What Texas Defense Suppliers Actually Need to Do (Without Spending $500K)

CMMC 2.0 Self-Assessment Guide

CMMC 2.0 is now a contract-eligibility requirement for the DoD supply chain — and Texas hosts a substantial portion of the Defense Industrial Base across Fort Worth (Lockheed Martin F-35 line, Bell, Triumph), San Antonio (Joint Base San Antonio), Bay Area Houston (NASA Johnson Space Center contractor community), and the broader DIB. Most CMMC content on the internet is from boutique consultancies quoting $500K engagements. This guide is from a managed IT provider that delivers CMMC-aligned managed services as a normal part of operations. We cover the three CMMC levels, what level you actually need, the 14 domains of NIST 800-171, the role of Privileged Access Management (PAM) as the highest-leverage technical control, the SSP and POA&M documentation that matters most, the assessment process, and the realistic cost and timeline for a typical Texas defense subcontractor reaching Level 2.

Start CMMC Readiness 888.792.8080

SOC 2 Compliant

24/7 Support

30+ Years Experience

What We Offer

Comprehensive solutions tailored for Houston-area businesses

CMMC Level 1 (Basic)

Required for any DoD contract that involves Federal Contract Information (FCI). 17 controls drawn from NIST 800-171, focused on basic safeguarding (access control, identification and authentication, media protection, physical protection, system communication protection, system and information integrity). Annual self-assessment with executive certification. Most defense suppliers handling only FCI fall here.

CMMC Level 2 (Advanced)

Required for any DoD contract that involves Controlled Unclassified Information (CUI). All 110 NIST 800-171 controls. Triennial third-party assessment by a CMMC-accredited C3PAO (or annual self-assessment for non-prioritized acquisitions). This is where most Texas defense subcontractors land — Lockheed/Bell/Triumph supply chain, NASA contractors, and the broader DIB (Defense Industrial Base).

CMMC Level 3 (Expert)

Required for the most sensitive DoD contracts handling CUI critical to national security. Subset of NIST 800-172 enhancements added on top of Level 2 controls. Triennial DIBCAC-led assessment. Few Texas defense suppliers fall here; if you do, you already know it.

PAM as Foundational Control

Privileged Access Management (PAM) — application allowlisting and ringfencing — satisfies more NIST 800-171 controls per dollar than any other technical investment: 3.1.5 (least privilege), 3.1.7 (non-privileged accounts cannot execute privileged functions), 3.4.6 (least functionality), 3.4.8 (application execution policy), and 3.13.4 (information flow control). One PAM deployment satisfies five distinct control practices and dramatically reduces ransomware risk to CUI-handling endpoints.

The 14 Domains of NIST 800-171

Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, System and Information Integrity. The 110 Level 2 controls map across these 14 domains. Most gap-analysis findings cluster in Configuration Management, Identification and Authentication (MFA), and System and Communications Protection (FIPS-validated encryption).

The SSP and POA&M

Two documentation artifacts are mandatory: System Security Plan (SSP) describing how each of the 110 controls is implemented in your environment, and Plan of Action and Milestones (POA&M) tracking any controls not yet fully implemented with target dates. The SSP is the single most important CMMC artifact — it is what assessors read before they ever touch your environment. A well-authored SSP can shorten assessment from weeks to days.

Why Choose LayerLogix?

Serving businesses throughout the Greater Houston area including Houston, Fort Worth, Arlington, Dallas, San Antonio, Clear Lake, Sugar Land, College Station, El Paso, Austin.

Keep DoD Contracts

CMMC enforcement is now contract-by-contract. DFARS 252.204-7021 requires CMMC certification for new awards. If you cannot meet your required level when a contract comes up, you do not win it. The math on getting compliant is much better than the math on losing the contract.

Avoid the $500K Consultant Bill

Boutique CMMC consultancies routinely quote $200K-$500K+ for a Level 2 readiness engagement. Most defense suppliers do not need that. A managed IT provider with PAM, MFA, FIPS-validated encryption, and compliance program leadership built into the service baseline can deliver Level 2 readiness for a fraction of that cost — typically $25K-$75K initial readiness plus ongoing managed compliance.

Defensible DIBCAC Assessment

When the DIBCAC assessment cycle starts, the work you did in advance shows up. A well-authored SSP, validated control implementations, documented evidence retention, and a managed compliance program produce a clean assessment. Improvising during assessment produces findings.

Cyber Insurance Premium Reduction

CMMC-aligned environments routinely qualify for better cyber insurance pricing because the underlying controls (PAM, MFA, FIPS encryption, monitoring, IR capability) are exactly what underwriters now require for any insurable account.

A Path to ITAR and Beyond

CMMC controls overlap heavily with ITAR cybersecurity requirements, NIST 800-172 enhanced controls, and the broader federal cybersecurity baseline. Building your CMMC program well positions you for adjacent federal compliance work.

Our Process

Determine required level — Level 1 (FCI only), Level 2 (CUI), or Level 3 (CUI critical to national security). Read your DoD contracts; the required level is specified.

Inventory CUI/FCI flows — where does CUI enter your environment? Where is it stored? Where is it processed? Where does it leave? You cannot protect what you have not mapped.

Initial gap assessment — formal assessment against the 17 (Level 1) or 110 (Level 2) NIST 800-171 controls. Most defense suppliers find 30-60 gaps on first pass.

Author SSP — write the System Security Plan describing your environment and how each control is implemented. This is the highest-leverage artifact in CMMC.

Author POA&M — Plan of Action and Milestones tracking any not-yet-implemented controls with target completion dates.

Deploy foundational technical controls — Privileged Access Management (PAM) for least privilege and execution control, MFA on all CUI-touching accounts, FIPS-validated encryption for CUI at rest and in transit, audit logging for all privileged access.

Deploy procedural controls — incident response plan, configuration management process, physical access controls, personnel security procedures, security awareness training program.

Internal validation — control-by-control validation against your SSP, evidence collection, gap closure for any remaining items.

Pre-assessment with C3PAO — engage a C3PAO for a pre-assessment review before the formal assessment cycle. Their findings give you time to remediate.

Formal Level 2 assessment — formal C3PAO assessment for triennial certification. Annual maintenance and reassessment cycle thereafter.

Frequently Asked Questions

What level of CMMC do I actually need?▼

Read your DoD contracts and the DFARS clauses they cite. If your contracts only involve Federal Contract Information (FCI) — basic information like contract terms and shipping data — you need Level 1 (annual self-assessment). If your contracts involve Controlled Unclassified Information (CUI) — engineering data, drawings, technical specifications, ITAR-controlled material, etc. — you need Level 2 (triennial third-party assessment by a C3PAO, or annual self-assessment for non-prioritized acquisitions). Most Texas defense subcontractors land at Level 2.

How long does CMMC Level 2 readiness take?▼

For a typical Texas defense subcontractor with no prior compliance work, plan on 6-12 months from kickoff to Level 2 readiness. Companies with existing security programs (deployed PAM, MFA, encryption already in place) can move faster. The SSP and POA&M authoring is often the longest single phase — most defense suppliers underestimate how much documentation work is involved.

How much does CMMC Level 2 readiness cost?▼

Boutique CMMC consultancies quote $200K-$500K+. Managed IT providers with PAM, MFA, FIPS encryption, and compliance program leadership in the baseline can deliver Level 2 readiness for $25K-$75K initial plus $1,500-$5,000 per month for ongoing managed compliance — with the technical controls already deployed as part of managed services. The C3PAO assessment itself adds $40K-$120K depending on environment size.

Can my MSP deliver CMMC compliance?▼

Some MSPs can; most cannot. CMMC-capable MSPs deploy PAM, MFA, and FIPS-validated encryption as standard managed services baseline; have demonstrable defense supply chain client experience; can author SSPs and POA&Ms; and operate ongoing compliance programs. Generic MSPs cannot. Ask any MSP about their actual CMMC project portfolio before assuming they can support your work.

What is a Registered Practitioner Organization (RPO)?▼

An RPO is an organization registered with the CMMC Accreditation Body (now Cyber-AB) to deliver consulting and implementation services for CMMC. RPOs cannot perform formal CMMC assessments — that is what C3PAOs do. RPOs prepare you; C3PAOs certify you. An MSP can be an RPO without being a C3PAO; in fact, the same firm cannot do both for the same client (conflict of interest).

How does Privileged Access Management (PAM) help with CMMC?▼

PAM is the highest-leverage technical control across NIST 800-171. A single PAM deployment satisfies 3.1.5 (least privilege), 3.1.7 (non-privileged accounts cannot execute privileged functions), 3.4.6 (least functionality), 3.4.8 (application execution policy), and 3.13.4 (information flow control) — five distinct controls in one deployment. PAM also dramatically reduces ransomware risk to CUI-handling endpoints, gives DIBCAC assessors clean answers about least privilege and execution control, and produces audit evidence that satisfies multiple control assessments simultaneously.

Ready to Get Started?

Contact LayerLogix today for a free consultation. We serve businesses throughout Houston, Fort Worth, Arlington, and the surrounding Greater Houston area.

Schedule Free Consultation Call 888.792.8080