CMMC 2.0 Compliance
Cybersecurity Maturity Model Certification — What Every DOD Contractor Must Now Demonstrate
lbttechgroup.com · +1 (916) 333-1062 · Sacramento, California · Veteran-Owned
WHAT IS CMMC?
CMMC 2.0 is in effect. Without certification, your federal contracts are at risk.
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the U.S. Department of Defense’s framework for verifying that defense contractors and subcontractors have implemented appropriate cybersecurity practices to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). CMMC 2.0 is now embedded in DOD contracts and flowing down through the supply chain — meaning subcontractors and suppliers at every tier face the same certification requirements as prime contractors.
Unlike earlier versions, CMMC 2.0 requires third-party certification (for Level 2 and above), not just self-attestation. Organizations that cannot demonstrate certification at the required level will be ineligible to bid on, perform, or renew covered DOD contracts.
3
CMMC maturity levels
110
NIST 800-171 practices at Level 2
2025
CMMC requirements in active contracts
C3PAO
required for Level 2 third-party audit
THE THREE CMMC LEVELS
Which level applies to your contracts.
Level
Requirements & Assessment
Level 1 — Foundational
17 practices from NIST SP 800-171. Annual self-assessment with senior official affirmation. Applies to organizations handling FCI only.
Level 2 — ADVANCED
110 practices from NIST SP 800-171. Triennial third-party assessment by a CMMC Third-Party Assessment Organization (C3PAO) for critical national security programs; annual self-assessment for non-critical. Applies to organizations handling CUI.
Level 3 — Expert
110+ practices from NIST SP 800-171 plus additional requirements from NIST SP 800-172. Government-led assessment. Applies to organizations on the highest-priority DOD programs.
The majority of Sacramento-area government contractors and subcontractors handling CUI will require Level 2 certification — the most impactful and resource-intensive tier for small businesses to achieve.
THE 14 NIST 800-171 PRACTICE DOMAINS (LEVEL 2)
What Level 2 certification requires you to demonstrate.
Domain
Focus
Access Control (AC)
Limit system access to authorized users and processes
Awareness & Training (AT)
Ensure personnel are aware of security risks and trained to fulfill responsibilities
Audit & Accountability (AU)
Create, protect, and retain audit logs to enable monitoring and investigation
Configuration Management (CM)
Establish baseline configurations and inventory of information systems
Identification & Authentication (IA)
Identify users, processes, and devices; authenticate before granting access
Incident Response (IR)
Establish operational incident-handling capability — detection, analysis, containment, recovery
Maintenance (MA)
Perform maintenance on systems; control maintenance tools and remote access
Media Protection (MP)
Protect system media containing CUI; sanitize or destroy before disposal
Personnel Security (PS)
Screen personnel; ensure CUI protection during and after employment
Physical Protection (PE)
Limit physical access to systems and the CUI they store or transmit
Risk Assessment (RA)
Assess risk to systems and data; scan for vulnerabilities periodically
Security Assessment (CA)
Assess security controls; develop and implement action plans to correct deficiencies
System & Communications Protection (SC)
Monitor, control, and protect organizational communications at external boundaries
System & Information Integrity (SI)
Identify, report, and correct information system flaws; protect from malicious code
COMMON CMMC READINESS GAPS
Where contractors most often fall short before a C3PAO audit.
⚠ No System Security Plan (SSP) — required documentation of how each of the 110 practices is implemented in your environment
⚠ No Plan of Action & Milestones (POA&M) — required tracking of all identified gaps and remediation timelines
⚠ Missing MFA — multi-factor authentication is required for all access to CUI systems under AC.3.012
⚠ Inadequate audit logging — many contractors lack the log retention depth and coverage that AU domain requirements demand
⚠ Unmanaged CUI data flows — CUI stored in personal email, consumer cloud services, or non-authorized systems
⚠ No incident response capability — IR.2.092 requires an operational incident response plan, not just documentation
⚠ Vendor/subcontractor risk — CMMC flows down through the supply chain; prime contractors must verify subcontractor compliance
HOW LBT DELIVERS CMMC READINESS
Structured readiness support from gap to C3PAO-ready.
LBT Technology Group provides CMMC 2.0 readiness consulting as a structured engagement, preparing government contractors for C3PAO third-party assessment at Level 2 — with documentation, technical implementation, and evidence collection designed to satisfy auditor requirements.
✓ CMMC Readiness Gap Assessment
A formal evaluation of your current environment against all 110 NIST SP 800-171 practices, producing a gap register with practice-level findings and a prioritized remediation roadmap.
✓ System Security Plan (SSP) Development
Documentation of how each required practice is implemented in your specific environment — the foundational document required for both self-assessment and C3PAO audit.
✓ Plan of Action & Milestones (POA&M)
A tracked remediation plan documenting all identified gaps, responsible parties, and completion timelines — required for CMMC and regularly reviewed by the DOD through SPRS score submissions.
✓ Technical Control Implementation
Implementation of the technical controls required across the AC, AU, IA, SC, and SI domains — including MFA, endpoint monitoring, log management, and network boundary protection.
✓ CUI Data Flow Mapping & Boundary Definition
Map where CUI enters, traverses, and exits your environment — defining the assessment boundary and implementing controls to protect CUI wherever it lives.
✓ SPRS Score Submission Support
Assistance with Supplier Performance Risk System (SPRS) score calculation and submission — required for all DOD contractors before contract award.
Is Your Business CMMC Ready?
Schedule a complimentary scoping consultation. LBT will assess your current compliance posture, identify gaps, and show you exactly what it takes to close them — at no cost and no obligation.
BOOK YOUR FREE CMMC ASSESSMENT →
+1 (916) 333-1062 · lbttechgroup.com · Sacramento, California
© 2026 LBT Technology Group, LLC · CMMC 2.0 Compliance Services · Sacramento, CA · Confidential