BlueKey IT helps defense contractors meet CMMC Level 1 and Level 2 and the NIST SP 800-171 requirements behind them. Our CyberAB Registered Practitioners and Certified CMMC Professionals scope your CUI, calculate your SPRS score, write your SSP, POA&M, and policies, and keep you ready for annual affirmations.
Real reviews from real customers. See why businesses choose BlueKey IT.
Read All ReviewsCMMC effort and cost grow with the size of your boundary. We start by finding exactly where FCI and CUI live in your business, then build the controls, documentation, and evidence around that boundary so your self-assessments and affirmations hold up.
Status as of October 1, 2026: On July 13, 2026, the Department of War announced the suspension of CMMC Phase II, which would have required third-party (C3PAO) assessments in contracts starting November 10, 2026. A September 3 class deviation directs contracting officers to remove third-party CMMC requirements from solicitations and contracts. The CMMC Reform Task Force delivered its recommendations to the Department of War CIO in September, and they have not been published yet. We will update this page when they are.
What has not changed: Phase I is still in effect. Level 1 and Level 2 self-assessments, SPRS scores, and annual affirmations are still required, DFARS 252.204-7012 still requires NIST SP 800-171 for CUI, and inaccurate cybersecurity attestations still carry False Claims Act risk. The suspension changed how compliance is verified, not what is required. For background, read What Is CMMC Certification.
| CMMC Level 1 | CMMC Level 2 | |
|---|---|---|
| Protects | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Requirements | 15 basic safeguarding requirements (FAR 52.204-21) | 110 requirements of NIST SP 800-171 Rev. 2 |
| Assessment today | Annual self-assessment and affirmation | Self-assessment with an SPRS score, plus annual affirmation. Third-party certification is paused under the Phase II suspension. |
| What we deliver | Scoping, controls, policies, and affirmation support | Scoping, gap assessment, SPRS score, SSP, POA&M, policies, remediation, and GRC setup |
We confirm which data you handle, define your CMMC boundary, and run a gap assessment with an SPRS score.
We close gaps with technical controls and write your SSP, POA&M, and policies, organized in a GRC platform.
We keep controls and evidence current, support your annual affirmation, and prepare you for any future assessment.
Support requests for in-scope systems follow our standard help desk response times: 1 business hour for critical issues, 2 hours for high, 4 hours for medium, and 8 hours for low priority requests.
Defense contractors and subcontractors that handle FCI or CUI, including manufacturers, machine shops, engineering firms, and professional services firms in the Defense Industrial Base. Have an in-house IT team? We work alongside them through co-managed IT. Need ongoing security leadership? See our vCISO packages.
We support defense contractors nationwide, with local CMMC services in Arizona, Colorado, Texas, Utah, and Tennessee.
CMMC engagements are scoped to the size of your environment and the level you need. Gap assessments and documentation are quoted as projects, and ongoing compliance can be added to a managed IT or co-managed IT plan.
The Cybersecurity Maturity Model Certification (CMMC) is the Department of War program that verifies defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Level 1 covers FCI with 15 basic safeguarding requirements, and Level 2 covers CUI with the 110 requirements of NIST SP 800-171.
NIST published SP 800-171 Rev. 3 in 2024, but the current CMMC assessment framework remains based on SP 800-171 Rev. 2. The Department of War is expected to incorporate Rev. 3 through future rulemaking. Until that occurs, organizations preparing for CMMC Level 2 should assess against the requirements currently specified by the CMMC program and applicable contract clauses.
Yes. On July 13, 2026, the Department of War announced the suspension of Phase II, which would have required third-party (C3PAO) assessments in contracts. Phase I is still in effect, so Level 1 and Level 2 self-assessments, SPRS scores, and annual affirmations are still required, and DFARS 252.204-7012 still requires NIST SP 800-171 for CUI.
If you only handle Federal Contract Information, you likely need Level 1. If you handle Controlled Unclassified Information, you need Level 2, which is where most defense subcontractors that receive drawings, specifications, or technical data land. Your contract clauses and the data you receive determine the level, and we help you confirm it during scoping.
An SPRS score is the result of a NIST SP 800-171 self-assessment using the DoD Assessment Methodology. The maximum score is 110, with points deducted for each requirement not met, and the score is posted in the Supplier Performance Risk System (SPRS) where contracting officers can see it.
A System Security Plan (SSP) documents how your environment satisfies the applicable security requirements and describes the system boundary and security controls. A Plan of Action and Milestones (POA&M) documents permitted gaps, corrective actions, responsible parties, and target completion dates. POA&Ms are subject to specific CMMC requirements and are not a substitute for meeting requirements that are not eligible for POA&M treatment.
No. Only an authorized CMMC Third-Party Assessment Organization (C3PAO) can perform a certification assessment. Our Registered Practitioners and Certified CMMC Professionals prepare you, and if you pursue a voluntary certification we help coordinate the assessment with a C3PAO.
A governance, risk, and compliance (GRC) platform tracks your controls, policies, evidence, and remediation tasks in one place. It is not required, but it makes self-assessments, annual affirmations, and future assessments much easier. We help you choose and set one up, then keep it current.
Yes. Many defense contractors use BlueKey IT for managed or co-managed IT so the same team that maintains your systems also maintains the controls and evidence CMMC requires.
Map where CUI enters your business, where it is stored, and which systems touch it, then sort your assets into CMMC categories and see whether an enclave could shrink your scope. Get the free BlueKey IT worksheet to start.
Prefer to talk it through? Schedule a discovery call and we will review your contracts, the data you handle, and your current documentation, then give you a clear plan and quote.
Related services: cybersecurity and compliance, vCISO and IT consulting, endpoint security, and managed IT services.
Other compliance frameworks: HIPAA IT compliance, FTC Safeguards Rule compliance, PCI DSS compliance, and SOC 2 readiness, ISO 27001 readiness, and cybersecurity insurance readiness.
Last updated: October 2026
