CMMC compliance that passes the assessment
Level 1 and Level 2 readiness for Georgia manufacturers, engineering firms and subcontractors in the defense supply chain. We find the gaps, fix them in your environment and get you ready for the assessor.
- Gap assessment against all 110 NIST SP 800-171 requirements
- Hands-on remediation by engineers, not a binder of templates
- System Security Plan, POA&M and SPRS score you can defend
- Prepared for your C3PAO assessment and the years after it
Where most small contractors are right now
The firms we talk to usually aren't ignoring CMMC. They're stuck somewhere between knowing it matters and knowing what to do first.
A prime just asked for your status
A questionnaire or a flow-down clause showed up, and nobody on your team is sure whether you need Level 1 or Level 2, or what your SPRS score should say.
You posted a score you can't back up
Someone submitted a self-assessment years ago. Under CMMC, a senior official now has to affirm it, and a False Claims Act case is a real risk if it's wrong.
CUI is everywhere
Drawings and specs live in email, on a shared drive, on shop-floor PCs and in personal OneDrive folders. You can't protect what you can't find.
Your IT provider says "we've got it"
But they can't show you a System Security Plan, an asset inventory or evidence for a single control. An assessor will ask for all three.
What the final CMMC rule requires
These come from the CMMC program rule (32 CFR Part 170) and the DFARS clauses that put it into contracts.
What CMMC means for a Georgia contractor in 2026
The Cybersecurity Maturity Model Certification (CMMC) is how the Department of Defense checks that contractors actually protect the information it shares with them. The requirements themselves aren't new. Most defense contracts have carried DFARS 252.204-7012 and the NIST SP 800-171 controls for years. What's new is that compliance is now verified, scored and tied to contract awards.
Which level do you need?
- Level 1 applies if you only handle Federal Contract Information (FCI), meaning non-public information the government gives you or that you create under a contract. It covers 15 basic safeguarding requirements from FAR 52.204-21. You complete a self-assessment every year and a senior official affirms it in SPRS.
- Level 2 applies if you receive, store or send Controlled Unclassified Information (CUI), such as technical drawings, specifications, export-controlled data or anything marked CUI. It covers all 110 requirements in NIST SP 800-171 Rev. 2. Depending on the contract, that's either a self-assessment or a certification assessment by an authorized third party (a C3PAO), valid for three years with an annual affirmation.
- Level 3 adds 24 requirements from NIST SP 800-172 and is assessed by the government's DIBCAC. It applies to a small number of programs.
The timeline
The CMMC program rule took effect on December 16, 2024, and the DFARS rule that puts CMMC into contracts took effect on November 10, 2025. That started Phase 1, where solicitations can require Level 1 or Level 2 self-assessments. Phase 2 begins November 10, 2026, when Level 2 certification by a C3PAO can be required before award. Phases 3 and 4 follow in 2027 and 2028.
Why Georgia contractors feel it
Georgia has a deep defense supply chain. Machine shops, electronics assemblers, engineering firms and software developers support work tied to Dobbins Air Reserve Base and Lockheed Martin's plant in Marietta, Robins Air Force Base near Warner Robins, and Army and Navy installations across the state. Many of these suppliers have 10 to 150 employees and no full-time security staff. CMMC applies to them the same way it applies to a large prime.
What it takes to pass
Assessors don't grade policies on paper. For each requirement they look for evidence that the control is implemented and working: configuration screenshots, logs, access reviews, training records and interviews with your staff. The usual sticking points are multifactor authentication everywhere CUI is reachable, FIPS-validated encryption, audit logging that someone actually reviews, incident reporting within 72 hours, and cloud services that meet FedRAMP Moderate or equivalent. That last one is why many contractors move CUI into Microsoft 365 GCC High or a defined CUI enclave.
Getting there is mostly engineering work, not paperwork. That's where an IT and security team that does the hands-on implementation saves time over a consultant who hands you a gap list and leaves.
From first gap to final assessment
Start with an assessment, or bring us in at any stage. Each service stands on its own.
Gap Assessment
Find out exactly where you stand against Level 1 or all 110 Level 2 requirements, with a realistic SPRS score.
See what's includedCMMC Level 1
The 15 basic safeguarding requirements for contractors that handle Federal Contract Information only, plus the annual self-assessment.
Level 1 detailsCMMC Level 2
All 110 NIST SP 800-171 requirements, implemented and documented, with your team prepared for the C3PAO assessment.
Level 2 detailsGCC High & CUI Enclaves
A CUI environment that meets DFARS 7012: Microsoft 365 GCC High migrations or a focused enclave that keeps scope small.
Compare the optionsThree ways contractors approach CMMC
Most firms try one of the first two before they call us.
| Do it in-house | Paperwork consultant | Sentry Cloud IT | |
|---|---|---|---|
| Gap assessment | Spreadsheet from a blog post | Thorough, but stops at the report | All 110 requirements, with evidence noted for each |
| Technical fixes | Whoever has time | Left to you or your MSP | Done by our engineers in your environment |
| SSP and POA&M | Template, half filled in | Well written, may not match reality | Written from what's actually configured |
| CUI environment | CUI spread across everything | Recommendation only | GCC High or enclave designed, migrated and supported |
| Assessment day | Learning as you go | Sometimes on site | Evidence organized by requirement; we sit in |
| After certification | Drift sets in | New engagement needed | Monitoring, annual affirmation support and change control |
Four steps to assessment-ready
Timelines depend on your starting point. A focused Level 2 project for a small contractor typically runs four to eight months.
Scope
We identify where FCI and CUI enter, live and leave your business, and draw the boundary the assessor will use.
Assess
Every applicable requirement is tested, scored and documented with the evidence that exists today.
Remediate
Our engineers close the gaps: MFA, encryption, logging, endpoint hardening, GCC High or enclave build-out, policies and training.
Prove it
SSP, POA&M and SPRS score are finalized, evidence is organized by requirement, and we prepare your team for the C3PAO.
Statewide, from metro Atlanta to the coast
Our engineers are based in Alpharetta and work on site across metro Atlanta. Contractors elsewhere in Georgia get the same team, with remote work and planned site visits.
- Atlanta
- Marietta
- Kennesaw
- Alpharetta
- Peachtree Corners
- Norcross
- Lawrenceville
- Warner Robins
- Macon
- Columbus
- Augusta
- Savannah
- Athens
- Gainesville
CMMC questions we hear every week
Do we need Level 1 or Level 2?
If you only handle Federal Contract Information, Level 1. If you receive or create Controlled Unclassified Information (drawings, specs, export-controlled or CUI-marked data), Level 2. Your contract's DFARS clauses and what your prime sends you decide it. We can usually tell you in one call.
Can Sentry Cloud IT certify us?
No, and no one who helped you prepare can. Certification assessments are done by an authorized C3PAO that is independent of your implementation partner. We get you ready, organize the evidence and support you through the assessment.
How long does Level 2 take?
For a contractor with 10 to 100 users and a reasonably modern setup, four to eight months is typical. Moving CUI into GCC High or an enclave is usually the longest single task.
What does it cost?
It depends on how many users and systems are in scope and how much is already in place. After the gap assessment we give you a fixed-price proposal, so there are no open-ended hourly bills.
Don't find out from a contracting officer
Primes are already asking subcontractors for CMMC status. A gap assessment tells you where you stand in about two weeks, so you can answer with a plan instead of a guess.