, 17 practices drawn from FAR 52.204-21. These are the fundamentals: use antivirus, require passwords, limit access to company info, don't leave systems unattended in public. If you've been doing basic IT security, you may already meet most Level 1 requirements. Annual self-attestation is submitted to the Supplier Performance Risk System (SPRS).
Advanced, 110 Practices
Level 2 is where most small businesses encounter CMMC as a significant challenge. It requires implementation of all 110 security practices from NIST SP 800-171. This covers access control, audit logging, incident response, system and communications protection, media protection, and more. For most small businesses, achieving Level 2 requires meaningful IT infrastructure changes. Third-party assessments are conducted by CMMC Third-Party Assessment Organizations (C3PAOs) authorized by the CMMC Accreditation Body (Cyber-AB). The cost and timeline for these assessments has moderated since the initial rollout, but significant preparation is required.
Expert, 110+ Additional Practices
Level 3 is the most rigorous tier, required for programs involving particularly sensitive CUI, typically classified or near-classified defense programs. It builds on the full Level 2 requirements and adds additional practices from NIST SP 800-172. Government assessments are conducted by DCSA (Defense Contract Security Agency), not private C3PAOs. Most small businesses do not need Level 3, but if you're pursuing programs that involve highly sensitive defense data, you'll need to understand the requirements early in your pursuit strategy.
How to Get Started: The CMMC Gap Assessment
The first step for any contractor is a gap assessment, an honest evaluation of where your current cybersecurity posture stands against the requirements of the CMMC level you need. Do not skip this step. Contractors who jump directly to remediation without a gap assessment routinely miss requirements, remediate the wrong controls, and fail assessments because of blind spots they didn't know existed.
Identify which level applies to your contracts
Review your existing DoD contracts and target opportunities. If any involve CUI, Level 2 is required. Look for DFARS 252.204-7012 and 252.204-7021 clauses in your contracts.
Define your CUI scope
Not all your IT systems necessarily handle CUI. Scoping your CMMC boundary, identifying exactly which systems, people, and processes touch CUI, dramatically reduces your compliance burden by limiting what must be assessed.
Conduct a gap assessment against NIST SP 800-171
Assess your current controls against all 110 practices (for Level 2). Document what's in place, what's partially implemented, and what's missing. This becomes your System Security Plan (SSP) and Plan of Action and Milestones (POA&M).
Build a remediation plan
Prioritize gaps by risk and assessment impact. Some gaps are quick wins (policy documentation); others require infrastructure investment (multi-factor authentication, encrypted storage). Timeline to full Level 2 readiness for a small business with significant gaps is typically 6-18 months.
Submit your SPRS score (Level 1) or engage a C3PAO (Level 2)
Level 1: Complete annual self-assessment and submit score to SPRS. Level 2: Select and engage a C3PAO for your formal assessment. The C3PAO will conduct the assessment and submit results to the CMMC Contractor Verification Database.
Common CMMC Mistakes Small Businesses Make
- Treating CMMC as an IT project, not a business decision: CMMC compliance is a prerequisite for contract eligibility. Business owners need to own the decision and the timeline, not delegate it entirely to IT staff.
- Scoping too broadly: Including all company systems in your CMMC boundary when only a subset actually handles CUI dramatically increases cost and complexity. Proper scoping is one of the highest-ROI CMMC activities.
- Waiting until a contract requires it: C3PAO assessment scheduling can take months. If you wait until an opportunity requires CMMC certification to begin your compliance journey, you'll likely miss the pursuit or be forced to decline.
- Relying entirely on a Managed Service Provider: MSPs can implement controls, but they cannot make your business compliant on their own. You must have internal awareness, documented policies, and governance in place.
- Not documenting implemented practices: CMMC assessors evaluate evidence of implementation, not intent. A practice that is implemented but not documented is treated as not implemented.
CMMC and Your Federal Proposals
CMMC compliance increasingly appears as a proposal requirement, not just a contract clause. Solicitations for DoD work often require offerors to attest to their CMMC level in the proposal itself, and some require documentation of a current SPRS score or C3PAO assessment result. If your competitors are certified and you're not, this gap will appear in the proposal evaluation as a risk factor or a responsiveness issue.
FedBiz Solutions' CMMC advisory services help DoD contractors understand their compliance requirements, conduct gap assessments, and develop remediation plans that get them to the required certification level, with a strategy that also optimizes their federal proposal positioning. We work alongside your technical team (or your MSP) to ensure the business, compliance, and proposal dimensions of CMMC are all addressed together.