Do I need CMMC to handle CUI?

Yes — new DoD contracts that involve Controlled Unclassified Information require CMMC Level 2, which maps to the 110 NIST 800-171 controls.

How long does CMMC certification take?

It varies, but the path is: scope CUI, self-assess and submit to SPRS, write the SSP and POA&M, secure the gaps, then a C3PAO assessment. ForteFide compresses the technical work from months to hours.

Does ForteFide produce evidence a C3PAO accepts?

Yes — it produces signed, tamper-proof evidence bound to your license, plus a printable attestation for the organizational controls.

CMMC Level 2 · for contractors who handle CUI

Handle CUI? Here's how to become CMMC certified — the whole path, and where you stand.

The DoD now requires contractors who handle CUI to prove they protect it. It's confusing, the clock is running — and almost nobody's done: only about 1 in 100 feel ready. So you're not behind. Here's the entire path in plain English, and a free scorecard that shows where you stand today, no commitment.

Run the free scan — see where you stand Still have questions? Let's talk

What is CMMC, and why now?

CMMC — Cybersecurity Maturity Model Certification — is how the Department of Defense makes sure its contractors actually protect the sensitive information they handle. If your company touches Controlled Unclassified Information (CUI) — the contract details, specs, and drawings the government marks as sensitive-but-unclassified — the DoD now wants independent proof you're securing it.

The rule that puts CMMC into contracts took effect November 10, 2025 and phases in over three years. As it rolls out, the short version becomes true: no certification, no contract.

The reassuring part: almost nobody is finished. Roughly 99% of the contractors who need it aren't certified yet — most are figuring it out right now, same as you.

Which level do you need?

There are three, and most companies that handle CUI land on Level 2.

Level 1 — for basic contract info, not CUI. A smaller set of safeguards you assess yourself.
Level 2 — for CUI. This is the big one: 110 security requirements from NIST SP 800-171, and for most contracts an independent assessment by an authorized third party (a C3PAO). Around 80,000 contractors need it.
Level 3 — the highest tier, for the most sensitive programs. Adds enhanced requirements on top of Level 2 and is assessed by the government itself.

Not sure which applies? It comes down to one question: does the information in your contracts get marked as CUI? If yes, plan for Level 2.

Read this before you sign

You don’t just post your score — you sign it. And the False Claims Act is what you sign under.

Notice the word affirm back there. When you post your SPRS score, a senior official signs their name to it. To the government, that signature isn’t a formality — it’s a promise that the number is true.

If it isn’t — if a control is marked met that isn’t, and you knew, or looked the other way, or never actually checked — that’s not a paperwork slip. Under the False Claims Act, an inflated score tied to a federal contract can become a false claim. What that carries is steep:

Triple damages. The government can recover three times the damages it says it suffered on the affected contract.
A penalty on every invoice. Each claim billed under a false attestation draws its own civil penalty — currently over $14,000, and up to more than $28,000, adjusted for inflation every year. Invoice monthly for two years and that’s two dozen separate penalties, stacked on top of the triple damages.
It’s personal. The official who signs is on the hook — and “knowing” isn’t only deliberate lying. It includes reckless disregard and deliberate ignorance. “I didn’t know” can be the violation, not the defense.
Your own people can bring it. An employee can file a whistleblower suit on the government’s behalf and keep a share of what’s recovered. The Justice Department’s Civil Cyber-Fraud Initiative exists specifically to pursue false cybersecurity attestations — and it is active right now.

None of this is hypothetical — a single cyber-fraud settlement has already reached $11.25 million. And the pause on third-party assessments doesn’t lower this risk. It raises it: with no assessor checking your work first, nobody catches an inflated score until the government does.

This is the whole reason ForteFide is built the way it is. It can’t make the False Claims Act go away — nothing can, and anyone who tells you otherwise is selling you a new problem. What it does is let you sign a number you can prove: all 110 controls checked against your real systems, with signed, tamper-evident evidence you can put in front of a skeptical reviewer, one control at a time. The honest score — and the receipts to back it.

General information, not legal advice — for how the False Claims Act applies to you, talk to qualified counsel. Sources: False Claims Act, 31 U.S.C. §§ 3729–3733; DFARS 252.204-7012; 32 CFR 170.24.

What does Level 2 actually require?

110 practices, across 14 families. In plain English, they ask you to have control over:

Who can get in — accounts, least privilege, multi-factor authentication.
What's watched — audit logs and monitoring, so you know who did what.
How things are set up — hardened configurations, only the services you need, patching.
How data is protected — encryption in transit and at rest, secure remote access.
What you do when something goes wrong — an incident response plan you've actually tested.
The paperwork behind it — policies, training records, and a written security plan.

None of it is exotic. Most of it is good IT hygiene, written down and proven.

The steps — and why each one exists

Scope it. Find exactly where CUI lives and flows. Why: you only have to protect what's in scope — getting this right shrinks the whole job.
Score yourself (SPRS). Assess against the 110 and submit a score to the DoD's SPRS system. Why: the DoD requires a current score on file — it's your baseline.
Write the SSP and POA&M. A System Security Plan documents how each control is met; a Plan of Action & Milestones lists the gaps and how you'll close them. Why: the assessor examines these first — no security plan, no assessment.
Secure the gaps. Actually implement the missing controls — the technical settings and the policies. Why: a plan isn't security; the assessor checks the real system.
Get assessed by a C3PAO. An authorized third party evaluates you. Why: for CUI you generally can't just attest to yourself — independent proof is the point.
Certify. Pass and you're certified. Score at least 88 of 110 with only certain gaps remaining and you can earn a conditional status — with 180 days to close them. Miss one of the critical controls, though, and there's no shortcut.

How hard is this, honestly?

We won't pretend it's a weekend. The real picture:

Most people aren't close yet. The median score contractors submit is about 60 out of 110. You need 88 for a conditional pass and 110 to be fully certified.
Not every control is equal. The critical ones — multi-factor authentication, encryption, patching, boundary firewalls — have no do-over: they must be met outright, with no partial credit and no plan-to-secure-later. Every control counts toward your score; the high-weight ones count absolutely.
The work splits in two. Most of the 110 are technical — system and configuration settings that can be assessed and secured with the right tooling. The rest are organizational — policies, training, physical measures — finite, but you have to write and do them.
Assessors are scarce. There are fewer than 100 authorized assessment firms, and lead times run 6 to 18 months. The queue only gets longer as the deadline nears — the real argument for starting now.

The honest summary: it's real, it's finite, and the earlier you see your actual gaps, the smaller the surprise.

Where DenseDefense comes in

This is the part we made easy. Start by seeing exactly where you stand — for free, no sales call.

Scan free. Run ForteFide against your systems and get your real score across all 110 controls in an afternoon, not a quarter.
Secure the technical gaps. For the controls that can be remediated, ForteFide does it — and re-checks to prove it's actually secured.
Walk in with proof. It seals the result into signed, tamper-proof evidence your assessor accepts. Everyone else stops at the paperwork; we secure what's vulnerable.

You don't have to commit to anything to find out where you are. See your starting line, then decide.

Run the free scan — see where you stand Still have questions? Let's talk