CMMC is a cybersecurity framework created by the US DoD that establishes a minimum threshold level of cybersecurity that organizations entrusted with sensitive defense information must meet or exceed. CMMC was created to curtail the theft of controlled unclassified information (CUI) by adversaries of the United States.

These levels are based on the sensitivity of DoD information received or handled:

• CMMC level 1: Foundational – Applies to companies that only receive federal contact information (FCI). These 17 controls define requirements for basic cyber hygiene.
• CMMC level 2: Advanced – Aligns with the 14 Control Families and 110 security controls within National Institute of Technology and Standards (NIST) Special Publication 800-171 Revision 2 to protect controlled unclassified information (CUI).
• CMMC level 3: Expert – This is intended for companies that collaborate with CUI on the DoD’s highest-priority programs. It is focused on reducing the risk from Advanced Persistent Threats (APTs).

We offer a full suite of advisory and remediation services, including CUI boundary workshops, GAP analyses, and strategy and planning. Plus, Coalfire is one of the first authorized CMMC Third Party Assessment Organization (C3PAO) and a Registered Provider Organization (RPO).

Coalfire can either provide services that help you prepare for a CMMC certification assessment or can perform the CMMC certification assessment, but we can’t do both for the same company. Coalfire’s suite of CMMC Certification Ready services are designed to help you prepare for CMMC Certification in a timely, cost-efficient manner. CMMC Certification services include conducting mock assessments and performing a CMMC certification assessments.

While Coalfire provides services to OSCs looking for CMMC Certification Readiness as well as OSCs seeking CMMC Certification, Coalfire cannot assess an organization for whom we have provided CMMC advisory services within the past two years.

Your maturity level is determined based on the nature of the DoD contracts and work that you would like to pursue. Generally, an organization that only handles FCI (Federal Contract Information) must certify at level 1. Any organizations that handle Controlled Unclassified Information (CUI) must certify to level 2.

CMMC 2.0 simplified both compliance requirements and the assessment process, aligning CMMC Level 2 with NIST SP 800-171 R2. The rule to enact CMMC 2.0 is current in process and expected to be published as an Interim rule in 2023. It will go into effect 60 days after its publication.