CMMC Level 2 for CUI · A CMMC firm · Cyber AB Registered Practitioner led
CMMC Level 2, done with you. From scope to signature, and every year after.
- A Cyber AB Registered Practitioner leads youIncluded
- All 110 requirements, scored the official wayIncluded
- The 14 policies, SSP, and POA&M, drafted with youIncluded
- Security awareness training for your whole teamIncluded
- Proof pulled from Google, Microsoft 365, and gov cloudIncluded
- Kickoff and review calls at every stepIncluded
A Cyber AB Registered Practitioner leads your Level 2 program, from a kickoff and scoping call to your senior official's signature. Your team works the 110 requirements and 320 objectives step by step on the platform, your Google Workspace, Microsoft 365, or Microsoft government cloud pulls in proof, and we review every step before anything is signed. All without moving your data, without replacing your MSP or your enclave, and without a consultant who does it once and leaves. Start free for 30 days.
Three different things, often confused. We are the third: the CMMC firm that leads your program with you.
Holds the CUI
Your enclave
GCC High, a managed environment, your own tenant.
Signs the affirmation
Your senior official
A person at your company, named in SPRS, who stands behind the score. Nobody can sign it for them.
Leads the program with you
Custodia
A Registered Practitioner and the platform, with your team: scope, self assess, score, fix, attest, and keep it current.
We do not become your cloud and we never sign for you. A Registered Practitioner leads the work, your team does it on the platform, and it works with whatever enclave and MSP you already have.
how it works
You answer in plain English, one step at a time. A Registered Practitioner checks every step. That is the whole job.
Nobody wants to self assess out of a spreadsheet. It starts with a kickoff and scoping call. Then the platform asks, your team answers, and Charlie drafts what your answers imply and cites the rule. A Registered Practitioner reviews each step as your team finishes it, with review calls along the way. Charlie never marks anything MET, your team does. One question at a time, across 5 steps.
It is not a document you buy, and it is not software and good luck. It is a program we lead with you, every year.
1. Scope your assessment
Start with a kickoff and scoping session. Map how controlled information enters, lives, gets worked on, and leaves, categorize every asset, save the network diagram, and start a Customer Responsibility Matrix for every provider you rely on. We review the scope with you before the work moves on.
2. Assess the 110
Adopt the 14 policies, then resolve every requirement at the objective level with evidence behind each MET. Guided capture covers 44 kinds of proof, and a read only connection to Google Workspace, Microsoft 365, or Microsoft government cloud pulls in what your systems can prove. Your team confirms every MET, and a Registered Practitioner reviews every requirement before your official signs.
3. Score it and close the gaps
Your 32 CFR 170.24 score out of 110, reviewed with you, a POA&M for what is still open, the 88 line for Conditional, 180 days to close, and the 6 that can never ride one.
4. Prove it, attest, and file
Turn every readiness check green and sign your internal audit. Then the attest session: you record your score in SPRS and your senior official self attests to it, with us beside them. A prime or your own internal auditor can walk the same evidence in a read only seat.
Scope your assessment
Start with a kickoff and scoping session. Map how controlled information enters, lives, gets worked on, and leaves, categorize every asset, save the network diagram, and start a Customer Responsibility Matrix for every provider you rely on. We review the scope with you before the work moves on.
Assess the 110
Adopt the 14 policies, then resolve every requirement at the objective level with evidence behind each MET. Guided capture covers 44 kinds of proof, and a read only connection to Google Workspace, Microsoft 365, or Microsoft government cloud pulls in what your systems can prove. Your team confirms every MET, and a Registered Practitioner reviews every requirement before your official signs.
Score it and close the gaps
Your 32 CFR 170.24 score out of 110, reviewed with you, a POA&M for what is still open, the 88 line for Conditional, 180 days to close, and the 6 that can never ride one.
Prove it, attest, and file
Turn every readiness check green and sign your internal audit. Then the attest session: you record your score in SPRS and your senior official self attests to it, with us beside them. A prime or your own internal auditor can walk the same evidence in a read only seat.
your score, 32 CFR 170.24
Start at 110. Every NOT MET requirement subtracts 1, 3, or 5 points by weight. At 88 or better, with every remaining gap eligible for a POA&M, you can file with Conditional status (32 CFR 170.21).
Example: Meridian Defense Systems, Inc.
the POA&M, closing
- AC.L2-3.1.3 Control CUI Flow
- AT.L2-3.2.3 Insider Threat Awareness
- AU.L2-3.3.3 Event Review
- CM.L2-3.4.3 System Change Management
180 days to close every POA&M item, or the status expires.
6 requirements can never ride a POA&M at all, the System Security Plan among them. Those have to be MET before you record your score, on either track.
You self assess first, with a Registered Practitioner checking every step. You run your own internal audit. Then your senior official signs.
Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.
your team builds it, we check it
Compliance stops being one person's problem. Invite your team and the work splits. Send the controls to whoever holds the passwords, let your IT person handle the evidence, and keep the signature with your senior official. Five roles, one workspace, and a Registered Practitioner reviewing all of it.
the rhythm
A cadence you can prove beats a screenshot you took last Tuesday.
Several Level 2 requirements ask you to define a frequency and then show you kept it, and one asks for continuous monitoring outright. So your team keeps a monthly rhythm here, and a Registered Practitioner checks in with you through the year. Every month the platform checks your record and seals a new dated version whenever something changed, kept six years. When your senior official signs, or a prime asks, you are not assembling evidence, you are handing over a run of it.
each mark is one monthly check of your record
The monthly rhythm is how we do it. The regulation asks you to set your own cadence and keep it, and it never names a number.
Your evidence compounds instead of expiring.
when someone needs to check
When a prime or your own reviewer asks, they walk your evidence in your workspace, not a shared drive.
Give them a read only seat: a prime that wants proof before a flowdown, a customer running a supplier check, or your own internal auditor. They see every requirement, every objective, the evidence behind each one, and the guide line it answers. Findings get raised against the specific objective they belong to, and you resolve them in the same place, so nobody is reconciling a spreadsheet against an email thread.
- aauthorized users are identifiedMET
- bprocesses acting on behalf of authorized users are identifiedMET
- cdevices authorized to connect are identifiedMET
- aauthorized users are identifiedMET
- bprocesses acting on behalf of authorized users are identifiedMET
- cdevices authorized to connect are identifiedMET
no Charlie · no remediation hints · nothing they can change
A real self assessment still means looking at live systems. Your tenant, your AWS account, your repos. Your team does that work, a Registered Practitioner reviews it, and your senior official stands behind it. What we remove is the weeks of hunting for documents before anyone gets to look at anything real.
why the Audit Room exists
The Audit Room is where your team proves readiness, and a Registered Practitioner checks it, before your senior official signs: every readiness check green, your internal audit signed. The standard it holds you to is the one the Department wrote down. Any assessment of readiness starts with the System Security Plan and the scope, and a plan that is thin or a scope that is unclear stops the work before a single control gets evaluated. The Audit Room is built so you find those gaps first, while they are still cheap to fix.
CMMC Assessment Process v2.0 § 1.22, Adverse Determination of Assessment Readiness. Read the source.
Your sealed record
Every package hashed, signed, and sealed, kept six years, ready for your senior official, a prime, or your own reviewer.
The public verified page
A live page at bidfedcmmc.com/verified/yourcompany for the primes who just need to check. Once your self assessment is filed and your senior official has affirmed it, it reads: Filed in SPRS, renewal clocks tracked.
The payoff
The status is what unlocks the pipeline. Matching contracts land in your inbox every Monday.
the outside check
You think your security is fine.Everyone does, until someone qualified actually looks.
At Level 1 you answer 15 questions. At Level 2 you score yourself against 320 objectives across 110 requirements, and your senior official signs for the result every year. Where a solicitation asks for certification, a C3PAO checks it too. The gap between what a team believes it has implemented and what it can prove is where self assessments fail, and it is not a gap anyone can see in their own program.
A Cyber AB Registered Practitioner leads your program and is the outside read before your signature. They start with you at kickoff, review every step as your team finishes it, send back what to change on review calls, and flag which MET answers will not hold up if anyone checks. They never sign for you. Included every year of the cycle, not just the first one.
“Under no circumstances shall the C3PAO, its Assessment Team, or any other affiliated personnel offer any advice, implementation assistance, or recommendations as to how the OSC can improve or enhance their preparedness for a replanned or rescheduled CMMC Level 2 certification assessment . . .”
If a contract brings in an assessor, they are not allowed to help you. That is not a criticism of them, it is what independence means. It is also why a Registered Practitioner sits on your side of the table, from scope to signature.
You are not signing a form. You are signing a statement the government can prosecute.
A CMMC affirmation is made by a named senior official who can bind the company. A knowingly false one carries 18 U.S.C. § 1001 and False Claims Act exposure. That is the law today, on the self assessment path as much as any other.
Take the assessor out of the loop and that exposure does not go down, it concentrates. There is no third party left to catch the answer that was optimistic. Which is exactly why the person who signs should not also be the only person who checked.
That is the statute, not legal advice. Questions about your own exposure belong with your counsel.
one framework, all the way down
Every other framework helps you win the deal. This one decides whether you are eligible for the award.
SOC 2 and ISO 27001 get asked for by customers. CMMC is written into the contract, at DFARS 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements, and DFARS 252.204-7025, Notice of Cybersecurity Maturity Model Certification Level Requirements. That is why we build one framework all the way down to its 320 objectives instead of dozens of frameworks an inch deep. Built for CMMC and nothing else, because federal contract data deserves more than a module added to a commercial checklist. Your contracts depend on this one.
Every other option leaves a hole somebody has to fill later.
| Do it yourself | Consultant or prep firm | Managed enclave or cloud | General compliance platform | Custodia | |
|---|---|---|---|---|---|
| Holds your CUI | You | No | Yes, that is the product | No | No, and we never will |
| Who does the work | You, alone | They do, while engaged | Not their job | You, with a grid to fill | Your team, led by a Registered Practitioner |
| Scores you against § 170.24 | By hand | By hand | No | Varies | Yes, as your team answers |
| A CMMC professional reviews your work | No | While engaged | No | Not included | Yes, a Registered Practitioner, every year |
| Pulls proof from Google, Microsoft 365, and gov cloud | No | No | No | Varies | Yes, read only |
| CMMC is the only framework they build for | n/a | Sometimes | No | No, one of many | Yes |
| Year two and three | Start over | Re engage, re bill | Same bill, no program | Subscription plus a consultant anyway | Same program, same yearly price |
Save $500/yr on annual, or $1,291.67/mo
The whole Level 2 program: a kickoff and scoping session, a Registered Practitioner reviewing every requirement on review calls, the policies, SSP, and POA&M drafted with you, security awareness training for your whole team, read only connections to Google Workspace, Microsoft 365, and Microsoft government cloud, Charlie, an attest session with your senior official, a sealed record kept six years, and contract opportunities matched to you. Priced per year of the three year Level 2 assessment cycle.
Security is not a one time purchase, so Level 2 is priced by the year: an affirmation every year, a Registered Practitioner there for every year of the cycle, and you can cancel anytime.
Your 30 free days start with a kickoff call with a Registered Practitioner. Connect your systems, invite your team, and see the program work on your own business before you pay anything. No credit card, cancel anytime. Level 1 and Level 2 are both open, so sign up for the level your contracts call for.
Can our own team really do this?
Do you host our CUI?
Do you certify us, or sign for us?
We are not sure we need Level 2.
start your Level 2 program
Start free for 30 days, kickoff call included. No credit card, cancel anytime. Level 1 and Level 2 are both open, so if your contracts only carry FCI, start at Level 1 instead.
reference
The full CMMC Level 2 reference guide
Plain English, primary sources cited. Not sure which level you need? Run the free check.
What CMMC Level 2 is, in one paragraph
CMMC Level 2 is how the Department of Defense verifies that a contractor protecting Controlled Unclassified Information (CUI) actually implements the safeguards its contracts have required for years. If a contract carries DFARS 252.204-7012, or the government sends you controlled technical drawings, export controlled specs, or technical data on a defense article, you are in Level 2 territory. The standard is NIST SP 800-171 Revision 2: 110 security requirements across 14 families, each judged at the objective level, scored out of 110, and recorded in SPRS under your CAGE code with an annual affirmation by a senior official.
Level 2 is not paperwork about security. It is a scored, evidence backed statement, with False Claims Act exposure behind it, that your business runs the 110 requirements today. That is exactly why a current, defensible assessment is what DFARS 252.204-7019(b) asks to see before award.
One point that gets muddled, so it is worth stating plainly. Self assessment and self attestation at Level 1 and Level 2 are law today. DFARS 252.204-7012 is unaffected. The NIST SP 800-171 Rev 2 baseline is unaffected. Self assessment requirements appear in solicitations today, government led assessments continue, and False Claims Act exposure for a knowingly false affirmation is unchanged. As of September 3, 2026 a DFARS class deviation directs contracting officers to remove third party assessment requirements from contracts, so Level 2 is self assessed and self attested today. The program rule still provides for certification by an accredited third party, so your solicitation sets the track. If your contracts carry CUI, the work behind the 110 requirements applies to you either way.
The 110 requirements, in 14 plain-English families
Every requirement comes from NIST SP 800-171 r2. Here is the whole map, what each family actually asks of your business:
Assessors do not grade the families, they grade the 320 assessment objectives beneath them (NIST SP 800-171A). One unmet objective fails its whole requirement, which is why working at the objective level from day one is the only honest way to build.
The score, the 88 rule, and the POA&M clock
Scoring is arithmetic, defined in 32 CFR 170.24. Start at 110. Every NOT MET requirement subtracts 1, 3, or 5 points by weight. Missing multifactor authentication or FIPS validated encryption carries special deductions, and no System Security Plan means the assessment cannot be completed at all (CA.L2-3.12.4).
You do not need a perfect 110 to file. At 88 or better, with every remaining gap eligible for a Plan of Action and Milestones, you can file with Conditional status, then close every POA&M item within 180 days or the status expires. Six requirements can never ride a POA&M, including the SSP itself and the physical access trio, and those must be MET before you record your score, on either track.
The two tracks use the same 110 requirements, and your solicitation sets which one applies. Level 2 (Self) is a self assessment recorded in SPRS, the default today; Level 2 (C3PAO) is certification by an accredited third party, recorded in CMMC eMASS, where a contract demands it. Build one honest package and it serves both. A status is valid three years, with annual affirmations by your senior official.
How to get CMMC Level 2 filed, step by step
- 1Confirm CMMC Level 2 applies to you
Check your contracts for DFARS 252.204-7012 and look for information marked CUI, export controlled, or Distribution D. If you find either, Level 2 applies. If your contracts only involve FCI, start with Level 1 instead.
- 2Map your CUI
Document every flow of controlled information: what it is, where it comes from, which systems store, process, or transmit it, and where it leaves. This map drives everything that follows.
- 3Draw the assessment boundary
Categorize every asset under 32 CFR 170.19: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out of Scope. Determine FedRAMP status for every cloud vendor that touches CUI per DFARS 252.204-7012.
- 4Adopt the policies and stand up the registers
Adopt the written policies the documentation objectives call for, and start the trackers the operational objectives call for, so the paperwork objectives are satisfied by documents you actually run on.
- 5Work the 110 requirements at the objective level
Resolve each requirement the way an assessor scores it: every NIST SP 800-171A objective MET or Not Applicable, with evidence behind every MET. Adopted written policies satisfy the documentation objectives.
- 6Write the System Security Plan and score honestly
The SSP is mandatory, no SSP means the assessment cannot be completed (CA.L2-3.12.4). Run the official 32 CFR 170.24 scoring: 110 minus 1, 3, or 5 points per gap.
- 7POA&M what is eligible, fix what is not
At 88 or better with only POA&M eligible gaps you can file with Conditional status. POA&M items close within 180 days. Only 1 point gaps are POA&M eligible (except FIPS encryption, SC.L2-3.13.11, at 3 points), so the six never POA&M requirements and every other 3 and 5 point item must be MET first.
- 8Prove readiness, then record the self assessment and affirm
Turn every readiness check green and sign your internal audit. Then record the assessment in SPRS under your CAGE code and have your Affirming Official, a senior company official, affirm. The status is valid three years with annual affirmations.
- 9Hold it year round, and re-affirm every year
Keep evidence fresh, close POA&Ms on schedule, review policies annually, and re-affirm every year in SPRS. Keep the sealed record package for six years from the CMMC Status Date: it is the evidence behind the score you filed.
What CMMC Level 2 really costs in 2026
A consultant readiness engagement is scoped and billed as a project, usually over months, and the method leaves with the consultant. A full time compliance hire is a salary, and one person cannot hold 320 objectives in their head.
Custodia's CMMC Level 2 program is $15,000 a year, or $1,291.67/mo if you prefer monthly. It covers a kickoff and scoping session, review calls at every step, the living Policy Center, the guided evidence capture, security awareness training for your team, the Audit Room, an attest session with your senior official, the sealed six year record package, contract opportunity matching, and a Registered Practitioner year round: your team does the build on the platform so the method stays yours, and the practitioner reviews every step, checks the package before anything is filed, and keeps watching your posture after it is. Custodia is led by a Cyber AB Registered Practitioner (RP).