CMMC questions, answered plainly
The questions Georgia contractors ask us most, answered based on the final CMMC rule.
What is CMMC?
The Cybersecurity Maturity Model Certification is the Department of Defense program that verifies contractors protect Federal Contract Information and Controlled Unclassified Information. It's defined in 32 CFR Part 170 and added to contracts through DFARS 252.204-7021.
When does CMMC apply to my contracts?
Phase 1 began November 10, 2025, with Level 1 and Level 2 self-assessments in solicitations. Phase 2 begins November 10, 2026, when Level 2 C3PAO certification can be required. Primes may ask subcontractors for status sooner.
What's the difference between FCI and CUI?
FCI is non-public information provided by or generated for the government under a contract. CUI is a narrower category that needs safeguarding under law or policy, such as controlled technical information and export-controlled data. FCI leads to Level 1, CUI to Level 2.
What is an SPRS score?
It's the result of a NIST SP 800-171 assessment, on a scale from -203 to 110, recorded in the government's Supplier Performance Risk System. Contracting officers can see it.
What is a POA&M, and can we use one?
A Plan of Action and Milestones lists requirements that aren't fully met yet. At Level 2, you can get conditional status with a score of at least 88, if the open items are allowed on a POA&M and closed within 180 days. Level 1 doesn't allow POA&Ms.
Who can perform our Level 2 certification?
Only an authorized C3PAO, listed in the Cyber AB marketplace. An organization that helped implement your controls can't also certify you.
Do we need Microsoft 365 GCC High?
If CUI is stored or processed in Microsoft 365, the service generally has to meet FedRAMP Moderate or equivalent under DFARS 7012, and GCC High is the usual choice. A CUI enclave can limit how many users need it.
How long does CMMC Level 2 take?
Typically four to eight months for a small contractor, longer if a large GCC High migration or major infrastructure changes are needed.
Does CMMC certification expire?
Level 1 self-assessments are done every year. Level 2 and Level 3 assessments are valid for three years. A senior official must affirm continued compliance every year at every level.
Do you work with contractors outside Atlanta?
Yes. We support contractors across Georgia, including Warner Robins, Macon, Columbus, Augusta and Savannah, with remote work and planned site visits.
Don't find out from a contracting officer
Primes are already asking subcontractors for CMMC status. A gap assessment tells you where you stand in about two weeks, so you can answer with a plan instead of a guess.