CMMC readiness for small defense contractors.
Plain-language guidance, a clear roadmap, and the documentation you need to meet your contract's CMMC requirements.
Your contract sets the level. Here is what each one means.
| Level 1 | Level 2 | |
|---|---|---|
| Information protected | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Requirements | 15 basic safeguarding requirements FAR 52.204-21 | 110 security requirements NIST SP 800-171 Rev 2 |
| Assessment | Annual self-assessment | Self-assessment or C3PAO assessment, as the contract specifies |
| Open items allowed? | No. Every requirement must be met. | A limited plan of action for certain requirements, closed within 180 days |
| Affirmation | Annual, by a senior company official, in SPRS | Annual, by a senior company official, in SPRS |
Level 3 applies to a small number of programs and is assessed by the government. Requirements summarized from 32 CFR Part 170; your contract language governs.
Three steps from first conversation to assessment-ready.
Assess
Confirm what data you handle and which level applies, define the boundary, then measure every gap.
Build
Close the gaps with policies, configurations, and evidence, starting with what carries the most risk.
Sustain
Keep controls working and evidence current between assessments and annual affirmations.
Everything you need to show your requirements are met.
- Scope and boundary. The people, systems, and locations in your assessment, documented.
- Gap assessment. Your environment measured against every requirement in your level.
- Policies and procedures. Written for how your company actually works, plus a System Security Plan for Level 2.
- Prioritized action plan. Every gap with an owner, a fix, and a date, ordered by risk.
- Microsoft 365 configuration. MFA, Conditional Access, and device encryption set up in the tools you already have.
- Evidence, organized. Proof for each requirement, ready for your assessment and annual affirmation.
CMMC questions we hear most.
Does every defense contractor need CMMC?
CMMC applies when a Department of Defense contract includes the CMMC requirement, and the contract states which level. If you handle Federal Contract Information, expect Level 1; if you handle Controlled Unclassified Information, expect Level 2 or higher. We start every engagement by confirming what your contracts actually require.
We don't handle CUI. Do we still need to do anything?
If you handle Federal Contract Information, Level 1's 15 requirements apply, with an annual self-assessment and affirmation. Getting the scope right matters: documentation should describe your real situation, not one you might be in later.
Can Brookmore certify us?
No. Level 1 is a self-assessment that your company affirms. Level 2 is either a self-assessment or an assessment by an authorized third party (a C3PAO), depending on the contract. Brookmore provides readiness and advisory services, is not a C3PAO, and does not issue certifications.
Do we need Microsoft GCC High?
Not always. The right environment depends on the data you handle and your contract requirements. Many Level 1 companies meet their requirements in commercial Microsoft 365. We help you weigh the options before you commit to a migration.
How long does readiness take?
It depends on your level, size, and starting point. A small Level 1 company with good basics can be ready in weeks; Level 2 typically takes months. The gap assessment gives you a realistic timeline.
Brookmore provides readiness and advisory services. We are not a C3PAO and do not issue CMMC certifications.
Have a CMMC clause in your contract?
Send us the clause or tell us what data you handle. We will tell you which level applies and what it takes.