Are Your DoW Contracts at Risk?

CMMC 2.0 (Cybersecurity Maturity Model Certification) is the US Department of War's mandatory cybersecurity framework for defense contractors. It replaced the original 5-level CMMC model in 2021, consolidating to 3 levels aligned with NIST SP 800-171 and NIST SP 800-172. All DoW contractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must meet CMMC requirements to win and keep DoW contracts.

Any company in the Defense Industrial Base (DIB) that bids on or holds DoW contracts is subject to CMMC. This includes prime contractors and subcontractors at all tiers. If your company handles Federal Contract Information (FCI), you need CMMC Level 1. If you handle Controlled Unclassified Information (CUI) — including technical data, export-controlled information, or DoW contract requirements data — you need CMMC Level 2.

CMMC Level 1 covers 17 basic cybersecurity practices from FAR 52.204-21 and allows annual self-attestation by a senior company official. CMMC Level 2 covers all 110 security requirements from NIST SP 800-171 across 14 practice domains. Most DoW contractors with CUI must achieve Level 2, which — for critical programs — requires a third-party assessment by a Certified Third-Party Assessment Organization (C3PAO) every 3 years.

A CMMC readiness assessment from Dragonfli Group is $3,500 for the Full Assessment & Dragonfli-Reviewed Report Package, which includes your complete SSP draft, POA&M, gap analysis, and remediation roadmap — every document reviewed by a CMMC Registered Practitioner. The full $3,500 credits toward your follow-on remediation engagement, which is scoped to your gap profile. A formal C3PAO certification assessment itself typically costs $50,000–$200,000+ depending on scope.

Traditional cybersecurity firms charge $10,000–$20,000 for a CMMC readiness assessment — with typical delivery timelines of 6–12 weeks, usually ending in a static PDF report. The same document set consultants deliver — SSP draft, POA&M, gap analysis, roadmap — is reviewed by a CMMC Registered Practitioner and delivered in days, not months, for $3,500, credited in full toward your remediation engagement. Dragonfli is also a CyberAB verified Registered Practitioner Organization — not a generic cybersecurity vendor.

The Supplier Performance Risk System (SPRS) score is a numeric score (-203 to 110) that DoW uses to evaluate a contractor's cybersecurity posture. It is calculated by assessing all 110 NIST SP 800-171 requirements: each unimplemented requirement carries a weighted penalty. A score of 110 means full implementation. Contractors must self-report their SPRS score in the PIEE portal and update it as controls are implemented. A low SPRS score is visible to contracting officers and can affect contract awards.

CMMC Level 2 assesses all 14 NIST SP 800-171 practice families: Access Control (AC), Awareness and Training (AT), Audit and Accountability (AU), Configuration Management (CM), Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Personnel Security (PS), Physical Protection (PE), Risk Assessment (RA), Security Assessment (CA), System and Communications Protection (SC), and System and Information Integrity (SI).

An RPO (Registered Practitioner Organization) like Dragonfli Group is a CyberAB accredited firm that provides consulting, assessment preparation, and implementation support. An RPO helps you get ready for certification. A C3PAO (Certified Third-Party Assessment Organization) is the independent auditor that conducts the official CMMC Level 2 certification assessment. You work with an RPO to prepare, then engage a C3PAO for the official assessment.

For organizations that are largely compliant with current cybersecurity practices, CMMC Level 2 self-assessment and documentation (SSP, POA&M) can be completed in 30–90 days. For organizations with significant gaps, full technical implementation and third-party certification typically takes 6–18 months depending on scope, budget, and remediation complexity. Starting with a Dragonfli Group readiness assessment is the fastest way to understand your specific timeline.

Non-compliant defense contractors risk losing existing DoW contracts and being ineligible for new awards. CMMC requirements are embedded in contracts via DFARS clause 252.204-7021. Intentional misrepresentation of your CMMC status can also trigger False Claims Act liability. CMMC requirements are now actively enforced across DoW contracts — non-compliance is a direct barrier to DoW business.

Yes — CMMC Level 2 is achievable for small businesses, though the path varies by size and current IT maturity. Many small defense contractors are closer to compliance than they realize. The CMMC Accelerator is specifically designed to guide businesses without dedicated IT or security staff through a plain-English assessment and generate the documentation they need. Dragonfli Group's tiered engagements are sized to your gap profile, so small businesses pay for the help they actually need.