Know Your Real CMMC Score While the Clock Is Paused

The Department of Defense built the Cybersecurity Maturity Model Certification to verify that the cybersecurity protections defense contractors have long been required to implement are actually in place. The suspension changes the verification mechanism, not the protections. DFARS 252.204-7012, 252.204-7019, and 252.204-7020 remain in force, your NIST SP 800-171 implementation obligation is unchanged, and the Department has been explicit that it is reducing certification burden rather than lowering the cybersecurity baseline. Read the pause for what it is: the reform work is aimed at how contractors prove compliance, not at whether they have to be compliant.

That makes this a prep window, and prep windows close. Every contractor that handles Controlled Unclassified Information still has exactly the gaps it had in June, and the reform review does not close a single one of them. Measuring and remediating now, with no clock forcing the pace, is the low-stress and lower-cost path. Doing the same work later under a restored schedule, competing for the same limited pool of practitioners and assessors, is the expensive one. Start with the CMMC compliance program overview or the underlying NIST 800-171 compliance requirements.

One more reason the pause is the right moment: remediation is sequential. You cannot compress a year of engineering into a quarter by spending more money. Multifactor authentication has to be deployed before you can evidence it. Audit logging has to run long enough to produce reviewable records. Security awareness training has to be delivered, documented, and repeated. Policies have to be approved and then actually followed, because an assessor asks your staff what they do, not only what your binder says. Organizations that treat the suspension as permission to stop will restart from the same line they are standing on today, only with less runway.

Not sure whether Level 2 even applies to you, or how CMMC compares to a framework you already run? See how CMMC stacks up in our CMMC versus ISO 27001 comparison, and how the underlying NIST 800-171 controls map to your environment.

Level 1 covers Federal Contract Information

Federal Contract Information, or FCI, is information provided by or generated for the government under a contract that is not intended for public release. Delivery schedules, statements of work, and process documentation frequently qualify. If your contracts put FCI in your systems but never CUI, you are almost certainly a CMMC Level 1 organization. Level 1 is 15 basic safeguarding requirements drawn from FAR 52.204-21, and it is self-assessed and annually affirmed by a senior company official. It is not trivial, but it is a matter of weeks of focused work rather than a multi-year program, and it does not require an outside assessor.

Level 2 covers Controlled Unclassified Information

Controlled Unclassified Information is the category that changes everything. Technical drawings, specifications, export-controlled data, and program information marked CUI or covered by DFARS 252.204-7012 pull you into all 110 NIST SP 800-171 requirements. Level 2 is where the System Security Plan, the POA&M, continuous monitoring, and the SPRS score all become load-bearing. For most CUI-flowing contracts, Level 2 is verified by a Certified Third Party Assessment Organization on a three-year cycle, though a subset of contracts allow a Level 2 self-assessment. Which one applies to you is a contract-language question, not a technology question, and it is one of the first things we read on a scoping call.

Level 3 is a small, specialized population

Level 3 applies to a much narrower group of contractors supporting priority and national-security programs. It is the 110 NIST SP 800-171 requirements plus 24 enhanced requirements from NIST SP 800-172, 134 in total, and it is assessed by the government's Defense Industrial Base Cybersecurity Assessment Center rather than by a Certified Third Party Assessment Organization. Level 3 is not an entry point. Under 32 CFR 170.18, a Final Level 2 certification assessment performed by a C3PAO is a prerequisite before Level 3 can be pursued at all. The Department of Defense's own regulatory impact analysis (89 FR 83092) estimates Level 3 implementation at $2.7 million to $21.1 million in nonrecurring cost plus $490,000 to $4.1 million per year recurring, with that wide range driven by organization size rather than by timing. Level 2 and Level 3 contract designations are among the requirements placed in abeyance by the July 2026 suspension, so any Level 3 work today is proactive readiness on your own timeline. If your programs are heading that direction, read the CMMC Level 3 readiness overview.

Enclave scoping is where the money is won or lost

Almost every dollar of a CMMC program is a function of how many systems, users, and data flows sit inside the assessment boundary. A contractor that lets CUI sprawl across the general corporate network has just scoped every laptop, every file share, and every user into a 110-requirement program. A contractor that channels CUI into a deliberately small enclave, with a documented boundary and controlled data flows, assesses a fraction of that footprint. This is why boundary design is the first phase of our engagement rather than an afterthought, and why we will push back if your instinct is to declare the whole company in scope. See how we design and build a CMMC enclave once the boundary is agreed.

Scoping also decides which assets are in the boundary at all. CMMC scoping guidance separates CUI assets from security protection assets, contractor risk managed assets, specialized assets, and out-of-scope assets, and each category carries different documentation and assessment obligations. Getting an asset into the right category, with the reasoning written down, is ordinary work that pays for itself several times over during an assessment.

What you receive in writing

The deliverable is a package you own outright, regardless of whether you engage Petronella Technology Group, Inc. for the remediation that follows. It contains your CUI boundary and data-flow diagram, the graded control matrix covering every applicable requirement with its assessment objectives, your SPRS score calculation worksheet showing exactly how the number was derived, a prioritized Plan of Action and Milestones sequenced by score impact and dependency, and a path-to-assessment roadmap with realistic durations. Where remediation is warranted, a fixed-scope quote follows within two business days so you can budget against a number instead of a feeling.

We deliberately write the findings so a non-technical executive can read the summary and a systems administrator can act on the detail. A readiness report that only a consultant can interpret is a report that quietly expires the moment the consultant leaves.

The scoring methodology starts every organization at 110, one point for each requirement, and subtracts points for each requirement that is not fully implemented. The deductions are weighted by security impact. Most unmet requirements cost one point. A significant group cost three points. A small set of requirements whose absence leaves the environment fundamentally exposed cost five points each. Because the deductions are weighted but the starting value is not, the arithmetic runs below zero as soon as an organization is missing a meaningful share of the heavier requirements. A first honest score in negative territory is common, it is not a moral judgment, and it is dramatically better information than an inflated positive number.

Two subtleties trip people up. First, partial implementation generally does not earn partial credit; a requirement is either implemented or it is not, with narrow exceptions where the methodology permits partial values for multifactor authentication and FIPS-validated cryptography. Second, an unimplemented requirement tracked on a POA&M still costs its points until it is actually closed. A POA&M documents your plan honestly, which matters, but it does not restore the score.

This is where the accuracy of the number stops being an academic question. A self-assessment score posted to SPRS is a representation to the government. Posting a figure that overstates your implementation creates False Claims Act exposure, and enforcement actions in recent years have made that risk concrete for contractors who certified compliance they did not have. The purpose of a readiness assessment is not to manufacture a flattering number. It is to produce a number you can stand behind, with the calculation worksheet that shows how you got there and the POA&M that shows where you are going.

The practical sequence we recommend is simple. Score honestly, post the honest score, then improve it deliberately and re-post as milestones close. A contractor whose score is climbing on a documented plan reads far better to a prime than a contractor whose score has been suspiciously perfect since the day it was first entered.

Cyber AB Registered Provider Organization #1449. An RPO is a company authorized by the Cyber AB, the accreditation body of the CMMC ecosystem, to provide readiness, consulting, and advisory services. RPOs sign a code of professional conduct, and their practitioners individually hold the CMMC-RP credential. You can verify any consultant at the official Cyber AB marketplace.

Every practitioner holds CMMC-RP. Not just the principal. We prepare your evidence the way a C3PAO will assess it, and because we are a Registered Provider Organization rather than the assessor, we keep a clean referral path to the C3PAOs that fit your contract type, geography, and CUI profile. We do not certify you, and we do not promise an assessment outcome we cannot control.

What an RPO can do, and what it cannot

What we can do: assess your current state against the requirements, design and document the enclave boundary, write the System Security Plan and the policy set, build and sequence the POA&M, calculate the SPRS score and show the work, implement and configure the technical controls, train your staff, prepare your evidence package, and sit beside you through the process. That is the entire body of readiness and remediation work, and it is where a contractor's real risk lives.

What we cannot do: certify you, assess you for certification purposes, grade our own work, sign your senior official's affirmation, or promise a result. Only a Certified Third Party Assessment Organization can perform a Level 2 certification assessment, and only the government assesses Level 3. This is not a limitation we regret. It is the point.

Why the independence line protects you

Cyber AB conflict-of-interest rules generally prevent the same organization from both preparing a contractor and certifying that contractor for Level 2. The reason is obvious once stated: a firm that grades its own remediation has an incentive to grade generously, and the value of the certificate depends on that incentive not existing. Any vendor offering to both build your program and certify it is describing a conflict, not a convenience.

The practical benefit for you is that our findings have no commercial reason to flatter you. If your first honest SPRS score is deeply negative, we tell you, because the alternative is that you find out from an assessor after you have already spent the budget. When you are ready for the formal assessment, we refer you to a C3PAO whose scheduling, sector experience, and geography actually fit your situation, and we prepare your team for what that assessment will ask.

Read the practice overview at our CMMC compliance services hub, or compare this engagement against the standalone CMMC readiness assessment page for a deeper walk through the deliverable itself.

Founded in 2002, BBB A+ since 2003. Petronella Technology Group, Inc. has engineered, defended, and forensically investigated networks for more than two decades from Raleigh, North Carolina. That operating history matters during an assessment, because organizational maturity is itself a signal assessors weigh, and it means we can pair CMMC readiness with a full managed XDR and vCISO practice for the contracts that come after certification.