CMMC Compliance Services: Get Audit-Ready with Managed Implementation

Key Takeaways

• CMMC readiness depends on implemented, monitored, and documented safeguards. A gap report alone is not enough.

• Level 1 covers FCI with 15 FAR 52.204-21 requirements. Level 2 covers CUI with 110 NIST SP 800-171 Rev. 2 requirements.

• Phase 2 is paused, but self-assessments and DFARS 252.204-7012 obligations still apply.

• Conditional Level 2 status needs at least 88 of 110, with POA&M closeout within 180 days.

• PKFOD identifies the gaps. BastionX closes them and keeps the evidence current.

Where CMMC Stands Now

The CMMC program rule (32 CFR Part 170) took effect in December 2024, and the DFARS acquisition rule that places CMMC requirements in contracts took effect November 10, 2025. That date began Phase 1, in which new solicitations may require Level 1 or Level 2 self-assessments as a condition of award.

Phase 2, which would have made Level 2 C3PAO certification the default for applicable contracts on November 10, 2026, is suspended. The Department of Defense, also using the secondary title Department of War, announced the suspension on July 13, 2026, and created a CMMC Reform Task Force to review the program. A DFARS class deviation directs contracting officers to leave the suspended third-party assessment requirements out of contracts. Monitor official CMMC announcements and acquisition guidance for any changes resulting from the Task Force's review. (SBA Office of Advocacy)

The suspension does not remove existing obligations. Contracts can still require CMMC self-assessments and affirmations, DFARS 252.204-7012 still requires NIST SP 800-171 safeguards for covered systems, and prime contractors may flow down their own requirements. Some contractors are also choosing voluntary C3PAO assessments. Check your solicitations and contracts for the status you must achieve.

DFARS Compliance and CMMC

DFARS compliance and CMMC are related but not the same. DFARS 252.204-7012 requires contractors handling covered defense information to implement NIST SP 800-171, report cyber incidents to DoD within 72 hours, and use cloud services that meet FedRAMP Moderate or equivalent requirements. DFARS 252.204-7019 and 252.204-7020 require a current NIST SP 800-171 assessment score in SPRS for covered contracts.

CMMC adds verification. DFARS 252.204-7021 and 252.204-7025 make the required CMMC status a condition of contract award. In practice, the same NIST SP 800-171 safeguards support both, so DFARS compliance work and CMMC preparation should be planned together. For NIST work outside the defense context, see our NIST compliance services.

Implementing CMMC Requirements

CMMC readiness starts with understanding your contract requirements and implementing the safeguards that apply to your assessment scope. A gap analysis alone does not establish compliance.

Level 1 requires an annual self-assessment against the 15 FAR 52.204-21 requirements protecting Federal Contract Information (FCI), together with an annual affirmation. Level 2 evaluates the 110 security requirements in NIST SP 800-171 Revision 2. Depending on the contract, Level 2 requires either a self-assessment or an assessment by an authorized or accredited CMMC Third-Party Assessment Organization (C3PAO), generally every three years, with annual affirmations.

SPRS records assessment information, but a numerical score alone does not establish the required CMMC status. Your solicitation, contract, and applicable flowdown requirements determine which status your organization must achieve and maintain.

Understanding the requirements is only part of CMMC preparation. Your organization also needs the people, tools, and time to implement them. A gap analysis identifies the controls you're missing. Someone still has to configure Intune, enforce multi-factor authentication, segment your network, and produce the evidence an assessor will review.

BastionX combines managed IT and cybersecurity to coordinate endpoint configuration, monitoring, remediation, and supporting documentation. The engagement defines who implements each requirement, who reviews the evidence, and which responsibilities remain with your organization.

What CMMC Compliance Costs

A CMMC budget should distinguish assessment and affirmation costs from implementation, remediation, and ongoing operation of safeguards.

In its 2024 CMMC program rule, DoD estimated $101,752 for a small entity to support a Level 2 certification assessment and initial affirmation. That estimate includes preparation, organizational support, assessment activities, reporting, and the C3PAO engagement. It is not simply the assessor's invoice or a standard market price.

The estimate assumes the underlying security requirements have already been implemented. Budget separately for any necessary remediation and ongoing operation of safeguards, and obtain quotes based on your actual assessment scope.

Implementation is a separate budget entirely, and its size depends on three variables:

• Assessment scope: More systems, users, locations, and service providers generally increase implementation and evidence requirements. A larger Level 2 scope does not increase the baseline beyond 110 security requirements, but it can increase the work needed to demonstrate those requirements across the environment.

• Endpoint count: Each managed device adds to the configuration, monitoring, and evidence-collection workload.

• Existing control maturity: An organization starting from a basic IT setup will spend significantly more than one that already runs MFA, endpoint detection, and access logging.

An unsuccessful assessment can add remediation, documentation, and reassessment costs. It can also affect eligibility for opportunities requiring a CMMC status your organization has not achieved. The impact depends on the solicitation or contract, your existing status, and whether you qualify for conditional status and POA&M closeout.

Vendor coordination also affects cost and assessment preparation. Separate IT and security providers can work effectively when responsibilities, escalation procedures, and evidence ownership are clear. An integrated provider may simplify coordination, but it does not eliminate the need for documented responsibilities and verification.

BastionX combines managed IT and cybersecurity to connect implementation, monitoring, and supporting records within an agreed service scope.

CMMC Compliance Services for Level 1 and Level 2

CMMC Level 2 evaluates the 110 security requirements in NIST SP 800-171 Revision 2. BastionX supports readiness by implementing and operating the safeguards assigned to it in the engagement.

Level 1 uses a separate baseline of the 15 FAR 52.204-21 requirements for protecting FCI. Services should match your required level and assessment scope. Your organization retains responsibilities such as workforce practices, physical security, policy approval, and compliance affirmations, with assistance defined in the service agreement. CMMC is one part of our cybersecurity compliance services.

Unresolved findings can delay assessment readiness and increase remediation costs. BastionX's work falls into four service areas.

CMMC Remediation from Gap Findings. PKFOD performs the gap analysis against the applicable baseline: the 15 FAR 52.204-21 requirements for Level 1 or the 110 NIST SP 800-171 Revision 2 requirements across 14 families for Level 2. BastionX works from those findings, or from an existing assessment report, to prioritize remediation by risk and assessment impact, assign remediation responsibilities, and track progress and supporting evidence.

Identity Hardening and Secure Remote Access. BastionX configures supported identity, endpoint, and access controls within the engagement, including MFA, Conditional Access, least-privilege permissions, and device-compliance policies. Zero Trust principles can guide implementation, but CMMC does not require a particular Zero Trust product.

Remote access to CUI systems must meet applicable authentication, access, logging, and cryptographic requirements. When cryptography protects CUI confidentiality, the design must use FIPS-validated cryptography as required by NIST SP 800-171 Revision 2. For remote connectivity, BastionX can deploy CipherNet, BastionX's own fork of an open source WireGuard mesh platform, which we maintain, host and operate. CipherNet's suitability must be evaluated against the actual deployment and cryptographic modules before it is included in a CUI protection design.

24/7 SOC Monitoring and MDR. Level 2 includes ongoing security-control monitoring and system-monitoring requirements. It does not specifically require a 24/7 U.S.-based SOC. BastionX offers round-the-clock monitoring for systems covered by the engagement, with investigation, escalation, and authorized response actions defined in agreed procedures.

SSP Maintenance and Supporting Evidence. The System Security Plan describes the assessment boundary, operating environment, implementation of security requirements, and connections to other systems. BastionX uses available automation to collect configuration and monitoring records, supplemented by human review, approved documentation, interviews, and testing. The SSP and supporting evidence are reviewed and updated as the environment changes.

• Remediation of gap findings against the 15 Level 1 or 110 Level 2 requirements

• Identity, endpoint, and access controls across Microsoft 365, Azure, and Intune

• Secure remote access evaluated against applicable authentication and cryptographic requirements

• Round-the-clock monitoring with defined investigation, escalation, and response procedures

• SSP and evidence maintenance supported by automation and human review

9 Tasks Your CMMC Partner Should Handle

A capable CMMC partner stays involved through implementation, evidence collection, and ongoing maintenance.

Consulting and implementation responsibilities depend on the service agreement. Use this checklist to identify which tasks your partner will perform, which remain with your organization, and how completion will be verified.

1. System Security Plan (SSP) development and maintenance for Level 2. Your partner helps document the assessment boundary, operating environment, implementation of security requirements, and connections to other systems, and keeps the SSP current as the environment changes. Level 1 does not independently require an SSP, but your organization must retain the evidence used to support its self-assessment.

2. POA&M remediation and closure evidence. Track deficiencies, responsible owners, deadlines, and closure evidence. For conditional Level 2 status, the assessment score must be at least 88 out of 110, and only eligible unmet requirements may remain on a POA&M. Closeout must occur within 180 days. Level 1 does not permit POA&Ms. Assign remediation responsibilities between your organization and its providers.

3. Assessment scope and service-provider responsibilities. Identify relevant information flows, assets, people, locations, and external services. Level 1 scope concerns FCI; Level 2 scope includes CUI assets and applicable security-protection assets and services. Document provider responsibilities in the SSP and customer responsibility matrix. For cloud services that process, store, or transmit CUI, verify that the specific service offering is FedRAMP Moderate authorized or higher, or meets DoD's requirements for FedRAMP Moderate equivalency. Confirm applicable DFARS obligations and document shared responsibilities. Include relevant external security services in the assessment scope, even when they handle security protection data without CUI, and configure segmentation where appropriate.

4. Access control for CUI systems. Limit access to CUI systems based on identity, authorization, and device posture, and protect remote connections with the required authentication and cryptography. Zero Trust principles can guide this work, but the requirement is the outcome, not a specific product.

5. Identity and endpoint hardening in Microsoft 365, Azure, and Intune. MFA enforcement, conditional access policies, privileged identity management, and device compliance baselines in Intune are practical controls that support requirements across multiple NIST SP 800-171 families.

6. Security monitoring and response. Define monitoring coverage, review procedures, escalation paths, and response authority. A SOC can support these activities, but its location and operating hours alone do not demonstrate that the applicable CMMC requirements are met.

7. Evidence collection and retention. Retain the evidence used for Level 1 and Level 2 assessments for six years from the applicable CMMC Status Date, including evidence supporting self-assessments. For a Level 2 certification assessment, also hash the evidence files using a NIST-approved hashing algorithm and provide the C3PAO with the artifact names, hash values, and algorithm used. Define who collects, protects, and retains these records.

8. Assessment preparation and evidence packaging. Your partner should have every requirement's evidence organized, timestamped, and retrievable before the assessment window opens, so your staff can answer requests promptly.

9. Assessment independence and retained accountability. For Level 2 certification, use an authorized or accredited C3PAO that meets applicable impartiality requirements. For Level 1 and Level 2 self-assessment, your organization remains responsible for the assessment and submissions. Providers may assist with preparation, but implementation support does not replace the required assessment or your affirming official's responsibilities.

If a partner can't explain how it handles each task, ask for specifics before you sign.

From the field

Rashid Ahmed, CISSP, CISO & CTO

I spent 17 years at Payomatic, progressing through technology and security leadership roles to become CISO. My work included implementing PCI DSS controls to support Level 1 validation requirements, implementing NYDFS Part 500 requirements, managing incident response and vendor risk, and reporting to executive leadership. I also worked with auditors on security controls supporting SOC 2 examinations.

Each of those frameworks has its own requirements and assessment process, and CMMC does too. What carries over is the discipline: define the scope, assign each requirement an owner, put safeguards into operation, and keep evidence that shows how they work. In my experience, assessments go poorly when nobody can say who owns a control or where its evidence lives. That is why our CMMC engagements start with a documented scope and responsibility matrix.

Your Role in the Compliance Journey

Your organization remains accountable for its CMMC obligations, even when outside providers assist with implementation and assessment preparation.

• Your organization confirms requirements and approves scope. Your team supplies contract and workflow knowledge, works with qualified providers to identify relevant information and systems, and approves policies and responsibilities.

• PKFOD identifies the gaps. PKFOD performs the gap analysis and readiness assessment against the baseline for your required level.

• BastionX performs the work assigned in the engagement. This may include configuration, monitoring, remediation, and evidence support. Responsibilities retained by your organization are documented.

• The assessment follows the required pathway. Level 1 uses self-assessment. Level 2 uses self-assessment or C3PAO certification assessment, as required by the contract. Your affirming official remains responsible for the required compliance affirmations.

A documented scope and responsibility matrix help align implementation, evidence preparation, and assessment activities.

Frequently Asked Questions

Is CMMC still required after the Phase 2 suspension?

Yes. The July 2026 suspension paused advancement to Phase 2, including its planned expansion of Level 2 C3PAO certification requirements. Phase 1 self-assessment and affirmation requirements remain in applicable solicitations, and DFARS 252.204-7012 still requires NIST SP 800-171 safeguards for covered contractor systems. Prime contractors may also flow down their own requirements.

What is the difference between CMMC Level 1 and Level 2?

Level 1 applies to Federal Contract Information and covers the 15 FAR 52.204-21 requirements, assessed annually by self-assessment. Level 2 applies to Controlled Unclassified Information and covers the 110 requirements in NIST SP 800-171 Revision 2, assessed by self-assessment or by a C3PAO, depending on the contract.

Does BastionX perform the CMMC gap analysis?

No. PKFOD performs gap analysis and readiness assessment. BastionX implements the findings, remediates gaps, and maintains the safeguards and evidence. If you already have a gap report from another provider, we can work from that.

Can the company that implements our controls also certify us?

No. A C3PAO performing a Level 2 certification assessment must meet impartiality and conflict-of-interest requirements, which separate the assessment from implementation and consulting work. BastionX implements and operates agreed safeguards and supports assessment preparation. The C3PAO performs the assessment.

What SPRS score do we need?

Final Level 2 status requires a CMMC assessment score of 110, with all applicable requirements satisfied. Conditional Level 2 status requires at least 88, permits only eligible outstanding requirements, and requires successful POA&M closeout within 180 days of the Conditional CMMC Status Date. Level 1 uses an overall MET or NOT MET result rather than a numerical score. An existing NIST SP 800-171 assessment score in SPRS does not, by itself, establish CMMC status. Your contract determines the required assessment pathway and status. (32 CFR §170.21)

Does CMMC require a 24/7 SOC or Zero Trust?

No. Level 2 includes monitoring, access control, and cryptographic requirements, but it does not require a 24/7 U.S.-based SOC or a particular Zero Trust product. Those are ways to meet the requirements, and they must be documented and verified like any other control.

How long do we need to keep assessment evidence?

Retain assessment evidence for six years from the applicable CMMC Status Date for Level 1 self-assessments, Level 2 self-assessments, and Level 2 certification assessments. Level 2 certification assessments also require evidence-file hashing and submission of the required artifact and hash information to the C3PAO.

Who signs the annual affirmation?

Your organization's affirming official. Providers can help prepare evidence and maintain safeguards, but they cannot take over that responsibility.

How We Researched This Guide

This guide draws on the CMMC program rule at 32 CFR Part 170, including the final rule published October 15, 2024 and its cost estimates; FAR 52.204-21; the DFARS acquisition rule that took effect November 10, 2025; DFARS 252.204-7012, -7019, and -7020; NIST SP 800-171 Revision 2; and the Department of Defense's July 13, 2026 memoranda suspending Phase 2. Because the CMMC Reform Task Force may recommend changes, confirm current requirements against your solicitation, contract, and official guidance.

The implementation sections draw on Rashid Ahmed's experience developing security programs, assessing risk, implementing safeguards, and supporting audits in financial services and other regulated environments. The guide distinguishes regulatory requirements from implementation choices, including security operations centers, Zero Trust architecture, and specific remote-access platforms.

BastionX's service descriptions explain how the company implements, monitors, and maintains security controls. Each engagement defines the services provided and the responsibilities retained by the client. BastionX does not perform gap analyses, readiness assessments, or certification assessments. Gap analysis and readiness assessment are performed by PKFOD, and certification assessments by an authorized C3PAO.