CMMC Compliance Services for Defense Contractors and Their Suppliers
CMMC compliance services get sold two ways: a software dashboard that promises a score, or a consultant who writes a plan and leaves. Neither one configures a firewall. On July 13, 2026 the Department of War suspended CMMC Phase II, so third-party certification is on hold, but Phase I self-assessments and DFARS 252.204-7012 still apply. A machine shop or engineering firm that handles controlled unclassified information still needs a score, a plan and an affirmation it can stand behind. NetSys does the engineering underneath all three.
The short answer
The Cybersecurity Maturity Model Certification (CMMC 2.0) is the Department of Defense program that checks contractors protect federal contract information (FCI) and controlled unclassified information (CUI). On July 13, 2026 the Department of War suspended Phase II, so the program is paused in Phase I. Level 1 is an annual self-assessment and affirmation against the 15 requirements in FAR 52.204-21. Level 2 is a self-assessment every three years, affirmed annually, against the 110 requirements of NIST SP 800-171 Revision 2. DFARS 252.204-7012 still applies. NetSys provides CMMC compliance services: scoping where CUI lives, building an enclave that meets the controls, writing the System Security Plan and organizing evidence. We are not a C3PAO and certify no one.
Most of the defense industrial base is small: a precision machining shop in Suffolk County, a wiring harness supplier in New Jersey, an engineering firm subcontracting to a prime. CMMC applies to them because the requirement flows down through the contract. If the prime handles CUI and passes drawings or specifications to you, you handle CUI, and Level 2 is your problem whether or not anyone said so.
Our CMMC compliance services start from the data rather than the framework. Where does CUI arrive, who opens it, where is it stored, where does it go next? The answer usually shows that CUI touches a handful of people and systems, which means the controls can be applied to a defined enclave instead of the whole company. That is the difference between a project the business can afford and one it cannot.
Scope Small, Build Once, Document From Reality
You can start with our free remote external penetration test, limited to available information and agreed external scope. A separate scoping workshop maps CUI flows and draws the enclave boundary. Inside that boundary we implement the NIST SP 800-171 requirements, from identity and MFA through logging and incident response. Cloud services holding CUI have to meet the FedRAMP Moderate baseline or an equivalent under DFARS clause 252.204-7012, so we help you choose between commercial Microsoft 365, GCC and GCC High based on the data you hold. The System Security Plan is written from the configuration we deployed, not from a template, and every requirement points at evidence.
What Our CMMC Compliance Services Cover
Scoping and Gap Assessment
Level 1 or Level 2, and how much of the company is in scope.
- Contract and flow-down review to determine whether you hold FCI, CUI or both
- Data flow mapping and an enclave boundary that keeps most of the business out of scope
- Gap assessment against NIST SP 800-171 with a scored, prioritized remediation plan
- SPRS self-assessment score prepared with the DoD's published method
NIST SP 800-171 Controls Implementation
The requirements as configured systems, inside the enclave.
- Microsoft 365 GCC or GCC High tenant design, migration and hardening for CUI
- Phishing-resistant MFA, conditional access and privileged access management for administrators
- Endpoint baselines, encryption and application control through Intune and Defender
- Centralized logging, alerting and audit record retention that satisfy the audit family
Documentation and Evidence
What your affirming official signs, and where every claim points.
- System Security Plan written from the deployed configuration, requirement by requirement
- Plan of Action and Milestones for open items, within the limits the CMMC rule allows
- Policies and procedures tailored to how your shop runs, with named owners
- Evidence library organized by requirement, ready for your self-assessment or a government-led review
Ongoing Operation
An affirmation describes a moment; the contract expects every day.
- Continuous monitoring, patching and vulnerability management inside the enclave
- Quarterly control reviews and an annual affirmation package for leadership
- Change control so a new hire or new server does not silently break a requirement
- Remote delivery nationwide; on-site support in our published coverage areas, and visits elsewhere, Philadelphia included, arranged in advance
Why Defense Suppliers Choose NetSys for CMMC Compliance Services
Fifteen minutes with a NetSys engineer, not a salesperson, and you will know where your cmmc 2.0 compliance services stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
- Enclave-first scoping that keeps the project the size of your CUI, not the size of your company
- Controls are implemented and operated by the same engineers, so the SSP describes what is running
- PAM, monitoring and disaster recovery are included in the managed agreement
- Straight answers on where CMMC stands today, and about what we are not: an assessor
- Month to month, with a free remote external penetration test within an agreed external scope to start
Where we deliver CMMC 2.0 Compliance Services
CMMC 2.0 Compliance Services in New Jersey · CMMC 2.0 Compliance Services in Pennsylvania · CMMC 2.0 Compliance Services in Maryland · CMMC 2.0 Compliance Services in Delaware · CMMC 2.0 Compliance Services in New York City. We also support clients remotely wherever their systems run. See all locations and service areas.
CMMC 2.0 Compliance Services FAQs
What are CMMC compliance services?
CMMC compliance services prepare a defense contractor for the level its contracts require. That means deciding whether you handle FCI or CUI, scoping the systems involved, implementing the NIST SP 800-171 requirements, writing the System Security Plan and organizing evidence for your self-assessment and annual affirmation. NetSys delivers the engineering, documentation and ongoing operation.
What is the difference between CMMC Level 1 and Level 2?
Level 1 covers federal contract information: an annual self-assessment and affirmation against the 15 requirements in FAR 52.204-21. Level 2 covers controlled unclassified information, such as drawings marked CUI: a self-assessment every three years, affirmed annually, against the 110 requirements of NIST SP 800-171 Revision 2. Since the July 13, 2026 Phase II suspension, neither level requires third-party certification.
What is the difference between CMMC and NIST 800-171?
NIST SP 800-171 is the standard, and CMMC is the program that checks it. NIST SP 800-171 Revision 2 sets 110 security requirements for protecting controlled unclassified information, and defense contracts carrying DFARS 252.204-7012 require them. CMMC Level 2 is how the Department of Defense verifies those same 110 requirements, currently through a self-assessment every three years, affirmed annually. Level 1 covers the 15 FAR 52.204-21 requirements instead.
How much do CMMC compliance services cost?
The biggest cost driver is scope: how many people, devices and systems touch CUI. A tight enclave for a dozen users costs far less than bringing an entire company to Level 2, which is why scoping comes first. We do not publish prices. With Phase II suspended, there is no third-party assessor's fee to budget for today.
Can NetSys certify us for CMMC?
No. We are not a C3PAO and we certify no one. Since July 13, 2026, when Phase II was suspended, CMMC is met through self-assessments and annual affirmations, with select government-led assessments. If third-party certification returns, it must come from an authorized C3PAO independent of whoever built your environment. We design, document and run the controls.
Do we need CMMC if we are only a subcontractor?
Usually yes. CMMC requirements flow down from the prime to every subcontractor that receives FCI or CUI under the contract. If a prime sends you drawings marked CUI, Level 2 applies to the systems that handle them. Check the flow-down clauses in your subcontract and ask the prime in writing.
Do we have to move to Microsoft 365 GCC High for CMMC?
Not always. DFARS 252.204-7012 requires cloud services that store or process CUI to meet the FedRAMP Moderate baseline or an equivalent, and export-controlled CUI pushes most firms toward GCC High. For CUI without export controls, other Microsoft environments can be defensible when configured correctly. We walk through your data types and choose the lowest-cost option that meets the requirement.
Is CMMC still required after the Phase II suspension?
Yes, in its Phase I form. On July 13, 2026 the Department of War suspended Phase II but kept the Phase I self-assessment requirements in place, and it enforces NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments. DFARS 252.204-7012 still requires you to protect covered information. This is general information, not legal advice.
Sources and technical references
- DoD CIO: CMMC program status, including the July 13, 2026 Phase II suspension
- DoD CIO: About CMMC, levels and self-assessment requirements
- DFARS 252.204-7012: safeguarding covered defense information and cyber incident reporting
- FAR 52.204-21: the 15 basic safeguarding requirements behind CMMC Level 1
- NIST SP 800-171 Rev. 2: the 110 requirements behind CMMC Level 2
Guides on this topic
An enclave sized to your CUI, not your company.
First we trace where CUI arrives, who opens it, where it sits and where it goes next. That usually shows a handful of people and systems, so the controls land on a defined enclave rather than the whole company. The System Security Plan is written from what we deployed.