CMMC Resources
Practical CMMC 2.0 compliance guides from Dragonfli Group — a CMMC Registered Practitioner Organization with 18 years of federal cybersecurity experience.
Level 3 adds 24 NIST SP 800-172 enhanced requirements on top of a final Level 2 certification, assessed by the government (DCMA DIBCAC), not a C3PAO. Who actually needs it, how the assessment and scoring work, and how to know where you stand across Level 1, Level 2, and Level 3.
You do not need a perfect 110 to win the work. How conditional Level 2 certification works, why 88 is the line, which gaps a POA&M can and cannot cover under 32 CFR 170.21, and the 180-day clock to final status.
The DOJ Civil Cyber-Fraud Initiative uses the False Claims Act against contractors who misrepresent NIST SP 800-171 compliance or inflate their SPRS score. Here is how enforcement works, the whistleblower risk, recent settlements, and how to protect your company.
One word decides whether you face 17 cybersecurity practices or all 110: CUI. Learn what Controlled Unclassified Information is, how it differs from FCI, how to tell if you handle it, and how to scope your CMMC environment.
Your System Security Plan and Plan of Action & Milestones are the backbone of CMMC. Learn what each is, why no SSP means no SPRS score, and exactly what gaps a POA&M can cover under 32 CFR 170.21.
CMMC is live — the 48 CFR rule took effect November 10, 2025. Here is the four-phase rollout through 2028, when C3PAO certification becomes a condition of award, and why readiness takes longer than you think.
A C3PAO will examine, interview, and test your controls against 320 assessment objectives. Here is how the assessment works, the evidence you need, the most common reasons companies fail, and a six-step readiness plan.
CMMC obligations flow down from primes to subcontractors through DFARS clauses. Learn which CMMC level a subcontractor actually needs, the COTS exception, and exactly what to ask your prime.
Multi-factor authentication is one of the highest-weight, most-tested CMMC controls. Which accounts need MFA under NIST SP 800-171 3.5.3, how the 5-point partial-credit scoring works, and the coverage gaps that quietly fail assessments.
CMMC is assessed against Revision 2 today — a DoD class deviation keeps it in effect until rescinded. What changed in Rev 3 (including ODPs), when the transition is expected, and which version to build for right now.
Do you need GCC High for CMMC? Not always. How DFARS 7012 and FedRAMP requirements shape your cloud choice, when ITAR forces GCC High, and how a CUI enclave shrinks your CMMC scope and cost.
DFARS 7012 requires reporting cyber incidents within 72 hours, preserving forensic images for 90 days, and flowing the duty down to subcontractors. Exactly what the rule requires — and how to be ready before an incident.
The myth that your MSP "being CMMC certified" covers you is wrong on both halves. When an MSP or ESP needs its own assessment, how security providers are scoped, the cloud/FedRAMP path, and why the responsibility never leaves you.
Everything you need to know about CMMC 2.0 requirements, the 14 domains, SPRS scoring, C3PAO assessments, and how to prepare your company for certification.
Step-by-step guide to calculating your Supplier Performance Risk System score, applying the DoW methodology, self-reporting in PIEE, and understanding what your score means for contract awards.
The difference between FCI and CUI, what each CMMC level actually requires, how to determine which applies to your DoW contracts, and what self-attestation vs. C3PAO assessment means for your business.
Complete breakdown of CMMC 2.0 compliance costs: readiness assessments, RPO consulting, technical remediation, C3PAO assessment fees, and annual maintenance — with real numbers and what drives them up or down.