DefenseEye.ai

What is CMMC 2.0?

CMMC 2.0 (Cybersecurity Maturity Model Certification version 2.0) is a DoD cybersecurity framework published as 32 CFR Part 170, effective December 16, 2024. It requires all Defense Industrial Base (DIB) contractors to demonstrate specific cybersecurity practices to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). CMMC 2.0 has three levels: Level 1 (17 practices, self-attestation), Level 2 (110 NIST SP 800-171 practices, C3PAO assessment), and Level 3 (NIST SP 800-172 practices, government assessment). The DoD estimates over 80,000 DIB companies need CM

What is CMMC Level 2 and who needs it?

CMMC Level 2 requires full implementation of all 110 security practices from NIST SP 800-171 Rev. 2 and applies to any DoD contractor or subcontractor that processes, stores, or transmits Controlled Unclassified Information (CUI). Level 2 certification requires a triennial assessment by an accredited Certified Third-Party Assessment Organization (C3PAO). Contractors must also submit their SPRS score to sprs.apps.mil before DoD contract award per DFARS 252.204-7019. Source: DODCIO, NIST SP 800-171 Rev. 2 (csrc.nist.gov).

What is an SPRS score?

The SPRS (Supplier Performance Risk System) cybersecurity score measures a defense contractor's compliance with NIST SP 800-171. Calculated per the DoD Assessment Methodology, it starts at 110 points and deducts 1, 3, or 5 points for each unimplemented control. The score can be negative. Contractors must self-assess and submit their score to sprs.apps.mil before DoD contract award (DFARS 252.204-7019). False SPRS submissions can trigger False Claims Act liability. Source: DoD Assessment Methodology (dodcio.defense.gov).

What is a C3PAO?

A C3PAO (Certified Third-Party Assessment Organization) is a company authorized by the Cyber AB to conduct official CMMC Level 2 assessments using NIST SP 800-171A procedures. Results are submitted to DoD's eMASS system. Find authorized C3PAOs at cyberaccreditation.us/marketplace. Only C3PAOs can issue CMMC Level 2 certifications — consultants and RPOs cannot. Source: Cyber AB (cyberaccreditation.us), DFARS 252.204-7021.

What is DefenseEye and how does it help with CMMC?

DefenseEye is a CMMC advisory and compliance automation firm serving the U.S. Defense Industrial Base. DefenseEye's CMMC Lens platform automates NIST 800-171 evidence collection, SSP/POA&M generation, and SPRS score tracking from Microsoft cloud environments. DefenseEye's certified advisors provide gap assessments, remediation support, and C3PAO assessment preparation — reducing time to readiness by 60–80%.