What Is CMMC 2.0?
CMMC 2.0 is the Department of Defense's program to verify that companies in the defense supply chain actually protect the sensitive government information they handle.
In short
For years those requirements lived in contracts as self-attested NIST 800-171 obligations — CMMC adds independent verification so "we're compliant" can no longer just be a checkbox.
CMMC 2.0 · Levels, data and assessments
From a ticked box to checked proof
Six cards on how CMMC 2.0 works: what it changes, which information sets your level, how it flows down to suppliers, and who does the checking. Tap a lens to dive in, use the arrows, or let it play.
The idea · From promise to proof
Same rules as before. Now you have to prove it.
For years, DoD contracts told you to protect sensitive information under NIST SP 800-171, and you told the DoD you did. CMMC 2.0 keeps those requirements and adds verification: evidence, checked at the level your contract sets. Flip the toggle and watch the claim change.
What LayerLogix does
- Read your contracts and explain what they actually require
- Compare how you work today with the level you need
- Prep you for the assessment your contract names
Step 1 · The information you handle
Your level starts with the information you touch
CMMC cares about two kinds of government information. Federal Contract Information (FCI) is non-public contract detail, like a delivery schedule. Controlled Unclassified Information (CUI) is more sensitive, like a drawing marked CUI. Company size doesn't set your level. The data does.
What LayerLogix does
- Find where FCI and CUI enter your business and where they land
- Draw a tight boundary around the systems that hold CUI
- Confirm which data types each contract actually involves
Step 2 · Level 1, Level 2, Level 3
Three levels, each one built on the level below
Level 1 (Foundational) is basic safeguarding for FCI: 15 practices. Level 2 (Advanced) lines up with the 110 controls in NIST SP 800-171 and kicks in when you handle CUI. Level 3 (Expert) layers selected NIST SP 800-172 controls on top for the most sensitive programs.
What LayerLogix does
- Tell you which level each contract calls for, and why
- Map the controls you already run to that level's requirements
- Put the highest-weighted controls at the front of the plan
Step 3 · Who's in scope
It flows down to subcontractors and their suppliers
CMMC isn't only for primes. When a prime shares CUI with a subcontractor, the obligation travels with it, and the same goes for anyone you pass it to. Plenty of Texas machine shops and engineering firms are in scope through a subcontract and haven't noticed yet.
What LayerLogix does
- Review your subcontracts for DFARS flow-down language
- Track what you pass down to your own suppliers
- Limit CUI sharing to the vendors who truly need it
Step 4 · The assessment paths
Three ways to be assessed, and your contract picks
Level 1 is a yearly self-assessment that a senior official affirms. Most Level 2 contracts send your evidence to an independent, authorized C3PAO, which checks all 110 controls, though a limited set allow self-assessment. Level 3 is assessed by the government. Pick a contract.
What LayerLogix does
- Confirm the assessment type before anyone self-attests
- Run a mock assessment and fix what it turns up
- Organize evidence so an assessor can follow it
Step 5 · The three-year cycle
Passing is the start. Then it's every year.
Certification lasts three years, with an affirmation every year in between, and any POA&M items carry a firm deadline to close. That only holds up if the controls keep running: MFA on, logs reviewed, access trimmed, training recorded. Let them drift and you're affirming what you can't prove.
What LayerLogix does
- Run the controls day to day so the evidence stays fresh
- Close POA&M items before their deadlines
- Pull together the proof behind each annual affirmation
Showing The idea · From promise to proof: Same rules as before. Now you have to prove it.
What We Offer
Comprehensive solutions tailored for Houston-area businesses
The Plain-Language Definition
CMMC 2.0 (Cybersecurity Maturity Model Certification) is the Department of Defense program that requires companies in the defense supply chain to prove they protect sensitive government information. If you handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on DoD contracts, you have to demonstrate a defined level of cybersecurity maturity — and increasingly that proof has to be verified by an independent assessor, not just self-claimed. CMMC turns the cybersecurity requirements that were already in your contracts into something the DoD can actually verify.
The Three Certification Levels
Level 1 (Foundational) covers basic safeguarding of FCI with 15 practices and allows annual self-assessment. Level 2 (Advanced) aligns to the 110 controls of NIST SP 800-171 and is required for handling CUI — most Level 2 contracts require a third-party assessment. Level 3 (Expert) adds a subset of NIST 800-172 enhanced controls for the most sensitive programs and is assessed by the government. Your required level is set by the contract.
How CMMC Maps to NIST 800-171
CMMC Level 2 is essentially NIST SP 800-171 with teeth. The 110 controls are the same security requirements defense contractors have technically been obligated to meet since DFARS 252.204-7012 took effect — CMMC adds independent verification so contractors can no longer just check a box and move on. If you have already done real NIST 800-171 work, you are most of the way to CMMC Level 2.
The C3PAO Assessment
For most Level 2 contracts, certification requires an assessment by a CMMC Third-Party Assessment Organization (C3PAO) — an authorized, independent firm that reviews your evidence against all 110 controls. You must reach a passing score with no critical gaps. Certification is valid for three years with annual affirmations, so this is an ongoing program, not a one-time audit.
SPRS Score and POA&Ms
Defense contractors must post a self-assessment score to the Supplier Performance Risk System (SPRS) based on the 110 NIST 800-171 controls. A Plan of Action and Milestones (POA&M) documents how you will close any remaining gaps. Under CMMC 2.0, limited POA&Ms are allowed for certain controls with a firm closeout deadline — but the highest-weighted controls must be fully met to certify.
Who Actually Needs CMMC
Any organization in the Defense Industrial Base that handles FCI or CUI — prime contractors and, critically, the subcontractors and suppliers beneath them. Many Texas manufacturers, engineering firms, machine shops, and IT providers near military installations and the aerospace corridor are in scope without realizing it. If "flow-down" CUI requirements appear in your contract, CMMC applies to you.
Why Choose LayerLogix?
Serving businesses throughout the Greater Houston area including Houston, The Woodlands, Fort Worth, Dallas, Austin, San Antonio, Clear Lake, College Station.
Protects and Wins DoD Contract Revenue
CMMC is becoming a go/no-go gate in DoD solicitations. Contractors who can demonstrate certification keep their existing work and become eligible for awards that uncertified competitors are locked out of. For Texas firms in the aerospace and defense corridor, CMMC readiness is directly tied to staying in the supply chain.
One Program Satisfies Multiple Frameworks
Because CMMC Level 2 is built on NIST 800-171, the work you do to certify also strengthens you against FTC Safeguards, CIS controls, and general cyber-insurance requirements. The access control, monitoring, and least-privilege controls overlap heavily with every other framework, so you are not building a one-off.
Avoids False Claims Act Exposure
Posting an inflated SPRS score or affirming compliance you cannot back up is a growing source of False Claims Act enforcement. A real, evidence-backed CMMC program protects the company and its officers from the legal and financial risk of misrepresenting your security posture to the government.
Reduces Real Breach Risk in a Targeted Sector
The defense supply chain is a priority target for nation-state and ransomware actors precisely because smaller suppliers are seen as the weak link. The controls CMMC requires — MFA, least privilege, application control, logging, incident response — are exactly the controls that stop those attacks, so certification reduces genuine risk, not just paperwork risk.
Turns a Scramble Into a Predictable Plan
Companies that wait until CMMC language appears in a contract end up paying rush premiums and risk missing bid deadlines. Starting early turns a panicked scramble into a budgeted, phased program — gap assessment, remediation, evidence collection, then certification — on your timeline instead of the contracting officer's.
Our Process
Frequently Asked Questions
What is the difference between CMMC and NIST 800-171?▼
Which CMMC level do I need?▼
Can I self-assess, or do I need a C3PAO?▼
How long does CMMC certification take and what does it cost?▼
My company is a subcontractor. Does CMMC apply to me?▼
How does PAM help with CMMC compliance?▼
Do you provide What Is CMMC 2.0? in Houston and nearby areas?▼
What does What Is CMMC 2.0? cost for a Houston business?▼
More Plain-English Explainers
- Business Email Compromise (BEC)
- Data Security Posture Management (DSPM)
- Extended Detection and Response (XDR)
- FTC Safeguards Rule
- Identity Threat Detection and Response (ITDR)
- IT Consultant
- Managed Detection and Response (MDR)
- Privileged Access Management (PAM)
- Ransomware-as-a-Service (RaaS)
- RPO vs RTO
- Secure Access Service Edge (SASE)
- Zero Trust Security
Ready to Get Started?
Contact LayerLogix today for a free consultation. We serve businesses throughout Houston, The Woodlands, Fort Worth, and the surrounding Greater Houston area.