DFARS Rule Effective Nov 10, 2025 • C3PAO Assessments Mandatory Nov 10, 2026

CMMC Compliance

Cybersecurity Maturity Model Certification is now a contractual requirement for every organization in the Department of Defense supply chain. Phase 1 is active. Phase 2 mandatory third-party assessments begin November 2026. AGS guides you from where you are today to full certification, efficiently and without the guesswork.

Get Your Free Assessment Learn More

Foundational

Basic cybersecurity practices covering the fundamentals of protecting your business and government data. Annual self-assessment required. Applies to contracts involving Federal Contract Information (FCI) without sensitive government data.

Most Common

Advanced

Comprehensive security requirements across 14 areas of your IT environment. Applies when your contract involves sensitive government data (CUI). Third-party assessment by an accredited firm required starting November 2026.

Expert

The highest tier, building on Level 2 with additional protections against sophisticated, state-sponsored threats. Government-conducted assessment. Reserved for the most sensitive DoD programs.

What Is CMMC?

Protecting the Defense Industrial Base

Put simply: the federal government now requires proof that contractors handling sensitive information are actually protecting it. If your company works on DoD contracts, your cybersecurity practices are subject to formal certification requirements, and non-compliance means losing access to those contracts.

CMMC 2.0 is the Department of Defense's framework for that verification. The program rule (32 CFR Part 170) was finalized in October 2024. The DFARS implementation rule (DFARS Case 2019-D041, clause 252.204-7021) took effect November 10, 2025, inserting CMMC requirements directly into new DoD contracts.

If your organization handles Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) as part of any DoD contract, CMMC compliance is a contractual condition of award. It is not optional.

Applies to prime contractors and every subcontractor in the supply chain
Non-compliance disqualifies your organization from DoD contract awards
A System Security Plan documenting your security controls is required before an assessment can be scheduled
Your compliance score must be submitted to the government's contractor database before contract award
Independent third-party assessments are mandatory starting November 10, 2026 for most contracts involving sensitive data
CMMC requirements flow down to all subcontractors at every tier

How AGS Helps

Our CMMC Compliance Services

Most businesses don't know exactly where they stand until someone looks. We do the looking, fix what we find, document everything an assessor needs, and stay with you through the formal certification process.

Readiness Assessment

We review your IT environment against every CMMC requirement. You get a plain-English picture of where you stand, what you're missing, and how far you are from being certifiable.

Gap Analysis

We identify every gap between your current controls and CMMC requirements, prioritized by risk and effort so your team knows exactly where to focus first.

SSP & Policy Development

Every assessor will require a System Security Plan documenting how your organization protects its data. We write yours along with the full policy library, built to hold up under real scrutiny rather than just filling a template.

Gap Remediation

We don't just identify problems. We fix them. Our team implements the technical and administrative controls needed to close your compliance gaps.

Audit Preparation

We prepare your organization for the formal third-party assessment, organizing your evidence, running practice walkthroughs with your team, and making sure nothing catches you off guard on assessment day.

Continuous Compliance

CMMC compliance is not a one-time event. We provide ongoing monitoring, policy maintenance, and annual assessment support to keep you continuously compliant.

Our Process

Your Path to CMMC Certification

A clear, structured process so you always know where you stand and what comes next.

Initial Scoping

We determine which certification level applies to your contracts, identify what data and systems are covered, and establish the boundaries of what your assessment will include.

Gap Assessment & Compliance Score

We evaluate your environment against every CMMC requirement and calculate your current compliance score. You get a prioritized list of what needs to be fixed, in what order, and what the effort looks like.

Documentation Development

We write your System Security Plan, a required document every assessor will review, and a formal remediation plan covering any gaps that need additional time to close.

Remediation & Implementation

Our team does the actual work: deploying the right security tools, writing required policies, configuring your systems, and training your staff so every compliance category is covered.

Score Submission & Assessment Coordination

We submit your updated compliance score to the government's contractor database, compile your evidence package, run a practice walkthrough, and schedule your formal third-party assessment, booking early given the 3 to 6 month lead times common with accredited assessors.

The MSP Difference

One Provider for Your IT and Your Compliance

Most CMMC consultants deliver a gap report and a policy binder, then walk away. AGS is different. We are your managed IT provider, which means we deploy, configure, and operate the actual technical controls that satisfy CMMC requirements, and we maintain them year-round.

When your C3PAO assessor asks for evidence, we pull it from systems we already manage. When a control drifts, our monitoring catches it before it becomes an audit finding.

The tools we already run in your environment (Huntress SIEM, ThreatLocker, Duo MFA, NinjaOne RMM) directly satisfy specific CMMC technical controls
Your SPRS score is monitored continuously, not just recalculated before a deadline
Policy and procedure maintenance is included in managed services, keeping you compliant between your 3-year reassessments
No coordination gap between the people who built your network and the people assessing it. That is us, both times

MSP / Compliance Image
Replace with your image

The Business Case

What CMMC Compliance Really Costs You

The conversation around CMMC usually focuses on the cost of getting compliant. The more important number is what non-compliance costs when your next contract is on the line.

100%

Contract Ineligibility

Every DoD solicitation that includes DFARS clause 252.204-7021 requires a current CMMC status as a condition of award. There is no waiver and no grace period for existing vendors. If your recompete lands before you're certified, you're out.

$9.36M

Avg. Government Sector Breach Cost

The IBM Cost of a Data Breach Report 2024 puts the average government sector breach at $9.36M, nearly double the cross-industry average. The 110 NIST SP 800-171 controls CMMC requires are specifically designed to prevent these incidents.

6–18 mo

Typical Time to Level 2 Readiness

From initial gap assessment to a passed C3PAO evaluation, most organizations need 6 to 18 months. With Phase 2 mandatory assessments starting November 10, 2026 and C3PAO scheduling lead times of 3–6 months, the window to act without pressure is now.

CMMC Level 2

What Your Assessment Covers

An assessor will evaluate your security program across 14 categories, from how you control who has access to your systems to how you respond when something goes wrong. Every category has specific requirements your environment must meet. AGS has deep expertise across all 14 domains.

Access Control (AC)

Awareness & Training (AT)

Audit & Accountability (AU)

Configuration Management (CM)

Identification & Authentication (IA)

Incident Response (IR)

Maintenance (MA)

Media Protection (MP)

Personnel Security (PS)

Physical Protection (PE)

Risk Assessment (RA)

Security Assessment (CA)

System & Comm. Protection (SC)

System & Info. Integrity (SI)

Act Now

The Phased Enforcement Clock

CMMC requirements began appearing in new DoD contracts on November 10, 2025. The program rolls out in four phases over three years. Phase 2, which requires mandatory C3PAO third-party assessments for most Level 2 contracts, begins November 10, 2026.

With fewer than 100 authorized C3PAOs serving an estimated 80,000+ contractors needing Level 2 certification, scheduling delays of 3–6 months are already common. Organizations that haven't started gap work by mid-2026 will statistically miss Phase 2 readiness.

Phase 1 (Nov 10, 2025): CMMC in new contracts; Level 1 & Level 2 self-assessments required
Phase 2 (Nov 10, 2026): C3PAO third-party assessment mandatory for most Level 2 CUI contracts
Phase 3–4 (2027–2028): Full enforcement across all DIB contracts and subcontractors
Typical Level 2 prep time: 6–18 months from initial gap assessment to C3PAO
Non-compliant organizations are ineligible for contract award, with no exceptions

Start Your Assessment Today

Timeline / Urgency Graphic
Replace with your image