CMMC Compliance Services for Defense Contractors and Their Suppliers
CMMC compliance services get sold two ways: a software dashboard that promises a score, or a consultant who writes a plan and leaves. Neither one configures a firewall. On July 13, 2026 the Department of War suspended CMMC Phase II, so third-party certification is on hold, but Phase I self-assessments and DFARS 252.204-7012 still apply. A machine shop or engineering firm that handles controlled unclassified information still needs a score, a plan and an affirmation it can stand behind. NetSys does the engineering underneath all three.
The short answer
CMMC compliance services prepare a defense supplier for the Cybersecurity Maturity Model Certification (CMMC) level its contracts require: finding where federal contract information (FCI) and controlled unclassified information (CUI) live, building the NIST SP 800-171 controls around them, writing the System Security Plan and keeping the evidence behind each self-assessment and annual affirmation. Since the Department of War suspended Phase II on July 13, 2026, procurements may call only for Level 1 or Level 2 self-assessments, and DFARS 252.204-7012 still applies. NetSys does the engineering and the documentation; we are not a C3PAO and certify no one.
Most of the defense industrial base is small: a precision machining shop in Suffolk County, a wiring harness supplier in New Jersey, an engineering firm subcontracting to a prime. CMMC applies to them because the requirement flows down through the contract. If the prime handles CUI and passes drawings or specifications to you, you handle CUI, and Level 2 is your problem whether or not anyone said so.
Our CMMC compliance services start from the data rather than the framework. Where does CUI arrive, who opens it, where is it stored, where does it go next? The answer usually shows that CUI touches a handful of people and systems, which means the controls can be applied to a defined enclave instead of the whole company. That is the difference between a project the business can afford and one it cannot.
Scope Small, Build Once, Document From Reality
You can start with our free remote external penetration test, limited to available information and agreed external scope. A separate scoping workshop maps CUI flows and draws the enclave boundary. Inside that boundary we implement the NIST SP 800-171 requirements, from identity and MFA through logging and incident response. Cloud services holding CUI have to meet the FedRAMP Moderate baseline or an equivalent under DFARS clause 252.204-7012, so we help you choose between commercial Microsoft 365, GCC and GCC High based on the data you hold. The System Security Plan is written from the configuration we deployed, not from a template, and every requirement points at evidence.
What Our CMMC Compliance Services Cover
Scoping and Gap Assessment
Level 1 or Level 2, and how much of the company is in scope.
- Contract and flow-down review to determine whether you hold FCI, CUI or both
- Data flow mapping and an enclave boundary that keeps most of the business out of scope
- Gap assessment against NIST SP 800-171 with a scored, prioritized remediation plan
- SPRS self-assessment score prepared with the DoD's published method
NIST SP 800-171 Controls Implementation
The requirements as configured systems, inside the enclave.
- Microsoft 365 GCC or GCC High tenant design, migration and hardening for CUI
- Phishing-resistant MFA, conditional access and privileged access management for administrators
- Endpoint baselines, encryption and application control through Intune and Defender
- Centralized logging, alerting and audit record retention that satisfy the audit family
Documentation and Evidence
What your affirming official signs, and where every claim points.
- System Security Plan written from the deployed configuration, requirement by requirement
- Plan of Action and Milestones for open items, within the limits the CMMC rule allows
- Policies and procedures tailored to how your shop runs, with named owners
- Evidence library organized by requirement, ready for your self-assessment or a government-led review
Ongoing Operation
An affirmation describes a moment; the contract expects every day.
- Continuous monitoring, patching and vulnerability management inside the enclave
- Quarterly control reviews and an annual affirmation package for leadership
- Change control so a new hire or new server does not silently break a requirement
- Remote delivery nationwide; on-site support in our published coverage areas, and visits elsewhere, Philadelphia included, arranged in advance
Why Defense Suppliers Choose NetSys for CMMC Compliance Services
Fifteen minutes with a NetSys engineer, not a salesperson, and you will know where your cmmc 2.0 compliance services stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
Who does the work: meet the NetSys team on our About page.
- Enclave-first scoping that keeps the project the size of your CUI, not the size of your company
- Controls are implemented and operated by the same engineers, so the SSP describes what is running
- PAM, monitoring and disaster recovery are included in the managed agreement
- Straight answers on where CMMC stands today, and about what we are not: an assessor
- Month to month, with a free remote external penetration test within an agreed external scope to start
Where we deliver CMMC 2.0 Compliance Services
CMMC 2.0 Compliance Services in New Jersey · CMMC 2.0 Compliance Services in Pennsylvania · CMMC 2.0 Compliance Services in Maryland · CMMC 2.0 Compliance Services in Delaware · CMMC 2.0 Compliance Services in New York City. We also support clients remotely wherever their systems run. See all locations and service areas.
CMMC 2.0 Compliance Services FAQs
What are CMMC compliance services?
CMMC compliance services prepare a defense contractor for the level its contracts require. That means deciding whether you handle FCI or CUI, scoping the systems involved, implementing the NIST SP 800-171 requirements, writing the System Security Plan and organizing evidence for your self-assessment and annual affirmation. NetSys delivers the engineering, documentation and ongoing operation.
What is the difference between CMMC Level 1 and Level 2?
Level 1 covers federal contract information: an annual self-assessment and affirmation against the 15 requirements in FAR 52.204-21. Level 2 covers controlled unclassified information, such as drawings marked CUI: a self-assessment every three years, affirmed annually, against the 110 requirements of NIST SP 800-171 Revision 2. Since the July 13, 2026 Phase II suspension, neither level requires third-party certification.
What is the difference between CMMC and NIST 800-171?
NIST SP 800-171 is the standard, and CMMC is the program that checks it. NIST SP 800-171 Revision 2 sets 110 security requirements for protecting controlled unclassified information, and defense contracts carrying DFARS 252.204-7012 require them. CMMC Level 2 is how the Department of Defense verifies those same 110 requirements, currently through a self-assessment every three years, affirmed annually. Level 1 covers the 15 FAR 52.204-21 requirements instead.
How much do CMMC compliance services cost?
The biggest cost driver is scope: how many people, devices and systems touch CUI. A tight enclave for a dozen users costs far less than bringing an entire company to Level 2, which is why scoping comes first. The Department's own CMMC FAQ names the same drivers: the level required, how complex your network is and how much of the security work is already in place. Licensing for Microsoft 365 GCC High, where your data requires it, is its own line. We do not publish prices; the engineering is quoted after scoping, and ongoing operation runs under a month-to-month managed agreement. With Phase II suspended, there is no third-party assessor's fee to budget for today.
Can NetSys certify us for CMMC?
No. We are not a C3PAO and we certify no one. Since July 13, 2026, when Phase II was suspended, CMMC is met through self-assessments and annual affirmations, with select government-led assessments. If third-party certification returns, it must come from an authorized C3PAO independent of whoever built your environment. We design, document and run the controls.
Do we need CMMC if we are only a subcontractor?
Usually yes. CMMC requirements flow down from the prime to every subcontractor that receives FCI or CUI under the contract. If a prime sends you drawings marked CUI, Level 2 applies to the systems that handle them. Check the flow-down clauses in your subcontract and ask the prime in writing.
Do we have to move to Microsoft 365 GCC High for CMMC?
Not always. DFARS 252.204-7012 requires cloud services that store or process CUI to meet the FedRAMP Moderate baseline or an equivalent, and export-controlled CUI pushes most firms toward GCC High. For CUI without export controls, other Microsoft environments can be defensible when configured correctly. We walk through your data types and choose the lowest-cost option that meets the requirement.
Is CMMC still required after the Phase II suspension?
Yes, in its Phase I form. On July 13, 2026 the Department of War suspended Phase II but kept the Phase I self-assessment requirements in place, and it enforces NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments. DFARS 252.204-7012 still requires you to protect covered information. This is general information, not legal advice.
Does CMMC Level 3 apply to us?
Not while Phase II is suspended. Under the CMMC rule (32 CFR Part 170), Level 3 adds 24 requirements selected from NIST SP 800-172 on top of Level 2, is assessed by the government's DCMA DIBCAC, and requires a Final Level 2 certification from a C3PAO first. The July 2026 suspension limits procurements to Level 1 or Level 2 self-assessments, so no new solicitation can call for Level 3 today. If a prime says otherwise, ask for the clause in writing.
What do we have at the end of a CMMC engagement?
A written scoping decision (FCI, CUI or both, and where the enclave boundary sits), an SPRS score calculated with the DoD's published assessment method, a System Security Plan written from the deployed configuration, a Plan of Action and Milestones within the limits the rule allows, policies with named owners, and an evidence library organized by requirement. Each year your affirming official gets an affirmation package, and the controls keep running under the managed agreement in between.
How does a CMMC engagement start?
With your contracts, not the framework. We read the clauses and flow-downs to establish whether you handle FCI, CUI or both, then trace where CUI arrives, who opens it, where it is stored and where it goes next. That map sets the enclave boundary. The gap assessment against NIST SP 800-171 follows, and you get a scored, prioritized remediation plan before implementation begins. Our free remote external penetration test, within an agreed external scope, can run first.
Who supports the enclave after the controls are in place?
The NetSys engineers who built it: monitoring, patching and vulnerability management inside the enclave, quarterly control reviews and change control. Staff reach our help desk seven days a week from 4 a.m. to 11 p.m. Eastern time, and emergency service is available 24/7. If an incident touches covered defense information, DFARS 252.204-7012 requires you to report it to DoD within 72 hours of discovery, using a medium assurance certificate, and to keep images of affected systems and monitoring data for at least 90 days after the report. The report is yours to file; our logs and incident records supply the facts.
Sources and technical references
- DoW CIO: CMMC program status, including the July 13, 2026 Phase II suspension
- DoW CIO: About CMMC, levels and self-assessment requirements
- DoW CIO memo suspending Phase II: NIST SP 800-171 enforced through self-assessments and select government-led assessments (PDF)
- DoW CIO: CMMC FAQs, revised July 13, 2026, including what drives compliance cost (PDF)
- DFARS 252.204-7012: safeguarding covered defense information and cyber incident reporting
- FAR 52.204-21: the 15 basic safeguarding requirements behind CMMC Level 1
- NIST SP 800-171 Rev. 2: the 110 requirements behind CMMC Level 2
- eCFR 32 CFR Part 170: the CMMC program rule, including the Level 3 requirements
Guides on this topic
- CMMC 2.0 Compliance for Small Business
- NIST SP 800-171 explained: the 110 requirements behind CMMC Level 2
- IT for Government Contractors
- IT for Manufacturers
- NIST CSF 2.0 Implementation
- Privileged Access Management
- Security Assessments
- Free External Penetration Test
- manufacturing cybersecurity
- CMMC certification cost and what drives it
- NIST SP 800-171 checklist for the Level 2 requirements
- System Security Plan and POA&M templates
- CMMC Level 2 Requirements: The 110 Controls Explained
- CMMC Level 1 Checklist: The 15 Requirements Explained
An enclave sized to your CUI, not your company.
First we trace where CUI arrives, who opens it, where it sits and where it goes next. That usually shows a handful of people and systems, so the controls land on a defined enclave rather than the whole company. The System Security Plan is written from what we deployed.