Question 1

What is CMMC and why does it exist?

Accepted Answer

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense framework that verifies a defense contractor's cybersecurity hygiene before they handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). It exists because self-attestation under DFARS 252.204-7012 produced inconsistent compliance across the Defense Industrial Base, and adversary exfiltration of CUI from sub-tier contractors became a national-security concern. CMMC 2.0 collapses the earlier 5-level model to 3 levels (L1 FCI, L2 CUI, L3 high-confidentiality CUI) and ties certification to specific contract requirements.

Question 2

What is the difference between CMMC Level 1, Level 2, and Level 3?

Accepted Answer

Level 1 covers FCI only - 17 basic safeguarding practices, self-assessed annually. Level 2 covers CUI - all 110 NIST SP 800-171 Rev 2 controls, third-party assessed every 3 years by a Cyber AB-authorized C3PAO. Level 3 covers high-confidentiality CUI - Level 2 plus a subset of NIST SP 800-172 enhanced controls, government-led assessment. Most prime contractors flow down Level 2 because they treat any technical data above general descriptive material as CUI.

Question 3

When does CMMC become mandatory?

Accepted Answer

CMMC 2.0 entered phased implementation in 2025 under the DoD final rule. Phase 1 (self-assessment) is in effect for solicitations using DFARS clause 252.204-7021. Phase 2 (C3PAO certification for Level 2) began rolling into new contract awards in 2026 and continues through 2028. If your contract or any flowdown references DFARS 252.204-7012 or 252.204-7021, you are already inside the compliance window - the only question is whether your certification timeline matches the contract's anticipated award date.

Question 4

Do I need CMMC if I only handle FCI, not CUI?

Accepted Answer

Yes - FCI-only contractors need CMMC Level 1 (self-attestation). FCI is broader than people assume: any information not intended for public release that is provided by or generated for the government under a contract qualifies, including delivery schedules, statements of work, and routine procurement correspondence. Most DIB subcontractors handle some FCI. Level 1 is significantly less burdensome than Level 2 but still requires annual self-assessment, executive affirmation, and SPRS scoring.

Question 5

Can I self-assess instead of using a C3PAO?

Accepted Answer

Only for Level 1 and certain specific Level 2 contracts identified by the contracting officer. For most Level 2 work involving CUI - and effectively all Level 3 work - third-party certification by a Cyber AB-authorized C3PAO is required. Self-attestation by a senior official is still required annually even when a C3PAO certificate is in place. MacTech is not a C3PAO; we get you assessment-ready and partner with C3PAOs for the formal certification step.

Question 6

What is the relationship between CMMC and NIST SP 800-171?

Accepted Answer

CMMC Level 2 IS NIST SP 800-171 Rev 2 - all 110 controls, no more, no less, plus the assessment overlay defined in NIST SP 800-171A. The DoD adopted 800-171 as the substantive control set and CMMC as the assurance mechanism (who assesses, how often, and the consequences of non-compliance). If you have a credible 800-171 SSP and SPRS score, you have the foundation of a CMMC Level 2 program; the gap is usually evidence rigor and assessor-readable documentation.

Question 7

What is a CUI boundary or enclave and why does it matter?

Accepted Answer

A CUI boundary is the defined set of systems, networks, applications, people, and physical spaces where CUI is allowed to exist. A "CUI enclave" is a deliberately isolated boundary - typically a small set of hardened workstations, a controlled storage tier, and a defined transfer path - designed to keep CUI off your general corporate IT. A tight enclave shrinks assessment scope (fewer systems to harden, document, and monitor), reduces ongoing compliance cost by 40–60%, and dramatically simplifies incident response. The contractors who get hurt under CMMC are the ones who treat their whole enterprise as the boundary.

Question 8

How does MacTech help me reach CMMC compliance?

Accepted Answer

Three paths, scaled to your situation. (1) The Turnkey CUI Vault - a fully managed FIPS 140-3 controlled enclave with CMMC compliance posture and evidence provisioning handled for you, ready for C3PAO submittal. (2) The Deployable CUI Vault - the same FIPS 140-3 controlled boundary as an API-first vault you deploy into your existing environment when you only need the boundary, not the managed service. (3) The Compliance Package - a fixed-scope readiness engagement (assessment, SSP, POAM, evidence kit) for contractors who already have infrastructure and need the documentation and operational practices to pass a C3PAO. We also build training programs and partner with C3PAOs for the certification step itself.

CMMC & CUI Compliance - built for mission-critical programs

Why a clear CUI boundary matters

Three paths to CMMC compliance and CUI protection

Turnkey CUI Vault

What's included

Deployable CUI Vault

What's in the box

Full CMMC Documentation Template

What's inside

Optional add-on services

TrainOS - training & evidence modules a C3PAO can read directly

Awareness & Role-Based Training

Incident Response Tabletop

Annual Risk Assessment

Continuous Control Assessment

Vulnerability scan + remediation - RA.L2-3.11.2 + RA.L2-3.11.3 (7 statements)

The integrity primitives behind every artifact

CMMC at the core. Every framework within reach.

How we align with these frameworks

Practitioner guides - go deeper on the parts of CMMC that matter most

CMMC Level 2 compliance

CUI enclave architecture

CMMC 2.0 self-attestation

NIST 800-171 compliance

Incident response tabletops

Supply-chain cyber compliance

Ready to achieve CMMC readiness and a defensible CUI boundary?

What happens when you reach out