The Cybersecurity Maturity Model Certification (CMMC) is no longer a future requirement — it is here. The Department of Defense finalized the CMMC 2.0 rule in late 2024, and CMMC requirements are now appearing in DoD contract solicitations. For Atlanta-area government contractors, this means the window to prepare is closing fast.
Metro Atlanta is home to a significant defense contractor community. Proximity to Fort Gillem, Robins Air Force Base, and numerous federal agencies means that hundreds of small and mid-size businesses in the region hold or pursue DoD contracts that involve Controlled Unclassified Information (CUI). Every one of these businesses will need to demonstrate CMMC compliance to continue competing for defense work.
What CMMC Requires
CMMC 2.0 establishes three levels of cybersecurity maturity. The level required for a given contract depends on the type of information the contractor handles.
Level 1: Foundational
Level 1 applies to contractors that handle Federal Contract Information (FCI) but not CUI. It requires implementation of 17 basic cybersecurity practices drawn from FAR 52.204-21.
These are fundamental controls:
- Limit information system access to authorized users - Limit system access to the types of transactions and functions that authorized users are permitted to execute - Control information posted or processed on publicly accessible information systems - Identify, report, and correct information and system flaws in a timely manner - Provide protection from malicious code at appropriate locations - Update malicious code protection mechanisms when new releases are available - Perform periodic scans of information systems and real-time scans of files from external sources
Level 1 compliance is validated through annual self-assessment. No third-party certification is required.
Level 2: Advanced
Level 2 applies to contractors that handle CUI. It requires implementation of all 110 security controls defined in NIST SP 800-171 Revision 2.
This is where the compliance effort becomes substantial. NIST 800-171 covers 14 control families:
- Access Control (22 controls) - Awareness and Training (3 controls) - Audit and Accountability (9 controls) - Configuration Management (9 controls) - Identification and Authentication (11 controls) - Incident Response (3 controls) - Maintenance (6 controls) - Media Protection (9 controls) - Personnel Security (2 controls) - Physical Protection (6 controls) - Risk Assessment (3 controls) - Security Assessment (4 controls) - System and Communications Protection (16 controls) - System and Information Integrity (7 controls)
For contracts involving critical or sensitive CUI, Level 2 requires assessment by an authorized CMMC Third-Party Assessment Organization (C3PAO). For other CUI contracts, annual self-assessment may be sufficient, but the contractor must still implement all 110 controls and affirm compliance in the Supplier Performance Risk System (SPRS).
Level 3: Expert
Level 3 applies to contractors handling the most sensitive CUI in high-threat environments. It adds controls from NIST SP 800-172, which are designed to protect against advanced persistent threats. Level 3 requires government-led assessment by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
Most small and mid-size Atlanta contractors will need to achieve Level 1 or Level 2. Level 3 applies primarily to prime contractors and major defense programs.
Where Atlanta Contractors Typically Fall Short
Based on industry data from C3PAO assessments and self-assessment reviews, the most common compliance gaps among small and mid-size contractors include:
System Security Plans Are Missing or Incomplete
NIST 800-171 requires a System Security Plan (SSP) that describes the system boundary, how each of the 110 controls is implemented, and any planned remediation for controls that are not yet fully implemented. Many contractors either have no SSP or have a generic template that does not accurately reflect their environment.
A credible SSP requires a thorough understanding of where CUI flows in your environment — which systems store it, which users access it, how it is transmitted, and where it exits your control.
Plans of Action and Milestones Are Stale
For controls that are not fully implemented, contractors must maintain a Plan of Action and Milestones (POA&M) documenting the gap, the remediation plan, responsible parties, and target completion dates. Many contractors created POA&Ms years ago and have not updated them or made progress on the remediation activities.
Under CMMC 2.0, assessors will evaluate whether POA&Ms are realistic and whether the contractor is making meaningful progress. An indefinitely open POA&M with no evidence of remediation activity will not be acceptable.
Access Controls Are Weak
The Access Control family has 22 requirements and is the area where most contractors have the most gaps. Common issues include:
- No formal access control policy or procedures - Shared accounts used by multiple employees - Excessive administrative privileges granted to users who do not need them - No process for revoking access when employees change roles or leave the organization - No enforcement of session lock after inactivity - Remote access without multi-factor authentication
Audit Logging Is Inadequate
NIST 800-171 requires that organizations create and retain system audit logs and ensure they are reviewed regularly. Many contractors have logging enabled on some systems but not all, do not have centralized log management, and never review logs for security events.
Without comprehensive audit logging, you cannot detect unauthorized access to CUI, investigate security incidents, or provide evidence of compliance to assessors.
CUI Boundaries Are Not Defined
Before you can protect CUI, you must know where it lives. Many contractors have CUI scattered across email, shared drives, laptops, USB drives, personal cloud storage, and third-party collaboration platforms without a clear understanding of the full scope.
Defining your CUI boundary is the essential first step in CMMC compliance. Every control implementation depends on knowing which systems are in scope.
Building a CMMC Compliance Roadmap
Phase 1: Scoping and Gap Assessment (Weeks 1-4)
- Identify all contracts that require CMMC compliance and determine the required level - Map CUI data flows to identify every system, application, and user that touches CUI - Define the system boundary for your CMMC assessment scope - Conduct a gap assessment against all applicable NIST 800-171 controls - Calculate your current SPRS score
Phase 2: Remediation Planning (Weeks 5-8)
- Develop or update your System Security Plan with accurate descriptions of your environment and control implementations - Create or refresh your POA&M with realistic timelines and assigned responsibilities for each gap - Prioritize remediation based on risk impact and assessment timeline - Identify technology investments needed (SIEM, EDR, MFA, encrypted email, etc.) - Estimate budget and resource requirements for full remediation
Phase 3: Technical Remediation (Weeks 9-24)
- Implement missing access controls including role-based access, MFA, and session management - Deploy or upgrade audit logging and SIEM capabilities - Encrypt CUI at rest and in transit - Implement endpoint detection and response across all in-scope systems - Configure network segmentation to isolate CUI processing systems - Establish secure backup and recovery for CUI systems - Deploy vulnerability management and patch management processes
Phase 4: Policy and Training (Weeks 20-28)
- Develop or update all required policies and procedures across the 14 control families - Conduct security awareness training for all personnel with access to CUI - Implement role-specific training for system administrators and CUI handlers - Document all training with evidence suitable for assessor review
Phase 5: Assessment Preparation (Weeks 28-36)
- Conduct a mock assessment using the CMMC Assessment Guide methodology - Review and update SSP and POA&M based on mock assessment findings - Gather and organize evidence artifacts for each control - Submit updated SPRS score - Engage a C3PAO and schedule your formal assessment (if required)
Technology Investments to Expect
Most small contractors will need to invest in several technology areas to achieve CMMC Level 2:
- Security Information and Event Management (SIEM): $500 to $2,000 per month for a cloud-based solution appropriate for small organizations - Endpoint Detection and Response (EDR): $8 to $15 per endpoint per month - Multi-Factor Authentication: typically included in Microsoft 365 Business Premium ($22/user/month) or comparable platforms - Encrypted email: $3 to $8 per user per month - Vulnerability scanning: $200 to $500 per month - Managed IT and security services: $150 to $300 per user per month for comprehensive CMMC-aligned support
The total investment varies significantly based on your current maturity level and the size of your CUI environment. Contractors starting from a low baseline should plan for $50,000 to $150,000 in first-year remediation costs, with ongoing annual costs of $30,000 to $80,000 for a small to mid-size organization.
The Cost of Not Preparing
Contractors that cannot demonstrate CMMC compliance will be ineligible to bid on DoD contracts that require certification. This is not a theoretical risk — it is a contractual requirement that primes will flow down to subcontractors.
For Atlanta contractors whose revenue depends on defense work, loss of contract eligibility is an existential business risk. Starting the compliance process now, even if your timeline allows 12 to 18 months before assessment, gives you the runway to remediate gaps methodically rather than scrambling under deadline pressure.
Get Started
Norvet MSP helps Atlanta government contractors assess their current CMMC readiness, build compliance roadmaps, and implement the technical controls required for Level 1 and Level 2 certification. Contact us for a free CMMC readiness assessment — we will evaluate your current posture, calculate your SPRS score, and give you a clear, budgeted remediation plan.
Need help with Cybersecurity?
Our cybersecurity team helps businesses like yours stay protected with 24/7 threat monitoring, compliance frameworks, and incident response.
