Get Ready for CMMC Requirements Now
CMMC is no longer a future requirement—it's now a formal DoD program with contract enforcement underway. Learn what contractors must do right now to stay compliant and competitive.
Jan 18, 2025
4 min read
CMMC Compliance & NIST 800-171 Services
Minnesota's only C3PAO-authorized organization for official CMMC Level 2 assessments.
(651) 448-9900Understanding CMMC Levels
The Cybersecurity Maturity Model Certification (CMMC) framework has three levels of cybersecurity requirements
Level 1
Foundational
17 Practices
Self-Assessment
Basic cybersecurity hygiene practices to protect Federal Contract Information (FCI)
- Protect Federal Contract Information (FCI)
- Annual self-assessment required
- Basic cyber hygiene practices
- Entry-level compliance for DoD contractors
Level 2
Advanced
110 Practices
C3PAO Assessment Required
Comprehensive protection for Controlled Unclassified Information (CUI) aligned with NIST SP 800-171
- Protect Controlled Unclassified Information (CUI)
- Third-party C3PAO assessment required
- NIST SP 800-171 compliance
- Required for most DoD prime and sub-contractors
Level 3
Expert
134 Practices (110 + 24)
Government-Led Assessment
Level 2 requirements plus 24 additional NIST SP 800-172 controls for Advanced Persistent Threat (APT) protection
- All 110 NIST SP 800-171 controls (Level 2)
- 24 additional NIST SP 800-172 controls
- Advanced Persistent Threat (APT) protection
- Required for critical national security programs
Free ResourceNew!
CMMC Executive Toolkit
Secure board members buy-in for your company's CMMC journey. Perfect for C-Suite presenting to boards members or owners.
30-page Executive Guide (5,000+ words) — Written in business terms, not tech jargon. "Cybersecurity" used only 28 times.
Presentation Decks — 3 formats including 7-minute board-ready presentation
Speaking Scripts — Prepared talking points for executives
Video Walkthrough — Step-by-step guidance on using the toolkit
C3PAO-Certified Services
Comprehensive CMMC Compliance Services
As an ethical C3PAO, we can either help you get ready (consulting/managed environment/implementation) or perform the formal assessment — but never both Pre-Assessment & Assessment services for the same client.
C3PAO Certified Assessment
Formal CMMC Level 2 Assessment
Our 4-phase assessment process ensures comprehensive evaluation and successful certification
Phase 1
Preliminary Proceedings
1
- Assessment scope definition
- Gage Code review
- Schedule coordination
- On-site/remote mix determination
- Staffing and logistics planning
- Contract execution
- Readiness determination (Go/No Go)
- Pre-assessment form QA & eMASS upload
Phase 2
Control Validation
2
- Validation of 110 security controls
- Verification of 320 assessment objectives
- Daily checkpoint minutes
- Evidence repository management
- Remote validation activities
- On-site validation activities
Phase 3
Assessment Results
3
- Comprehensive assessment write-up
- Final determination
- Results out-brief meeting
- Certificate award (Final/Conditional/None)
- QA review process
- Results uploaded to eMASS
Phase 4
Reassessment (If Needed)
4
- Remediation of un-met 1-point objectives
- Updated assessment write-up
- Final determination
- Results out-brief meeting
- Certificate award
- QA review and eMASS upload
Pre-Assessment
Prepare your organization for CMMC certification with our comprehensive pre-assessment services
Readiness Services
Individual pre-assessment services to prepare your organization
Choose the services that fit your needs
- Gap AnalysisVerification of your environment with detailed feedback on CMMC journey readiness
- Mock AssessmentConduct an assessment and give no feedback
- SPRS Score AssessmentSupplier Performance Risk System evaluation and guidance
Managed CUI Environments
Package
Complete compliance package with ongoing support
Comprehensive turnkey solution
- Compliant EnclaveSecure CMMC-compliant environment for DoD business operations
- Continuous Monitoring24/7 monitoring and support of your compliant enclave
- Documentation PackageComplete policies and procedures supporting your CMMC environment
- FedRAMP Disaster RecoveryCompliant backup and recovery services ensuring business continuity
- Assessment POCDedicated Point of Contact during your CMMC assessment
- Annual Self-AssessmentYearly compliance verification services
- SPRS Upload AssistanceExpert guidance uploading scores to https://piee.eb.mil/
Consulting & Implementation
Individual consulting and implementation services
Select the services you need
- Environment ReconfigurationOptimization of existing CUI environment components
- Component InstallationAddition of necessary security and compliance infrastructure
- Policy DevelopmentCreation and enhancement of CMMC-related policies and procedures
- Artifact CollectionOrganization of assessment evidence and documentation
- Assessment POCDesignated contractor representative for assessor coordination
- Incident Response ExercisesOngoing tabletop exercises to maintain readiness
F-16 Fighting Falcon - Advanced defense systems require advanced cybersecurity
U.S. Air National Guard photo
MQ-9 Reaper - Protecting Controlled Unclassified Information (CUI)
U.S. Air Force photo
Continuous Monitoring
CMMC-Aligned Continuous Monitoring
Maintaining CMMC compliance isn't a one-time event—it's an ongoing commitment. Our continuous monitoring services ensure your security posture remains assessment-ready 24/7/365, with automated compliance tracking and real-time threat detection specifically designed for NIST 800-171 controls.
What is Continuous Monitoring?
CMMC continuous monitoring is the automated, real-time assessment of your security controls to ensure ongoing compliance with NIST 800-171 requirements. Unlike the C3PAO assessment that happens every three years, continuous monitoring provides daily verification that your 110 security controls remain properly configured and effective.
Think of it as a "health monitor" for your compliance posture—detecting configuration drift, unauthorized changes, failed security controls, and emerging vulnerabilities before they become assessment findings or security incidents.
Early Detection
Identify security control failures, configuration drift, and compliance gaps immediately—not months later during an audit. Receive automated alerts when controls deviate from CMMC requirements.
Assessment Ready
Maintain continuous readiness for your C3PAO assessment. Our dashboards provide real-time evidence that you're meeting all 110 NIST 800-171 controls, reducing assessment preparation time from months to days.
Audit Evidence
Automatically collect and organize audit logs, security events, and compliance artifacts required for CMMC assessment. Quarterly compliance reports document your ongoing adherence to security controls.
What We Monitor
Security Control Effectiveness
- • Multi-factor authentication (MFA) enforcement
- • Password complexity and rotation policies
- • Firewall rule configurations
- • Endpoint protection status (antivirus, EDR)
- • Patch management compliance
- • Encryption status (data at rest and in transit)
Access Controls & Authentication
- • User access permissions and role assignments
- • Failed login attempts and account lockouts
- • Privileged account usage
- • Unauthorized access attempts
- • Account lifecycle management (provisioning/deprovisioning)
- • Session timeouts and inactivity controls
Threat Detection & Response
- • Malware and ransomware detection
- • Suspicious network traffic patterns
- • Data exfiltration attempts
- • Brute-force attack detection
- • Anomalous user behavior
- • Security incident response workflows
Audit Logging & Compliance
- • System and application audit logs
- • Security event log collection and retention
- • Configuration change tracking
- • CUI access and modification logs
- • Backup success/failure monitoring
- • Quarterly compliance reporting
Our continuous monitoring services are included in all Managed CUI Environment packages and available as a standalone service for organizations managing their own CMMC compliance.
Free CMMC Budget Planning Tools
Before engaging any consultant, understand the costs. Our free calculators provide instant estimates with no sales pressure.
CFO Budget Planner
Comprehensive budget analysis with scenario planning (conservative/likely/aggressive). Ideal for detailed financial planning and board presentations.
Try CFO Planner →Quick ROI Calculator
2-minute estimate of CMMC compliance costs based on your organization size and current state. Perfect for initial scoping and executive buy-in.
Try ROI Calculator →Frequently Asked Questions
Common questions about CMMC compliance and our assessment services
What is a C3PAO?
A C3PAO (Certified Third-Party Assessment Organization) is an independent organization authorized by the CMMC Accreditation Body to conduct official CMMC Level 2 assessments. BomberJacket Networks is Minnesota's only C3PAO-authorized organization, meaning we're the only local company qualified to conduct official CMMC assessments that result in CMMC certification located in Minnesota.
How long does a CMMC assessment take?
Assessment timelines vary based on your organization's size and complexity. A CMMC Level 2 assessment can be as short as 3.5 days for an all virtual enclave environment next to weeks for a Prime that has multiple sites with CUI on premise gear and printing. The DoD requires C3PAOs to have three CCAs assigned to each assessment: a lead assessor, second CCA, and a QA assessor.
What's the difference between CMMC Level 1, 2, and 3?
Level 1 (17 practices): Basic cybersecurity hygiene to protect Federal Contract Information (FCI). Requires annual self-assessment.
Level 2 (110 practices): Comprehensive protection for Controlled Unclassified Information (CUI) aligned with NIST SP 800-171. Requires C3PAO assessment every 3 years. This is the most common level for DoD contractors.
Level 3 (134 practices): Advanced protection against APTs, including all Level 2 requirements plus 24 additional NIST SP 800-172 controls. Required for critical national security programs with government-led assessment.
Do I need CMMC certification to bid on DoD contracts?
If your contract involves CUI (Controlled Unclassified Information), you'll need CMMC Level 2 certification before a contract can be awarded. The DoD is phasing in CMMC requirements, with full enforcement expected in 2025-2026. Even if not yet required for your current contracts, getting certified now demonstrates commitment to cybersecurity and positions you competitively for future contracts.
What's included in your pre-assessment service?
Our pre-assessment includes a comprehensive gap analysis against all 110 NIST SP 800-171 practices, readiness scoring, prioritized remediation roadmap, and executive summary for leadership. We use the same assessment methodology as the formal C3PAO assessment, so you'll know exactly where you stand. Most organizations find 20-40 gaps initially, and our pre-assessment helps you address these systematically before the official assessment.
Ready to Start Your CMMC Journey?
Schedule an executive briefing to discuss your compliance needs and receive a customized service recommendation.
Related Resources
Latest Articles
View AllRead Article
CMMC 48 CFR Final Rule: What Contractors Must Do Now
The CMMC 48 CFR Final Rule is now officially in effect. Learn what defense contractors must do to stay eligible for DoD contracts during CMMC Phase 1.
Jan 17, 2025
3 min read