CMMC CONSULTING & READINESS SERVICES

Q: Which CMMC level will my organization need?

Level 1 applies to companies handling only FCI. Level 2 applies to most contractors handling CUI and maps directly to NIST 800-171. Level 3 applies to a small number of organizations supporting the most sensitive DoD programs. Most contractors will need Level 2 certification.

Q: Can Firethorne work with our existing IT team?

Yes. We offer two engagement models: Managed Services – We take full responsibility for IT operations and compliance management. Project-Based Consulting – We provide structure, roadmaps, and remediation guidance while your IT team executes.

Firethorne Tech helps defense contractors and DoD suppliers achieve and maintain CMMC compliance. Our US-based team delivers consulting, strategy, and technical services designed to align your environment and prepare you for third-party certification.

WHAT IS CMMC?

The Cybersecurity Maturity Model Certification (CMMC) is a certification program developed by the U.S. Department of Defense (DoD) to ensure that defense contractors and their suppliers protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

CMMC is built on the requirements of NIST SP 800-171, along with other federal standards, and adds a maturity model that requires organizations to demonstrate that security practices are not only implemented but are institutionalized and repeatable.

To be eligible for DoD contracts, defense contractors and subcontractors must meet the appropriate CMMC level and pass a third-party certification assessment. Without certification, organizations risk losing existing contracts and being disqualified from bidding on future opportunities.

In short: CMMC ensures that the Defense Industrial Base (DIB) supply chain meets consistent cybersecurity standards, protecting sensitive defense information from compromise.

CMMC TIMELINE

Understanding where CMMC stands helps you prepare effectively for compliance. With the program now officially codified (32 CFR) and enforcement coming soon through contracts (48 CFR), it’s critical to start your readiness journey now. Delaying could leave you ineligible for future DoD contracts as enforcement takes effect.

2010 – Executive Order 13556 establishes the Controlled Unclassified Information (CUI) Program, laying the groundwork for unified cybersecurity standards across the Defense Industrial Base
2019 – DoD announces the launch of CMMC, moving beyond simple self-attestation toward verified cybersecurity maturity
September 2020 – Published as interim DFARS rule, marking the start of CMMC 1.0 with five maturity levels based on NIST SP 800‑171 requirements
November 2021 – Transition to CMMC 2.0, streamlining the model to three levels and simplifying requirements for contractors
December 2024 – Publication of 32 CFR Part 170, the final rule solidifying the CMMC program framework, certification paths, and audit rules
July 2025 – The 48 CFR rule is submitted to OIRA for regulatory review. Once approved, this will make CMMC requirements enforceable in DoD contracts; we anticipate seeing them in contract language by October 2025
We Are Here (Mid‑2025) – The CMMC program is now codified, and enforcement is imminent. Level 2 assessments are operational in SPRS as of February 2025, signaling that readiness today is essential

OUR CMMC SERVICES

CMMC READINESS ASSESSMENTS

We start with a detailed readiness assessment to evaluate your current security posture against CMMC requirements. This includes reviewing policies, technical controls, and documentation to identify gaps and prioritize remediation efforts.

GAP ANALYSIS & REMEDIATION ROADMAPS

After the assessment, we provide a step-by-step remediation plan that aligns with NIST 800-171 controls and CMMC processes. Our roadmap helps you focus resources on the highest-impact areas to achieve compliance efficiently.

POLICY & DOCUMENTATION DEVELOPMENT

CMMC requires formal documentation such as System Security Plans (SSPs) and Plans of Action & Milestones (POA&Ms). We help you create and maintain these artifacts, ensuring they are audit-ready and tailored to your environment.

TECHNICAL SECURITY CONTROL IMPLEMENTATION

From multi-factor authentication (MFA) and encryption to endpoint detection and network segmentation, our team implements the technical controls necessary to satisfy CMMC requirements and strengthen your cybersecurity posture.

ONGOING COMPLIANCE MANAGEMENT

CMMC is not a one-time effort. We provide continuous monitoring, vulnerability management, and compliance advisory services to help you maintain alignment with requirements as regulations evolve and new threats emerge.

PRE-ASSESSMENT PREPARATION

When you’re ready for a third-party assessment, we guide you through the process with mock audits, evidence collection, and assessor coaching. This ensures you walk into certification confident and prepared.

MANAGED SERVICES MODEL

With Firethorne’s Managed Services, we take ownership of both your IT operations and your CMMC compliance journey. This isn’t just about keeping systems online — it’s about aligning monitoring, management, and security with recognized industry best practices and compliance requirements.

Onboarding & Baseline Assessment
We establish a clear baseline of your IT and compliance status, reviewing current policies, security controls, and infrastructure health.
Control Tracker & Runbook Development
A live control tracker and runbook are created to monitor every CMMC requirement, showing leadership progress in real time.
Best Practice IT Monitoring & Management
We deliver proactive endpoint, server, network, and cloud monitoring and management that aligns with security best practices. Every action we take is tied back to compliance requirements, ensuring that your environment doesn’t just run smoothly — it stays audit-ready.
FedRAMP-Aligned Cloud & Security Services
We leverage FedRAMP-compliant platforms wherever applicable, especially for Microsoft 365 and cloud-based security tools, so your environment remains within the federal compliance boundary.
Ongoing Compliance & Policy Updates
Compliance isn’t static. We maintain your documentation, policies, and technical controls, adjusting as CMMC guidance and federal standards evolve.
Leadership Reporting & Roadmap Reviews
You’ll receive executive-level dashboards and updates that track compliance readiness, SPRS scores, and IT performance against CMMC expectations.
Certification Support
When it’s time for your C3PAO assessment, we guide you through pre-audit readiness, evidence gathering, and mock audits to ensure confidence going into certification.

Best For: Defense contractors that want a fully managed partner to handle all IT and compliance responsibilities — not just short-term projects.

PROJECT-BASED MODEL

With this option, Firethorne works alongside your internal IT team or leadership to deliver CMMC-focused consulting projects. We don’t replace your MSP — instead, we provide the specialized compliance expertise and structured process you need to get audit-ready.

Readiness Assessment & Gap Analysis
We start with a full CMMC readiness assessment against NIST 800-171 controls and CMMC maturity processes. From there, we deliver a prioritized gap analysis that identifies exactly what must be remediated, and in what order.
Control Tracker Creation
We build a custom control tracker that provides clear visibility across all CMMC requirements. This tracker assigns ownership, tracks remediation progress, and helps leadership see compliance status in real time.
Runbook Development for Each Control
Every gap is mapped to a detailed remediation runbook, outlining technical steps, policy updates, and evidence requirements. This ensures your IT team knows exactly what to implement and how to demonstrate compliance.
Policy & Documentation Support
We provide guidance and templates for required artifacts such as System Security Plans (SSPs), Plans of Action & Milestones (POA&Ms), and user access policies. Our consultants ensure documentation is complete, accurate, and aligned with audit requirements.
Network & Infrastructure Review
We assess your IT infrastructure against security and compliance best practices. If upgrades are needed (such as segmentation, backup improvements, or privileged access controls), we document recommendations and provide guidance on implementation.
Remediation Advisory & Oversight
As your IT team implements changes, Firethorne provides advisory oversight to validate configurations, confirm alignment with CMMC requirements, and ensure controls are implemented correctly.
Pre-Assessment Preparation
Before a third-party C3PAO audit, we conduct mock assessments, review evidence packages, and coach your team through the certification process. This reduces surprises and increases confidence heading into the audit.

Best For: Organizations that want to keep IT operations in-house but need specialized CMMC expertise, structure, and documentation to achieve compliance.

BE READY FOR YOUR NEXT DIBCAC ASSESSMENT

LEVELS OF CMMC EXPLAINED

CMMC 2.0 introduced a simplified, three-tier model that replaced the original five levels. Each level reflects the sensitivity of the information you handle and the cybersecurity maturity your organization must demonstrate.

What This Means for Contractors

Level 1 keeps you in the game if you only handle FCI.
Level 2 is where most organizations must be, as it’s tied to NIST 800-171 and CUI protection.
Level 3 is specialized, but it sets the bar for the most sensitive DoD work.

At Firethorne Tech, we focus heavily on Level 2 readiness, helping defense contractors build roadmaps that cover technical controls, policies, documentation, and audit preparation.

CMMC Level 1 – Foundational Security

Level 1 applies to contractors that only handle Federal Contract Information (FCI) — information not intended for public release but not considered highly sensitive.

Scope: Protecting FCI from unauthorized access and basic cyber threats.
Requirements: 17 practices derived from FAR 52.204-21, such as using antivirus software, limiting access to systems, and enforcing basic password protections.
Assessment: Organizations may self-assess annually, but must keep documentation proving practices are implemented.
Business Impact: Even smaller suppliers in the DoD supply chain must achieve Level 1 to remain eligible for federal contracts.

CMMC Level 2 – Advanced Security for CUI

Level 2 is where most defense contractors will land. It applies to organizations that handle Controlled Unclassified Information (CUI) — sensitive defense information that must be safeguarded.

Scope: Protecting CUI from advanced persistent threats and reducing risks of compromise in the Defense Industrial Base (DIB).
Requirements: 110 security practices mapped directly to NIST SP 800-171. This includes controls for access management, incident response, data protection, and system monitoring.
Assessment:
- Prioritized contractors (those most critical to national defense) must undergo a third-party C3PAO assessment every 3 years.
- Non-prioritized contractors may complete annual self-assessments with attestations submitted to the DoD.
Business Impact: For most suppliers, Level 2 will become the standard for contract eligibility.

CMMC Level 3 – Expert Cybersecurity

Level 3 is reserved for contractors working on the most sensitive DoD programs. It applies to organizations facing the highest level of cybersecurity threats.

Scope: Protecting highly sensitive CUI from advanced nation-state threats.
Requirements: A subset of practices from NIST SP 800-172, which go beyond NIST 800-171 by requiring measures like enhanced monitoring, penetration testing, and insider threat programs.
Assessment: Government-led assessments (not third-party).
Business Impact: Only a small fraction of contractors will need Level 3 certification, but those who do will need to invest heavily in advanced cybersecurity capabilities.

FREQUENTLY ASKED QUESTIONS

What is the difference between CMMC and NIST 800-171?firethornetdev2025-08-27T23:28:17+00:00

What is the difference between CMMC and NIST 800-171?

NIST 800-171 is a standard that defines security controls for protecting Controlled Unclassified Information (CUI). CMMC builds on NIST 800-171 by adding a certification program that requires organizations to demonstrate compliance through third-party or government-led assessments.

Who needs CMMC certification?firethornetdev2025-08-27T23:28:38+00:00

Who needs CMMC certification?

Any contractor or subcontractor in the Defense Industrial Base (DIB) that handles CUI or FCI will need to meet CMMC requirements. This includes manufacturers, IT vendors, logistics companies, and service providers in the DoD supply chain.

Which CMMC level will my organization need?firethornetdev2025-08-27T23:29:15+00:00

Which CMMC level will my organization need?

Level 1 applies to companies handling only FCI.

Level 2 applies to most contractors handling CUI and maps directly to NIST 800-171.

Level 3 applies to a small number of organizations supporting the most sensitive DoD programs.
Most contractors will need Level 2 certification.

How long does it take to achieve CMMC readiness?firethornetdev2025-08-27T23:29:39+00:00

How long does it take to achieve CMMC readiness?

Timelines vary based on your current posture. Some organizations may be audit-ready in a few months, while others may need 12–18 months to close gaps, upgrade infrastructure, and complete documentation. Firethorne provides control trackers, remediation runbooks, and leadership reporting to keep your roadmap on track.

What happens if we are not CMMC compliant?firethornetdev2025-08-27T23:30:01+00:00

What happens if we are not CMMC compliant?

Without certification, you may lose eligibility for existing DoD contracts and be blocked from bidding on new opportunities. Non-compliance also increases the risk of security breaches, fines, and reputational damage.

Can Firethorne work with our existing IT team?firethornetdev2025-08-27T23:30:30+00:00

Can Firethorne work with our existing IT team?

Yes. We offer two engagement models:

Managed Services – We take full responsibility for IT operations and compliance management.

Project-Based Consulting – We provide structure, roadmaps, and remediation guidance while your IT team executes.

What kind of documentation is required for CMMC?firethornetdev2025-08-27T23:30:50+00:00

What kind of documentation is required for CMMC?

Organizations must maintain artifacts like System Security Plans (SSPs), Plans of Action & Milestones (POA&Ms), policies, procedures, and evidence of technical controls. Firethorne helps create and manage these documents so you’re audit-ready.

Do you provide ongoing support after certification?firethornetdev2025-08-27T23:31:14+00:00

Do you provide ongoing support after certification?

Yes. CMMC is not a one-time event. We provide continuous monitoring, compliance updates, and security management to ensure you stay aligned with evolving requirements.