CMMC 2.0 Compliance
CMMC Level 2, done by people who have been through the assessment.
Compliance Gauge takes defense suppliers from CUI scoping through all 110 NIST 800-171 practices to a passed C3PAO assessment.
What it is
CMMC 2.0 is the Department of Defense's way of verifying that its suppliers actually protect Federal Contract Information and Controlled Unclassified Information. Level 1 covers 17 basic practices for FCI. Level 2 covers all 110 practices of NIST SP 800-171 and, for most contracts, requires a third-party assessment by a C3PAO. The requirement flows down the entire supply chain, so a two-person machine shop can be held to the same 110 practices as the prime.
Who needs it
- Prime contractors and subcontractors under DFARS 252.204-7012
- Manufacturers, machine shops and electronics suppliers handling drawings marked CUI
- Engineering and design firms on DoD programs
- MSPs and cloud providers supporting any of the above
What we do
- CUI identification and data-flow mapping to shrink the assessment boundary
- Gap assessment scored using the DoD Assessment Methodology
- Enclave design: Microsoft GCC High, Azure Government or a segmented on-prem environment
- Implementation of all 110 practices with evidence captured per control
- System Security Plan, POA&M and SPRS score submission
- Mock assessment, then C3PAO coordination and finding response
The same four steps, every framework.
Scoped gap assessment
Inventory, data-flow mapping and a scored findings list with a cost to close.
Remediation plan
Every gap gets an owner, a fix and a date on the plan of action.
Implementation and evidence
Our engineers close the gaps; evidence is captured control by control.
Mock audit, then the real one
We run it the way the assessor will, then sit beside you for the real thing.
Frequently asked questions
How long does it take to get ready for a CMMC Level 2 assessment?
Most small and mid-size defense suppliers need three to six months from gap assessment to assessment-ready, depending on how much of the environment is in scope and whether an enclave has to be built. The scoped gap assessment in week one gives you a specific timeline for your environment.
Do we need a C3PAO assessment or can we self-assess?
Level 1 (FCI only) is an annual self-assessment. Most Level 2 contracts require a third-party assessment by an authorized C3PAO every three years, with an annual affirmation in between. A small subset of Level 2 contracts allow self-assessment; your contracting officer or prime confirms which applies.
What is an SPRS score and why does it matter?
Your Supplier Performance Risk System score reflects your NIST 800-171 self-assessment out of a maximum of 110. Contracting officers can see it, and a false or inflated score is a False Claims Act risk. We score it the way an assessor would before you submit it.
Can you host our CUI environment?
Yes. We design and operate enclaves in Microsoft GCC High or Azure Government, or a segmented on-premises environment, and provide the shared responsibility matrix your assessor will ask for.
Do you work with companies outside California?
Yes. Compliance Gauge serves defense suppliers nationwide; assessments and remediation are delivered remotely with on-site visits where physical security controls require them.
Find out where you stand on CMMC 2.0.
A scoped gap assessment gives you a compliance score, a findings list and a cost to close — before you commit to anything.