CMMC Compliance for DoD Contractors
Readiness for CMMC Level 1 and Level 2: a gap assessment against NIST SP 800-171, a System Security Plan and plan of action, the controls implemented, and the evidence an assessor expects to see.
Overview
CMMC is now in contracts. A supplier that cannot show its score will not be a supplier for long.
The Cybersecurity Maturity Model Certification program is the Department of Defense's way of making sure every company in its supply chain protects the information it handles. Level 1 applies to anyone handling Federal Contract Information and is an annual self-assessment against basic safeguarding practices. Level 2 applies to anyone handling Controlled Unclassified Information and aligns with the 110 security requirements of NIST SP 800-171; for most contracts it requires an assessment by an accredited third-party assessor, and the requirement is being phased into contracts now.
For a small manufacturer or engineering firm the hard part is not understanding the practices. It is implementing them across real systems with a small team, writing the System Security Plan that describes how each one is met, tracking what is not yet met in a plan of action, and producing evidence an assessor will accept. We do that work inside the managed IT program: scoping which systems touch CUI so the boundary is as small as it can honestly be, implementing the controls — MFA, logging, encryption, configuration baselines, access control, media handling — and generating the evidence as the systems run.
We prepare you for the assessment and sit beside you during it. We are not a certified assessor, and no managed IT provider should claim to issue your certification.
Capabilities
What's included
- Scoping and gap assessmentWhich systems and people handle FCI or CUI, assessed against NIST SP 800-171 with a ranked gap list.
- System Security Plan and POA&MThe SSP that describes how each requirement is met and the plan of action for what is still open.
- Control implementationMFA, logging, encryption, configuration baselines, access control and incident response, delivered through the platform.
- SPRS score and self-assessmentYour NIST SP 800-171 score calculated honestly and submitted to the Supplier Performance Risk System.
- Evidence collectionScreenshots, reports and logs mapped to each practice, kept current rather than gathered the week before.
- Assessment preparation and supportMock assessment, remediation of findings, and our team alongside yours when the assessor arrives.
How It Works
Delivered through managed IT
Configuration baselines, patch status, endpoint protection, logging and access changes for in-scope systems are managed and recorded in NinjaOne, our enterprise management platform, which is how the evidence for dozens of the 110 practices is produced as a by-product of running the systems. Where a requirement calls for a specific capability — a SIEM, FIPS-validated encryption, a CUI enclave in Microsoft 365 GCC High — we design and implement it.
Why Atlas
Secure. Reliable. Responsive.
Flat monthly fee
Predictable per-device pricing. No surprise invoices and no hourly meter running while your team waits for help.
Proactive, not reactive
Monitoring, patching, and automation run around the clock — so most issues are resolved before your staff ever notice them.
Responsive & accountable
One team that knows your environment and answers fast. You reach a real technician, not a ticket queue in another time zone.
Month-to-month
We earn your business every month. No multi-year lock-in — you stay because the service works, not because a contract traps you.
Common Questions
Questions we get asked
Do we need Level 1 or Level 2?
It depends on what information you handle under the contract. If you only handle Federal Contract Information — the ordinary information in and about a government contract — Level 1 applies and is an annual self-assessment. If you handle Controlled Unclassified Information, which includes most technical data and drawings, Level 2 applies. Your contract and your prime should say which; we help you read it.
Can you certify us?
No, and be wary of anyone who says they can. Level 2 certification for most contracts is issued after an assessment by a Certified Third-Party Assessment Organization accredited under the program. Our role is to get you ready — controls, documentation, evidence, a mock assessment — and to support you during the real one. Keeping the roles separate is also what the program expects.
How long does it take to become assessment-ready?
It depends on where you start and how small the CUI boundary can be made. A firm with managed IT already in place and a tightly scoped enclave can be ready in a matter of months; one with unmanaged systems, no documentation and CUI spread across every laptop takes longer. The gap assessment gives you a realistic timeline before you commit to the rest.
What is a SPRS score?
A score derived from your self-assessment against NIST SP 800-171, submitted to the Department of Defense's Supplier Performance Risk System. Primes and contracting officers can see it. It must be an honest reflection of your current state — a perfect score with no supporting evidence is a liability, not an asset — and it must be kept current as you close gaps.
Do we need Microsoft 365 GCC High?
Not always. GCC High is required when the data or the contract calls for it — commonly ITAR-controlled information or specific DFARS clauses — and it is more expensive and more work to migrate to. Many Level 2 contractors can meet the requirements in commercial Microsoft 365 with the right configuration. Scoping tells us which, and we will not move you unless the requirement is real.
Secure. Reliable. Responsive.
Book a consultation and we’ll map out a managed IT plan for your business. contact@atlasbm.net · (417) 619-6518