Are Your DoW Contracts at Risk?

CMMC 2.0 (Cybersecurity Maturity Model Certification) is the US Department of War's mandatory cybersecurity framework for defense contractors. It replaced the original 5-level CMMC model in 2021, consolidating to 3 levels aligned with NIST SP 800-171 and NIST SP 800-172. All DoW contractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must meet CMMC requirements to win and keep DoW contracts.

Any company in the Defense Industrial Base (DIB) that bids on or holds DoW contracts is subject to CMMC. This includes prime contractors and subcontractors at all tiers. If your company handles Federal Contract Information (FCI), you need CMMC Level 1. If you handle Controlled Unclassified Information (CUI) — including technical data, export-controlled information, or DoW contract requirements data — you need CMMC Level 2.

CMMC Level 1 covers 17 basic cybersecurity practices from FAR 52.204-21 and allows annual self-attestation by a senior company official. CMMC Level 2 covers all 110 security requirements from NIST SP 800-171 across 14 practice domains. Most DoW contractors with CUI must achieve Level 2, which — for critical programs — requires a third-party assessment by a Certified Third-Party Assessment Organization (C3PAO) every 3 years.

A CMMC readiness assessment from Dragonfli Group is from $325/mo (12 monthly payments) or $3,500 paid once, for the Full Assessment & Dragonfli-Reviewed Report Package: your complete SSP draft, POA&M, gap analysis, and remediation roadmap, every document reviewed by a CMMC Registered Practitioner. What you pay toward the report credits toward your follow-on remediation engagement (pay once and the full credit is available immediately; the monthly plan builds it as each payment clears). A formal C3PAO certification assessment itself typically costs $50,000 to $200,000+ depending on scope.

Traditional cybersecurity firms charge $10,000 to $20,000 for a CMMC readiness assessment, with delivery timelines of 6 to 12 weeks, usually ending in a static PDF report. The same document set, SSP draft, POA&M, gap analysis, and roadmap, is reviewed by a CMMC Registered Practitioner and delivered in days. With Dragonfli it is from $325/mo or $3,500 once, credited in full toward your remediation engagement. Dragonfli is also a CyberAB verified Registered Practitioner Organization, not a generic cybersecurity vendor.

The Supplier Performance Risk System (SPRS) score is a numeric score (-203 to 110) that DoW uses to evaluate a contractor's cybersecurity posture. It is calculated by assessing all 110 NIST SP 800-171 requirements: each unimplemented requirement carries a weighted penalty. A score of 110 means full implementation. Contractors must self-report their SPRS score in the PIEE portal and update it as controls are implemented. A low SPRS score is visible to contracting officers and can affect contract awards.

You can check your CMMC readiness for free with Dragonfli Group's Pulse Check — a roughly 15-minute self-assessment that returns an instant readiness snapshot, no credit card required. For your full estimated SPRS score on the official -203 to 110 scale across all 110 NIST SP 800-171 requirements — plus a draft System Security Plan (SSP), POA&M, gap analysis, and executive summary, each reviewed by a CMMC Registered Practitioner — the Full Assessment & Dragonfli-Reviewed Report Package is $3,500 and completes in about 60-90 minutes. Both start at cmmc.dragonfligroup.com.

CMMC Level 2 assesses all 14 NIST SP 800-171 practice families: Access Control (AC), Awareness and Training (AT), Audit and Accountability (AU), Configuration Management (CM), Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Personnel Security (PS), Physical Protection (PE), Risk Assessment (RA), Security Assessment (CA), System and Communications Protection (SC), and System and Information Integrity (SI).

An RPO (Registered Practitioner Organization) like Dragonfli Group is a CyberAB accredited firm that provides consulting, assessment preparation, and implementation support. An RPO helps you get ready for certification. A C3PAO (Certified Third-Party Assessment Organization) is the independent auditor that conducts the official CMMC Level 2 certification assessment. You work with an RPO to prepare, then engage a C3PAO for the official assessment.

For organizations that are largely compliant with current cybersecurity practices, CMMC Level 2 self-assessment and documentation (SSP, POA&M) can be completed in 30–90 days. For organizations with significant gaps, full technical implementation and third-party certification typically takes 6–18 months depending on scope, budget, and remediation complexity. Starting with a Dragonfli Group readiness assessment is the fastest way to understand your specific timeline.

Non-compliant defense contractors risk losing existing DoW contracts and being ineligible for new awards — CMMC requirements are embedded in contracts via DFARS clause 252.204-7021. The financial exposure goes further: under the U.S. Department of Justice's Civil Cyber-Fraud Initiative, the government uses the False Claims Act to pursue contractors that certified cybersecurity compliance — such as NIST SP 800-171 implementation — they had not actually met. Recent settlements have ranged from roughly half a million dollars to several million, and qui tam (whistleblower) provisions let employees report violations for a share of the recovery. Knowing your real SPRS score, and being able to prove your implementation, is now a financial and legal necessity — not just a compliance checkbox.

Yes — CMMC Level 2 is achievable for small businesses, though the path varies by size and current IT maturity. Many small defense contractors are closer to compliance than they realize. The CMMC Accelerator is specifically designed to guide businesses without dedicated IT or security staff through a plain-English assessment and generate the documentation they need. Dragonfli Group's tiered engagements are sized to your gap profile, so small businesses pay for the help they actually need.