CMMC 2.0 Self-Assessment Guide
CMMC 2.0 is now a contract-eligibility requirement for the DoD supply chain — and Texas hosts a substantial portion of the Defense Industrial Base across Fort Worth (Lockheed Martin F-35 line, Bell, Triumph), San Antonio (Joint Base San Antonio), Bay Area Houston (NASA Johnson Space Center contractor community), and the broader DIB.
In short
Most CMMC content on the internet is from boutique consultancies quoting $500K engagements.
CMMC self-assessment · Step by step
From a hunch to an answer you can sign
Six cards that walk the self-assessment in order: scope the data, check each requirement, write it down, score it, then plan the gaps. Tap a lens to dive in, use the arrows, or let it play.
The idea · Five steps under one signature
A signature is only as solid as what's under it
A CMMC self-assessment ends with a senior person at your company putting their name on the result. Signed on a hunch, it's a guess with a name on it. Signed on the work, it stands on five steps: scope, evaluate, document, score and plan. Flip the toggle and watch the piles go in.
What LayerLogix does
- Take you through scope, evaluation, SSP, score and gap plan
- Do the legwork with you, requirement by requirement
- Leave you records a senior official can sign against
Step 1 · Scope the data
Your level comes from the data, not the org chart
Start with the contract, because it names the level. Then follow the information: where it enters, where it's stored, where it's worked on and where it leaves. A delivery schedule is FCI and points to Level 1. A drawing marked CUI points to Level 2. What it doesn't touch stays outside the line.
What LayerLogix does
- Read the DFARS clauses in your contracts and name the level
- Map where FCI and CUI enter, live, get worked on and leave
- Draw the scope line so the assessment covers the right systems
Step 2 · Evaluate each requirement
Check each requirement three ways before calling it met
A requirement isn't met because a policy says so. Read the document, ask the person who does the work, then test the system itself. When all three line up, it's met. When one doesn't, like an admin login on a shop-floor PC that skips MFA, it goes on the gap list.
What LayerLogix does
- Walk each requirement with your team, not just the policy binder
- Test the settings on the real machines and accounts in scope
- Record every finding as met or not met, with the reason
Step 3 · The System Security Plan
Write the SSP so the assessor doesn't have to ask
The System Security Plan is what an assessor reads before touching anything. A line like "We use MFA" just starts a round of questions. Name the owner, the accounts in scope, how it's enforced and where the proof lives, and the questions answer themselves. Toggle it to compare.
What LayerLogix does
- Write SSP entries in plain language, one requirement at a time
- Point each entry to the setting, log or record behind it
- Keep the SSP current as your systems change
Step 4 · Score, affirm and submit
Score it straight, sign it, post it
For Level 2, the DoD scoring method starts at 110, the number of NIST SP 800-171 requirements. Each requirement not met takes off 1, 3 or 5 points, depending on its weight. A senior official affirms the result, and the score is posted to SPRS, the DoD's supplier risk system.
What LayerLogix does
- Calculate the score from the findings, with no rounding up
- Prepare the affirmation package for your senior official's review
- Organize the records that back up the score you post
Step 5 · Plan of Action and Milestones
Plan the gaps so one fix closes several
Every requirement still open goes on the POA&M with a target date, and the order matters. Work gap by gap and the plan sprawls. Put Privileged Access Management first and one rollout addresses least privilege, execution control and three more requirements. Then MFA, logging and visitor escort.
What LayerLogix does
- Write the POA&M with owners, milestones and realistic dates
- Deploy PAM, MFA, FIPS-validated encryption and audit logging
- Re-check each closed item, then update the SSP and the score
Showing The idea · Five steps under one signature: A signature is only as solid as what's under it
What We Offer
Comprehensive solutions tailored for Houston-area businesses
CMMC Level 1 (Basic)
Required for any DoD contract that involves Federal Contract Information (FCI). 17 controls drawn from NIST 800-171, focused on basic safeguarding (access control, identification and authentication, media protection, physical protection, system communication protection, system and information integrity). Annual self-assessment with executive certification. Most defense suppliers handling only FCI fall here.
CMMC Level 2 (Advanced)
Required for any DoD contract that involves Controlled Unclassified Information (CUI). All 110 NIST 800-171 controls. Triennial third-party assessment by a CMMC-accredited C3PAO (or annual self-assessment for non-prioritized acquisitions). This is where most Texas defense subcontractors land — Lockheed/Bell/Triumph supply chain, NASA contractors, and the broader DIB (Defense Industrial Base).
CMMC Level 3 (Expert)
Required for the most sensitive DoD contracts handling CUI critical to national security. Subset of NIST 800-172 enhancements added on top of Level 2 controls. Triennial DIBCAC-led assessment. Few Texas defense suppliers fall here; if you do, you already know it.
PAM as Foundational Control
Privileged Access Management (PAM) — application allowlisting and ringfencing — satisfies more NIST 800-171 controls per dollar than any other technical investment: 3.1.5 (least privilege), 3.1.7 (non-privileged accounts cannot execute privileged functions), 3.4.6 (least functionality), 3.4.8 (application execution policy), and 3.13.4 (information flow control). One PAM deployment satisfies five distinct control practices and dramatically reduces ransomware risk to CUI-handling endpoints.
The 14 Domains of NIST 800-171
Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, System and Information Integrity. The 110 Level 2 controls map across these 14 domains. Most gap-analysis findings cluster in Configuration Management, Identification and Authentication (MFA), and System and Communications Protection (FIPS-validated encryption).
The SSP and POA&M
Two documentation artifacts are mandatory: System Security Plan (SSP) describing how each of the 110 controls is implemented in your environment, and Plan of Action and Milestones (POA&M) tracking any controls not yet fully implemented with target dates. The SSP is the single most important CMMC artifact — it is what assessors read before they ever touch your environment. A well-authored SSP can shorten assessment from weeks to days.
Why Choose LayerLogix?
Serving businesses throughout the Greater Houston area including Houston, Fort Worth, Arlington, Dallas, San Antonio, Clear Lake, Sugar Land, College Station, El Paso, Austin.
Keep DoD Contracts
CMMC enforcement is now contract-by-contract. DFARS 252.204-7021 requires CMMC certification for new awards. If you cannot meet your required level when a contract comes up, you do not win it. The math on getting compliant is much better than the math on losing the contract.
Avoid the $500K Consultant Bill
Boutique CMMC consultancies routinely quote $200K-$500K+ for a Level 2 readiness engagement. Most defense suppliers do not need that. A managed IT provider with PAM, MFA, FIPS-validated encryption, and compliance program leadership built into the service baseline can deliver Level 2 readiness for a fraction of that cost — typically $25K-$75K initial readiness plus ongoing managed compliance.
Defensible DIBCAC Assessment
When the DIBCAC assessment cycle starts, the work you did in advance shows up. A well-authored SSP, validated control implementations, documented evidence retention, and a managed compliance program produce a clean assessment. Improvising during assessment produces findings.
Cyber Insurance Premium Reduction
CMMC-aligned environments routinely qualify for better cyber insurance pricing because the underlying controls (PAM, MFA, FIPS encryption, monitoring, IR capability) are exactly what underwriters now require for any insurable account.
A Path to ITAR and Beyond
CMMC controls overlap heavily with ITAR cybersecurity requirements, NIST 800-172 enhanced controls, and the broader federal cybersecurity baseline. Building your CMMC program well positions you for adjacent federal compliance work.
Our Process
Frequently Asked Questions
What level of CMMC do I actually need?▼
How long does CMMC Level 2 readiness take?▼
How much does CMMC Level 2 readiness cost?▼
Can my MSP deliver CMMC compliance?▼
What is a Registered Practitioner Organization (RPO)?▼
How does Privileged Access Management (PAM) help with CMMC?▼
Do you provide CMMC 2.0 Self in Houston and nearby areas?▼
What does CMMC 2.0 Self cost for a Houston business?▼
Ready to Get Started?
Contact LayerLogix today for a free consultation. We serve businesses throughout Houston, Fort Worth, Arlington, and the surrounding Greater Houston area.