Handle CUI? Here's how to become CMMC certified — the whole path, and where you stand.

What is CMMC, and why now?

CMMC — Cybersecurity Maturity Model Certification — is how the Department of Defense makes sure its contractors actually protect the sensitive information they handle. If your company touches Controlled Unclassified Information (CUI) — the contract details, specs, and drawings the government marks as sensitive-but-unclassified — the DoD now wants independent proof you're securing it.

The rule that puts CMMC into contracts took effect November 10, 2025 and phases in over three years. As it rolls out, the short version becomes true: no certification, no contract.

The reassuring part: almost nobody is finished. Roughly 99% of the contractors who need it aren't certified yet — most are figuring it out right now, same as you.

Which level do you need?

There are three, and most companies that handle CUI land on Level 2.

• Level 1 — for basic contract info, not CUI. A smaller set of safeguards you assess yourself.
• Level 2 — for CUI. This is the big one: 110 security requirements from NIST SP 800-171, and for most contracts an independent assessment by an authorized third party (a C3PAO). Around 80,000 contractors need it.
• Level 3 — the highest tier, for the most sensitive programs. Adds enhanced requirements on top of Level 2 and is assessed by the government itself.

Not sure which applies? It comes down to one question: does the information in your contracts get marked as CUI? If yes, plan for Level 2.

What does Level 2 actually require?

110 practices, across 14 families. In plain English, they ask you to have control over:

• Who can get in — accounts, least privilege, multi-factor authentication.
• What's watched — audit logs and monitoring, so you know who did what.
• How things are set up — hardened configurations, only the services you need, patching.
• How data is protected — encryption in transit and at rest, secure remote access.
• What you do when something goes wrong — an incident response plan you've actually tested.
• The paperwork behind it — policies, training records, and a written security plan.

None of it is exotic. Most of it is good IT hygiene, written down and proven.

The steps — and why each one exists

1. Scope it. Find exactly where CUI lives and flows. Why: you only have to protect what's in scope — getting this right shrinks the whole job.
2. Score yourself (SPRS). Assess against the 110 and submit a score to the DoD's SPRS system. Why: the DoD requires a current score on file — it's your baseline.
3. Write the SSP and POA&M. A System Security Plan documents how each control is met; a Plan of Action & Milestones lists the gaps and how you'll close them. Why: the assessor examines these first — no security plan, no assessment.
4. Secure the gaps. Actually implement the missing controls — the technical settings and the policies. Why: a plan isn't security; the assessor checks the real system.
5. Get assessed by a C3PAO. An authorized third party evaluates you. Why: for CUI you generally can't just attest to yourself — independent proof is the point.
6. Certify. Pass and you're certified. Score at least 88 of 110 with only certain gaps remaining and you can earn a conditional status — with 180 days to close them. Miss one of the critical controls, though, and there's no shortcut.

How hard is this, honestly?

We won't pretend it's a weekend. The real picture:

• Most people aren't close yet. The median score contractors submit is about 60 out of 110. You need 88 for a conditional pass and 110 to be fully certified.
• Not every control is equal. The critical ones — multi-factor authentication, encryption, patching, boundary firewalls — have no do-over: they must be met outright, with no partial credit and no plan-to-secure-later. Every control counts toward your score; the high-weight ones count absolutely.
• The work splits in two. Most of the 110 are technical — system and configuration settings that can be assessed and secured with the right tooling. The rest are organizational — policies, training, physical measures — finite, but you have to write and do them.
• Assessors are scarce. There are fewer than 100 authorized assessment firms, and lead times run 6 to 18 months. The queue only gets longer as the deadline nears — the real argument for starting now.

The honest summary: it's real, it's finite, and the earlier you see your actual gaps, the smaller the surprise.

Where DenseDefense comes in

This is the part we made easy. Start by seeing exactly where you stand — for free, no sales call.

• Scan free. Run ForteFide against your systems and get your real score across all 110 controls in an afternoon, not a quarter.
• Secure the technical gaps. For the controls that can be remediated, ForteFide does it — and re-checks to prove it's actually secured.
• Walk in with proof. It seals the result into signed, tamper-proof evidence your assessor accepts. Everyone else stops at the paperwork; we secure what's vulnerable.

You don't have to commit to anything to find out where you are. See your starting line, then decide.