Cyber Grants Alliance
For: Small businesses across the defense industrial base that qualify for a grant.
CMMC Level 2 for the Defense Industrial Base
Keep the contract that requires CMMC.
We take small and mid-sized defense contractors through CMMC Level 2: where you stand today, what is missing, and who does the work to close it. Published prices, plain words.
A gap assessment is how you find out where you actually stand, before the clock matters.
10+ years
in cybersecurity3+ years in CMMC specifically
110 of 110
controls met on our most recent Level 2 engagementIron Lift. As of 2026-09-15, per Iron Lift's self-assessment.
$5,000
CMMC Level 2 gap assessmentOne-time engagement fee. For most small and mid-sized contractors. How that number compares
320
assessment objectives behind the 110 requirementsNIST SP 800-171A, checked one at a time
Sound familiar?
A prime asked for your SPRS score.
You have a number from years ago, and you are not sure it would hold up.
Someone signs the annual affirmation.
It is a statement to the government, and nobody has checked the evidence behind it.
Nobody can say where your CUI lives.
Email, a shared drive, a laptop in the shop office. Maybe all three.
You heard CMMC was paused.
The third-party audit requirement is suspended. Your self-assessment, DFARS 7012 and NIST 800-171 still apply.
Your IT provider says you are compliant.
There is no System Security Plan to prove it.
The policies came from a template.
Nobody at the company has read them, and nobody follows them.
Start here
Which level applies to you?
CMMC has three levels, and you do not choose yours. What you handle decides the level: Federal Contract Information on its own is Level 1, Controlled Unclassified Information is Level 2. Your contract then decides how it is assessed, and the contracting officer writes that into DFARS 252.204-7021. If you cannot tell from your contract which one you have, that is the first thing a 30-minute call answers.
You handle only Federal Contract Information
Level 1
15 basic safeguarding requirements from FAR 52.204-21.
Self-assessed every year, with an annual affirmation.
You handle Controlled Unclassified Information
Level 2
The 110 requirements of NIST SP 800-171 Rev 2.
Self-assessed or certified by a C3PAO, whichever your contract names, every three years, affirmed every year.
You work on the most sensitive programs
Level 3
Level 2 plus enhanced requirements from NIST SP 800-172.
Assessed by the government's own assessors, DIBCAC.
The rule
What does Level 2 actually ask?
Level 2 is the 110 security requirements in NIST SP 800-171 Rev 2, grouped into 14 families. An assessor checks them against 320 objectives, one at a time, and your score goes into SPRS, from 110 down to minus 203. Your Affirming Official then signs that the score is true, at each assessment and every year after.
Most of the work is not buying tools. It is writing down how each requirement is met, proving it with evidence that builds up over weeks, and keeping it true after the assessment. Access Control and System and Communications Protection carry more than a third of the requirements between them. See every term on CMMC Terms.
Read the film's text
- CMMC Level 2 for the Defense Industrial Base
- Keep the contract that requires CMMC.
- 110 security requirements. NIST SP 800-171 Rev 2.
- 14 families: AC 22, AT 3, AU 9, CM 9, IA 11, IR 3, MA 6, MP 9, PS 2, PE 6, RA 3, CA 4, SC 16, SI 7.
- 320 assessment objectives. NIST SP 800-171A. Each one is assessed.
- Where you stand today. What is missing. Who does the work to close it.
- Capital Cyber Compliance. CMMC Level 2 for the Defense Industrial Base. Self-assessment · 110 controls · NIST SP 800-171.
- ACAccess Control22
- SCSystem & Communications Protection16
- IAIdentification & Authentication11
- AUAudit & Accountability9
- CMConfiguration Management9
- MPMedia Protection9
- SISystem & Information Integrity7
- MAMaintenance6
- PEPhysical Protection6
- CASecurity Assessment4
- ATAwareness & Training3
- IRIncident Response3
- RARisk Assessment3
- PSPersonnel Security2
Where to start
Three ways to start, by what you need.
Pick the one that matches the question you are asking. Two carry a published price; the third is scoped with you, because it depends on what you already have. All of it is listed on Services.
I need to know where I stand
CMMC Level 2 gap assessment
$5,000, one time
All 110 requirements scored against your environment, your SPRS score calculated, and a broad POA&M of what closing each gap takes.
See the gap assessmentI need the documents written
System Security Plan, policy and POA&M
Scoped per client
The System Security Plan, the policy set behind it, and a detailed POA&M, written against your environment as it actually is.
See the documents serviceI need someone to run it
CMMC In A Container™
From $1,000 a month plus a $6,000 one-time build
A FedRAMP Moderate environment, the full policy set, and the ongoing work, run with you. Prefer to keep your own environment? A fractional CISO owns the program instead.
See CMMC In A Container™CMMC terms
Terms you will hear.
Your prime, your contract and your assessor will use these words as if everyone knows them. Each one opens a plain explanation.
Resources
What help already exists?
You are not on your own with this. Public and nonprofit programs help small suppliers get ready, and some of them do work we also do. We point you to them anyway, with each one described in its own words on Resources.
NIST Manufacturing Extension Partnership (MEP)
For: US manufacturers. Find your state's center at nist.gov/mep/centers.
APEX Accelerators
For: Any business entering or growing in government contracting.
Project Spectrum
For: Small businesses in the defense supply chain.
Case Study: Iron Lift
IRON LIFTIron Lift · CMMC Level 2 readiness. A customer, not an actor.
We wrote the System Security Plan and ran evidence collection.
110 of 110CONTROLS MET (SELF-ASSESSMENT)
Level 2CMMC SCOPE
2026-09-15STANDING AS VERIFIED
Talk it through in 30 minutes.
BOOK A CALLPick a time. Bring your contract if you have it.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 controls against your real environment and calculates your SPRS score. No portal, no subscription.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.
Grant details and the application are at Cyber Grants Alliance. Need managed IT and security as well? Capital Cyber runs it.