Question 1

What is CMMC and why does it exist?

Accepted Answer

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense framework that verifies a defense contractor's cybersecurity hygiene before they handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). It exists because self-attestation under DFARS 252.204-7012 produced inconsistent compliance across the Defense Industrial Base, and adversary exfiltration of CUI from sub-tier contractors became a national-security concern. CMMC 2.0 collapses the earlier 5-level model to 3 levels (L1 FCI, L2 CUI, L3 high-confidentiality CUI) and ties certification to specific contract requirements.

Question 2

What is the difference between CMMC Level 1, Level 2, and Level 3?

Accepted Answer

Level 1 covers FCI only - 17 basic safeguarding practices, self-assessed annually. Level 2 covers CUI - all 110 NIST SP 800-171 Rev 2 controls, third-party assessed every 3 years by a Cyber AB-authorized C3PAO. Level 3 covers high-confidentiality CUI - Level 2 plus a subset of NIST SP 800-172 enhanced controls, government-led assessment. Most prime contractors flow down Level 2 because they treat any technical data above general descriptive material as CUI.

Question 3

When does CMMC become mandatory?

Accepted Answer

CMMC 2.0 entered phased implementation in 2025 under the DoD final rule. Phase 1 (self-assessment) is in effect for solicitations using DFARS clause 252.204-7021. Phase 2 (C3PAO certification for Level 2) began rolling into new contract awards in 2026 and continues through 2028. If your contract or any flowdown references DFARS 252.204-7012 or 252.204-7021, you are already inside the compliance window - the only question is whether your certification timeline matches the contract's anticipated award date.

Question 4

Do I need CMMC if I only handle FCI, not CUI?

Accepted Answer

Yes - FCI-only contractors need CMMC Level 1 (self-attestation). FCI is broader than people assume: any information not intended for public release that is provided by or generated for the government under a contract qualifies, including delivery schedules, statements of work, and routine procurement correspondence. Most DIB subcontractors handle some FCI. Level 1 is significantly less burdensome than Level 2 but still requires annual self-assessment, executive affirmation, and SPRS scoring.

Question 5

Can I self-assess instead of using a C3PAO?

Accepted Answer

Only for Level 1 and certain specific Level 2 contracts identified by the contracting officer. For most Level 2 work involving CUI - and effectively all Level 3 work - third-party certification by a Cyber AB-authorized C3PAO is required. Self-attestation by a senior official is still required annually even when a C3PAO certificate is in place. MacTech is not a C3PAO; we get you assessment-ready and partner with C3PAOs for the formal certification step.

Question 6

What is the relationship between CMMC and NIST SP 800-171?

Accepted Answer

CMMC Level 2 IS NIST SP 800-171 Rev 2 - all 110 controls, no more, no less, plus the assessment overlay defined in NIST SP 800-171A. The DoD adopted 800-171 as the substantive control set and CMMC as the assurance mechanism (who assesses, how often, and the consequences of non-compliance). If you have a credible 800-171 SSP and SPRS score, you have the foundation of a CMMC Level 2 program; the gap is usually evidence rigor and assessor-readable documentation.

Question 7

What is a CUI boundary or enclave and why does it matter?

Accepted Answer

A CUI boundary is the defined set of systems, networks, applications, people, and physical spaces where CUI is allowed to exist. A "CUI enclave" is a deliberately isolated boundary - typically a small set of hardened workstations, a controlled storage tier, and a defined transfer path - designed to keep CUI off your general corporate IT. A tight enclave shrinks assessment scope (fewer systems to harden, document, and monitor), reduces ongoing compliance cost by 40–60%, and dramatically simplifies incident response. The contractors who get hurt under CMMC are the ones who treat their whole enterprise as the boundary.

Question 8

How does MacTech help me reach CMMC compliance?

Accepted Answer

Three paths, scaled to your situation. (1) The Turnkey CUI Vault - a fully managed FIPS 140-3 controlled enclave with CMMC compliance posture and evidence provisioning handled for you, ready for C3PAO submittal. (2) The Deployable CUI Vault - the same FIPS 140-3 controlled boundary as an API-first vault you deploy into your existing environment when you only need the boundary, not the managed service. (3) The Compliance Package - a fixed-scope readiness engagement (assessment, SSP, POAM, evidence kit) for contractors who already have infrastructure and need the documentation and operational practices to pass a C3PAO. We also build training programs and partner with C3PAOs for the certification step itself.

CUI landed in your contract. Now someone has to draw a line around it.

Where the CUI lives, and the documents that say so

Turnkey CUI Vault

What's included

Deployable CUI Vault

What's in the box

CMMC L2 Policy & Procedure Library

What you receive

TrainOS - training & evidence modules a C3PAO can read directly

Awareness & Role-Based Training

Incident Response Tabletop

Annual Risk Assessment

Continuous Control Assessment

Vulnerability scan + remediation - RA.L2-3.11.2 + RA.L2-3.11.3 (7 statements)

The integrity primitives behind every artifact

CMMC at the core. Every framework within reach.

Practitioner guides - go deeper on the parts of CMMC that matter most

CMMC Level 2 compliance

CUI enclave architecture

CMMC 2.0 self-attestation

NIST 800-171 compliance

Incident response tabletops

Supply-chain cyber compliance

Which level, what is in scope, who may touch it: find out what you can answer today.

The program, as it keeps changing