All programs / CMMC
CMMC requirements are now appearing in Department of Defense contracts. Start with Level 1 today: a free guided questionnaire, professional documentation, or a fully guided build.
Your CMMC level depends on the type of information your contracts involve. Your contract or solicitation states the required level.
Information provided by or generated for the government under a contract that isn’t intended for public release. You need Level 1.
More sensitive information marked or identified as CUI, such as technical drawings or specifications. You need Level 2.
The 15 basic safeguarding requirements for FCI, documented and ready for your annual self-assessment and SPRS affirmation.
Preparation for the 110 NIST SP 800-171 requirements that protect CUI, from scoping and SSP to assessment readiness.
Ongoing support for Level 2 contractors: annual affirmations, SSP updates and continuous readiness between assessments.
No third-party certification is involved. Level 1 requires an annual self-assessment against the 15 requirements and an annual affirmation of compliance in SPRS by a senior official of your company.
Your SPRS affirmation is a formal representation to the government. Misrepresenting your security posture can create False Claims Act exposure, so your self-assessment should reflect what’s actually in place.
We’re building the Level 2 program now. Join the waitlist and we’ll contact you when it opens, along with any early-access pricing.
CMMC requirements flow down to subcontractors that handle FCI or CUI. If your prime contractor shares contract information with you, expect the same requirement.
Start free, or talk to NBT Systems about your contracts.
