Where are we in
the CMMC process?
Two questions bring most defense suppliers to this page. Is my company ready for CMMC, and what does CMMC mean for my company. This page answers both in plain language and then gives you a planning tool that answers them for your own situation. It does not rank you, it does not predict an outcome, and it produces no number. It tells you the level the conversation is likely about, whether you are in readiness, assessment or certification, and what is open in what order.
The problem: nobody can tell you where they are
Ask a defense supplier where it is in the CMMC process and the answer is almost never a position. It is a purchase, a vendor name, a half-finished document, or a date somebody mentioned on a call. That is not evasion. It is what happens when three different things are all called the same thing.
Readiness, assessment and certification are three separate concepts, and most confusion in this market comes from treating them as one. Readiness is the work you do. Assessment is the evaluation of that work. Certification is the outcome of the evaluation. A company that thinks it is buying certification is usually buying readiness support, and a company that thinks it has finished readiness has often only finished the paperwork that describes it.
The second problem is scope. Before any of that matters, a company has to know what information it actually handles, and where that information lives. A great many companies are working hard on the wrong boundary.
What usually goes wrong
- Scope is never settledThe company starts control work before deciding whether the whole estate or a separated enclave is in scope. Everything built against the larger answer has to be justified later, and some of it has to be rebuilt.
- The plan describes an intentionA System Security Plan is written describing how the environment ought to work. An assessment looks at how it does work. Where the two differ, the plan is the thing that gets corrected, usually under time pressure.
- Evidence is assembled afterwardsArtifacts are gathered in the weeks before an assessment rather than collected as the controls run. Reconstructed evidence is the most common reason readiness work has to be done twice.
- External providers are assumedThe contractor believes the managed service provider covers a requirement. The provider believes it was never in the agreement. Nobody finds the gap until somebody asks for it in writing.
- The Plan of Action becomes a parking lotItems go on a Plan of Action and Milestones without owners or dates, and the list stops being a plan. The rule limits what may sit on one and for how long, which makes an unmanaged list a liability rather than a shelter.
- A level is assumed rather than readA company plans for a level because a peer mentioned it. The requirement that binds you is the one written into your contract, and reading it is free.
- Certification is treated as purchasableIt is not. Salian is not a C3PAO and does not certify anyone. An authorized C3PAO or the Department of Defense certifies CMMC status; Salian supports readiness.
What you need to know
What does CMMC mean for my company?
CMMC is the Department of Defense program that checks whether a contractor is actually protecting the government information it holds. It matters to a company when that company holds Federal Contract Information or Controlled Unclassified Information under a defense contract or a subcontract. For a company holding only Federal Contract Information, it usually means implementing the basic safeguarding requirements in FAR 52.204-21 and affirming that yourself. For a company holding Controlled Unclassified Information, it means implementing the security requirements in NIST SP 800-171, writing them down in a System Security Plan, and being able to show that they operate. The specific requirement is set by the contract, not by a vendor and not by this page.
What is the difference between CMMC readiness and CMMC certification?
They are three separate things and confusing them is expensive. Readiness is the internal work: scoping the boundary, building the environment, writing the System Security Plan, running a Plan of Action and Milestones, and collecting evidence. Assessment is the formal evaluation of that work against the CMMC Program in 32 CFR Part 170, self-assessed at some levels and performed by an authorized third party at others. Certification is the outcome of an assessment, recorded against the company. A consultant can help with the first, prepare you for the second, and grant none of the third.
What is an enclave strategy?
An enclave strategy means deliberately putting the government information into a separated part of your environment rather than treating the whole company as in scope. A small enclave with its own identity, storage, devices and access rules is usually far cheaper to build, to document and to evidence than an entire corporate estate, because the requirements apply to what is inside the boundary. The trade is operational: people have to work inside the enclave for the work that belongs there, and the boundary has to be real rather than a diagram. The decision belongs at the start, because it changes the size of every task that follows.
Why do external service providers matter for CMMC?
Because responsibility does not transfer with the work. If a managed service provider runs your identity system, or a cloud service holds the data, or a helpdesk has administrative access, those providers sit inside your boundary and their handling of the information is part of your posture. The common failure is an assumption on both sides: the contractor believes the provider covers a requirement, the provider believes it was never in their agreement, and nobody discovers the gap until an assessor asks. The fix is a written split of who meets which requirement, alongside the provider claims themselves, such as whether a cloud offering claims FedRAMP Moderate or equivalency.
What is SPRS?
SPRS is the Supplier Performance Risk System, the Department of Defense system where contractors record the result of a NIST SP 800-171 self-assessment when their contract requires one. What matters for planning is whether a current submission exists and when it was made, because its absence is often the first thing a government customer notices. This page asks whether a submission exists and deliberately does not ask what was submitted.
Check your position
Where are we in the CMMC process?
Twenty planning questions. Answer not sure wherever you genuinely are not sure, and the tool will list it as something to confirm rather than guess at it. Everything runs in your browser, and nothing is sent anywhere unless you ask for a summary at the end.
Methodology
There is no model behind this and nothing is ranked. Each answer is read as one of three things: something that appears to be in place, an open item, or something to confirm. Answers of not sure are never counted against you; they become items to confirm, because the honest planning answer to an unknown is to go and find it. The level shown is a plain-language reading of the information you handle and any level a contract already names, and the requirement is set by the contract rather than by this page. Nothing you enter leaves your browser unless you ask for a summary.
Outputs describe readiness categories and open questions. They are not accreditation, authorization, or certification decisions. Accreditation is determined by the applicable Accrediting Official or Cognizant Security Authority; CMMC certification by an authorized C3PAO or the Department of Defense; system authorization by the Authorizing Official. Do not enter classified information or CUI.
What Salian does
Working out what information is actually in scope, whether an enclave is cheaper than an enterprise-wide boundary for your situation, and what goes inside the line. This is the decision that sets the size of everything after it, and it is the one most often skipped.
Writing the plan against the environment that exists, keeping the Plan of Action and Milestones as a plan with owners and dates, and setting up artifact collection so evidence accumulates as the controls run rather than being reconstructed later.
Putting every provider that touches the boundary into the plan, establishing in writing which requirements they meet and which you meet, and reading a FedRAMP Moderate or equivalency claim for what it actually covers.
A customer-hosted compliance platform for contractors managing CMMC and NIST 800-171 posture, for teams that would rather hold their own compliance data than put it in someone else's cloud.
What Salian does not control
The determination belongs to the government and to the authorized assessment ecosystem, and no consultant, this page included, can make one, predict one or accelerate one.
Salian is not a C3PAO and does not certify anyone.
What binds you is your contract. This page will not tell you that a specific contract requires a specific level, because that sentence is written in the contract and not in a planning tool. Where the honest answer is that CMMC may not apply to your work today, the tool says so and tells you what would change that.
What happens next
- Run the tool above and read the level line and the stage line before anything else. If the level is unresolved, resolving it is the whole of this week's work.
- Settle the boundary. Decide between an enterprise-wide scope and an enclave, write down what is inside it, and stop control work until that is done.
- Work the open items in the order the tool lists them: scoping, documentation, technical controls, evidence, external providers.
- If the people doing this work need the ground covered first, the CMMC Academy teaches the Level 1 practices free, with a certificate of completion.
- If you are also entering cleared work for the first time, map the wider picture in the cleared work readiness map.
- Plan the assessment only when readiness is real. Readiness first, assessment second, certification as the outcome of the second.
- If you would like a person to read the picture with you, send the summary from the tool. We reply within one business day, and we will tell you if the honest answer is that you do not need us yet.
Sources
The authorities behind the questions on this page. All retrieved 2026-09-02. Dates and level definitions here are stated per the rule as published on that date, and nothing below asserts what any particular contract requires. These are a starting point for your own reading and for legal review, not a substitute for either.
Per the rule as published, retrieved 2026-09-02: the CMMC Program rule at 32 CFR Part 170 took effect on 2024-12-16, and the acquisition clause at DFARS 252.204-7021 took effect on 2025-11-10. The rule describes a four-phase implementation running over three years from the effective date of the acquisition rule: a first phase covering Level 1 and Level 2 self-assessment requirements in applicable solicitations, a second phase beginning one year later that adds Level 2 certification assessment requirements, a third phase one year after that adding Level 3, and a fourth phase of full implementation. Which phase your own solicitation falls into, and what it requires of you, is stated in that solicitation.
- 32 CFR 170 (CMMC Program) Cybersecurity Maturity Model Certification Program, DoD. Effective 2024-12-16 per the rule as published. ecfr.gov, title 32, part 170
- DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. ecfr.gov, title 48, 252.204-7012
- DFARS 252.204-7021 Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement. Effective 2025-11-10 per the rule as published. acquisition.gov, DFARS 252.204-7021
- NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. The revision that binds you is the one your contract names. csrc.nist.gov, SP 800-171
- FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems, the basis of the Level 1 practices. ecfr.gov, title 48, 52.204-21
- SPRS Supplier Performance Risk System, the DoD system that records self-assessment submissions. sprs.csd.disa.mil
Talk to Salian
Run the tool first. If it tells you that CMMC may not apply to your work, that is a real answer and you should act on it rather than on a sales conversation. If the open items are real and you would rather not work them alone, send the summary or describe the requirement, and we will tell you which of the three stages you are actually in.