What is the difference between CMMC Level 1 and Level 2?

CMMC Level 1 requires self-assessment against 17 practices from FAR 52.204-21, focused on protecting Federal Contract Information (FCI). Level 2 requires a third-party assessment by a C3PAO against all 110 practices from NIST SP 800-171, focused on protecting Controlled Unclassified Information (CUI). Most organizations handling CUI need Level 2.

How much does CMMC compliance cost?

Costs depend on your current security maturity, scope of CUI handling, and target level. Level 1 self-assessment readiness typically costs $15,000-$30,000 for implementation consulting. Level 2 readiness runs $40,000-$80,000 depending on the complexity of your CUI environment and existing controls. C3PAO assessment fees are separate and vary by assessor.

Do Canadian companies need CMMC?

Canadian companies in the U.S. defense supply chain that handle CUI need CMMC certification. Canada's own CPCSC program covers Canadian federal procurement separately. If you work with both U.S. DoD and Canadian DND contracts, you may need both CMMC and CPCSC. Our team has experience with both frameworks and can design a program that satisfies both requirements.

How long does it take to get CMMC Level 2 certified?

From kickoff to C3PAO assessment readiness, expect 6-12 months depending on your starting point. Organizations with existing ISO 27001 or SOC 2 programs can accelerate significantly because of control overlap with NIST 800-171. The C3PAO assessment itself typically takes 1-2 weeks, with results delivered within 30 days.

CMMC Compliance Services - Level 1 and Level 2 Readiness

DoD Contracts Now Require CMMC Certification

CMMC 2.0 is no longer a future requirement. The DoD is embedding CMMC clauses into contracts now. If your company handles Controlled Unclassified Information (CUI) and bids on DoD work, certification is the price of continued eligibility.

The challenge isn't whether you need it. It's that NIST SP 800-171 has 110 security requirements across 14 families, and most defense contractors discover significant gaps between what they think they have and what a C3PAO assessor will accept as evidence.

That gap is exactly where we operate.

The Hidden Complexity of CMMC Readiness
CMMC isn't a checklist exercise. It requires demonstrating that 110 NIST SP 800-171 practices are implemented, documented, and operating effectively across your entire CUI environment.

110 Practices, Zero Shortcuts

NIST SP 800-171 covers 14 security families from access control to incident response. Each practice needs implementation evidence, not just a policy statement. Most companies discover 30-50% of practices are either missing or can't be proven to an assessor.

CUI Scoping Complexity

Before implementing controls, you need to know exactly where CUI flows: which systems process it, who accesses it, and how it's protected at rest and in transit. Scoping errors lead to either over-investment in controls that don't matter or gaps that fail the assessment.

C3PAO Assessment Standards

CMMC Level 2 requires a third-party assessment by a C3PAO. These aren't paper reviews. Assessors verify that practices are implemented and operating, not just documented. Companies that treat CMMC as a documentation exercise fail.

Warning: Generic Compliance Consultants Don't Understand Defense Requirements.

Advisors who apply SOC 2 or ISO 27001 templates to CMMC engagements miss what makes defense compliance different: CUI handling, DFARS flow-down requirements, and C3PAO assessment rigor.

The Checkbox Consultant

Applies commercial compliance templates without adapting to NIST SP 800-171 practice-level requirements.
No experience with CUI scoping, DFARS clause interpretation, or enclave design for sensitive workloads.
Produces SSPs and POA&Ms that satisfy an internal review but collapse under C3PAO scrutiny.

The Truvo Partnership

Led by CISSP and GIAC-credentialed engineers with direct experience securing critical infrastructure, including payment systems under federal oversight.
Builds security programs mapped to all 110 NIST SP 800-171 practices, designed for your specific CUI environment and infrastructure.
SSP, POA&M, and evidence packages built to withstand C3PAO assessment, not just pass internal review.

Why Our Effective Security Approach Works for Defense

A certification that doesn't reflect your actual security posture fails the first time a prime contractor or DoD auditor looks closely.

Preserve Contract Eligibility

CMMC certification is required for DoD contracts involving CUI. Getting certified before your competitors means you're bidding while they're still scrambling. Early movers win recompetes.

Cover Both Jurisdictions

Bidding on both US DoD and Canadian DND contracts? CMMC (NIST SP 800-171) and CPCSC (ITSP 10.171) share significant control overlap. We design your security program to satisfy both from a single effort.

Build Once, Extend to Other Frameworks

A well-designed CMMC program maps naturally to NIST 800-53, ISO 27001, and SOC 2. The security program is the source of truth. Frameworks are lenses you apply to it.

Trusted by Organizations Securing Critical Infrastructure

Ali Aleali

The Security Architect

Oksana Zbyranyk

The GRC & Risk Leader

Enterprise-Grade Experience

Our team has designed and audited security programs for Fortune 500s, major banks, and government agencies.

Developer-Centric

We provide actionable, developer-friendly remediation advice, not just a list of problems.

Business-Focused

We translate technical risk into business impact, helping you prioritize what matters most to your bottom line.

CMMC Level 1 vs Level 2: Which Do You Need?

Your required level depends on the sensitivity of information you handle.

Level 1: Self-Assessment

17 practices from FAR 52.204-21. Annual self-assessment, affirmed by a senior official. Required for contracts involving Federal Contract Information (FCI) only. Lower bar, but the self-assessment must be defensible.

Level 2: C3PAO Assessment

All 110 NIST SP 800-171 practices. Third-party assessment by a CMMC Third-Party Assessment Organization (C3PAO). Required for contracts involving Controlled Unclassified Information (CUI). This is where most defense contractors land.

Not Sure Which Level?

Your CMMC level is specified in individual contract solicitations. If you handle CUI in any form, plan for Level 2. Our free assessment maps your current environment to both levels so you know exactly where you stand.

Ready to Build and implement an Effective Security Program?

Free assessment for your defense supply chain organization against CMMC requirements.

Free CMMC Assessment

From the Blog: CMMC and Defense Compliance

Readiness guides for defense contractors navigating CMMC, NIST 800-171, and dual-jurisdiction requirements.

Flat 2D vector illustration of two official badges labeled

CMMC Compliance: Level 1 & Level 2 Readiness

DoD Contracts Now Require CMMC Certification