These are the eight questions that arrive after a prime sends a flow-down letter — answered the way we would answer them on the phone, without the consultant fog. Nothing here is legal advice, and none of it needs your email address.
Partly. On July 13, 2026 DoD suspended the Phase 2 move to mandatory third-party certification, pending a 60-day review. The self-assessment, the SPRS score, the annual affirmation, and DFARS 252.204-7012 were not paused.
Read the full answer →If a DoD contract's requirements reach you through a prime or a higher-tier supplier, CMMC reaches you too. Being three tiers down changes nothing except who tells you about it.
Read the full answer →Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21 and is self-assessed annually. Level 2 covers all 110 NIST SP 800-171 requirements, and for many CUI contracts it is assessed by a third party. What you hold decides which one you are.
Read the full answer →A System Security Plan describes your systems, their boundary, and how each of the 110 requirements is actually met. You can absolutely write your own — most shops stall because it takes 60 to 100 pages of specific, evidenced detail, not because it is secret work.
Read the full answer →A C3PAO is an accredited third-party organization that performs the certification assessment. Quoted costs for a small, tightly scoped shop commonly land in the tens of thousands, and scope drives the number more than headcount does.
Read the full answer →The Basic Assessment score runs from 110 down to −203. It starts at 110 and subtracts 1, 3, or 5 points for each unimplemented requirement, so a negative score is arithmetic, not a scandal — most shops that have never done this start below zero.
Read the full answer →Do not answer with a number you cannot evidence. Read which clauses and level they cited, find out whether CUI actually reaches you, score yourself honestly, and reply with a score plus a dated plan.
Read the full answer →If it stores, processes, or transmits CUI, yes. For most shops the CAD workstation and the ERP that carries government purchase orders are the two systems that pull the boundary wider than expected.
Read the full answer →Usually the marked drawing, the technical data package, export-controlled specifications, and any purchase order carrying that information. The marking is on the document — the obligation follows the content wherever you copy it.
Read the full answer →The calculator walks all 110 requirements with the official DoD weights and gives you a defensible SPRS score in about twenty minutes. It is free and it stores nothing unless you ask for the report.
Get your free SPRS score