CMMC Level 2 requirements, explained for a 20 person shop
CMMC Level 2 is the 110 controls of NIST SP 800-171, proven with evidence an assessor can test. Here is what that means for a small defense supplier, in plain words.
Published October 3, 2026
Guides
CMMC Guides
Plain answers to the questions defense contractors type before they know they need a gap assessment.
Written for a small shop with a contract clause it does not fully understand yet. No sales pitch in the body, and a published price when you are ready.
Which question are you asking?
5 GUIDESCMMC Level 1 vs Level 2: which one your contract actually needs
Level 1 protects Federal Contract Information with 15 practices. Level 2 protects CUI with 110. The contract clauses tell you which one you owe. A five minute read.
Published October 3, 2026
What a CMMC Level 2 assessment looks like, day by day
Before, during and after a CMMC Level 2 assessment: who is in the room, what the assessor examines, interviews and tests, and the five things that end an assessment early.
Published October 3, 2026
SPRS score: how it is calculated, and why a negative number is normal
Your SPRS score starts at 110 and loses 5, 3 or 1 points for every NIST SP 800-171 requirement you have not met. Most first scores are negative. Here is the math.
Published October 3, 2026
A fake security check appeared inside ChatGPT. What should a defense supplier take from it?
An IT team reported a ChatGPT chat that sent a user to a fake OpenAI verification page and a paste-a-command trap. What it means for a defense supplier, and the rule that stops it.
Published October 10, 2026
Have your contract in front of you?
BOOK A CALLBring it to a 30-minute call and we will read the clauses with you.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Start with where you stand.
A CMMC Level 2 gap assessment scores all 110 requirements and calculates your SPRS score, at a published price.
Defense supplier under 25 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.