For DoW subcontractors handling CUI — Level 2 is our specialty
CMMC Level 2:
Rapid Deployment.
Phase 2 makes a third-party assessment the ticket to CUI contracts. More than 300,000 companies in the defense industrial base fall under CMMC — roughly 80,000 of them need Level 2 certification, and only about 1% have it. Assessment slots are booking 3–6 months out. The contractors who move now keep their contracts — and inherit the work of those who didn't.
November 10, 2026 — C3PAO assessments become mandatory for Level 2 contracts involving CUI.
Why this is urgent
Wait, and you wait in line. Behind everyone.
Phase 1 already put CMMC language into contracts. Phase 2 ends self-attestation for most Level 2 work. Primes are flowing requirements down today and quietly re-ranking their supplier lists by who is assessment-ready.
- !No certification, no award. After November 10, 2026, prioritized CUI solicitations require C3PAO certification — not a promise, not a POA&M full of holes.
- !Capacity crunch is real. Fewer than 100 authorized C3PAOs serve tens of thousands of contractors. Late starters will miss award windows even if they're willing to pay.
- !Your SPRS score is already visible. Primes and contracting officers see it. A weak score costs you work before any deadline hits.
Level check
Which CMMC level do you need?
- L1Level 1 — FCI only. 15 basic safeguarding requirements, annual self-assessment. We'll get it done quickly and correctly — and have you ready for the day your contracts graduate to CUI.
- L2Level 2 — you touch CUI. This is our specialty. All 110 NIST SP 800-171 requirements, and under Phase 2 most contracts demand a third-party C3PAO assessment. The deepest work, the highest stakes — and exactly where we live.
- L3Level 3 — critical programs. Level 2 plus enhanced requirements, assessed by the government (DIBCAC).
Not sure? Your contracts and DFARS 252.204-7012 clauses tell the story — we read them with you on the readiness call, free.
The deployment plan
From "where do we even start?" to assessment-ready
A defensible path, run by, with, and through your team — every step tracked in the Cyber Tackle Box™ so nothing lives in someone's inbox.
Readiness Call & Scoping — free
Thirty minutes. We identify your level, your CUI boundary, your current SPRS posture, and the real size of the job. You leave with a straight answer either way.
Gap Assessment
A control-by-control review against NIST SP 800-171's 110 requirements. You get a scored gap report, a prioritized remediation roadmap, and an honest SPRS score you can stand behind.
Remediation — by, with, and through your team
Policies, procedures, and technical controls implemented with your people so the knowledge stays. Pre-built policy templates and workbooks in the Cyber Tackle Box cut months off document drafting. Where you need specialized muscle — enclaves, MDR, IAM — our vetted partner network deploys with you.
Evidence & System Security Plan
Assessors don't grade intentions; they grade artifacts. We assemble your SSP, POA&M closure evidence, and control artifacts into an assessment-ready package, organized the way assessors expect to see it.
C3PAO Assessment Prep
Mock-assessment walkthroughs run by instructors who teach the official CCA curriculum. We help you schedule with an authorized C3PAO and stand with you through assessment week.
The Lionfish edge
We train the assessors. That changes everything.
Cyber AB Accredited Training Provider
We teach the official CCP and CCA certification courses. Your readiness work is guided by the same body of knowledge your assessor was trained on — no guessing what "good" looks like.
One system of record
The Cyber Tackle Box™ tracks every control, policy, task, and piece of evidence — with your workforce training in the same platform. Your assessor follows a trail, not a shoebox.
Veteran-owned, defense-native
SDVOSB, SAM-registered (CAGE 96LH8), founded by a Green Beret. We speak prime-contractor and contracting-officer fluently — and your supply-chain diversity story improves the day you engage us.
Straight answers
CMMC questions we answer every week
What actually happens on November 10, 2026?
CMMC Phase 2 begins. Third-party assessments by an authorized C3PAO become the standard requirement for Department of War contracts involving CUI. Self-attestation no longer suffices for most Level 2 work — without certification you risk ineligibility for new awards, re-competes, and option exercises.
How long does Level 2 certification really take?
For most small and mid-sized contractors: 1–3 months of gap assessment and planning, 3–6 months of remediation and evidence building, then a 3–6 month wait for a C3PAO slot. Call it 6–12 months end to end. Started today, that lands uncomfortably close to the deadline — which is exactly the point.
Do I need Level 1 or Level 2?
Handle only Federal Contract Information? Level 1 — 15 basic safeguarding requirements, annual self-assessment. Store, process, or transmit CUI? Level 2 — all 110 requirements of NIST SP 800-171, with a C3PAO assessment for most contracts under Phase 2. Your DFARS clauses (especially 252.204-7012) are the tell; we review them with you free. Level 2 is our core specialty — it's where the real work (and the real risk to your contracts) lives.
What does this cost?
It depends on your posture, environment, and CUI footprint — anyone quoting a flat number before a gap assessment is guessing. What we can promise: a scoped, phased budget after the readiness call, remediation choices ranked by cost-effectiveness, and protection from the most expensive outcome in CMMC — failing the assessment and paying for it twice.
Can't I just wait and see if my contracts require it?
Primes aren't waiting. They are flowing requirements down now and choosing which subs to sponsor into next-generation work based on today's readiness. Waiting converts a manageable 2026 project into a 2027 emergency with no assessment slots left to buy.
Get in touch
Start your Level 2 Rapid Deployment
Tell us about your contracts and your deadline. A readiness call comes back to you within one business day.
- 1We reply within one business day — usually faster.
- 2A 30-minute call with someone who can actually answer your questions.
- 3A straight recommendation — even if it's that you don't need us yet.
Prefer to skip the form? Book a time directly or call 1-877-732-6772.