Do I need CMMC to handle CUI?

Yes — new DoD contracts that involve Controlled Unclassified Information require CMMC Level 2, which maps to the 110 NIST 800-171 controls.

How long does CMMC certification take?

It varies, but the path is: scope CUI, self-assess and submit to SPRS, write the SSP and POA&M, secure the gaps, then a C3PAO assessment. ForteFide compresses the technical work from months to hours.

Does ForteFide produce evidence a C3PAO accepts?

Yes — it produces signed, tamper-proof evidence bound to your license, plus a printable attestation for the organizational controls.

CMMC Level 2 · for contractors who handle CUI

Handle CUI? Here's how to become CMMC certified — the whole path, and where you stand.

The DoD now requires contractors who handle CUI to prove they protect it. It's confusing, the clock is running — and almost nobody's done: only about 1 in 100 feel ready. So you're not behind. Here's the entire path in plain English, and a free scorecard that shows where you stand today, no commitment.

Run the free scan — see where you stand Still have questions? Let's talk

What is CMMC, and why now?

CMMC — Cybersecurity Maturity Model Certification — is how the Department of Defense confirms its contractors actually protect the sensitive information they handle. If your company touches Controlled Unclassified Information (CUI) — the contract details, specs, and drawings the government marks as sensitive-but-unclassified — DFARS 252.204-7012 already requires you to safeguard it by meeting the 110 security requirements of NIST SP 800-171.

Here is the part that carries teeth today: you self-assess against those 110, post a score to the DoD’s SPRS system, and a senior official personally affirms it. That affirmation is a signature to the federal government — and a score you cannot back up is False Claims Act exposure, not just a failed audit.

The reassuring part: almost nobody is finished. Roughly 99% of the contractors who need it are not there yet — most are working through it right now, same as you.

Which level do you need?

There are three, and most companies that handle CUI land on Level 2.

Level 1 — for basic contract info, not CUI. A smaller set of safeguards you assess yourself.
Level 2 — for CUI. This is the big one: 110 security requirements from NIST SP 800-171. You assess against all 110, post the score to SPRS, and affirm it. Around 80,000 contractors need Level 2.
Level 3 — the highest tier, for the most sensitive programs. Adds enhanced requirements on top of Level 2 and is assessed by the government itself.

Not sure which applies? It comes down to one question: does the information in your contracts get marked as CUI? If yes, plan for Level 2.

Read this before you sign

You don’t just post your score — you sign it. And the False Claims Act is what you sign under.

Notice the word affirm back there. When you post your SPRS score, a senior official signs their name to it. To the government, that signature isn’t a formality — it’s a promise that the number is true.

If it isn’t — if a control is marked met that isn’t, and you knew, or looked the other way, or never actually checked — that’s not a paperwork slip. Under the False Claims Act, an inflated score tied to a federal contract can become a false claim. What that carries is steep:

Triple damages. The government can recover three times the damages it says it suffered on the affected contract.
A penalty on every invoice. Each claim billed under a false attestation draws its own civil penalty — currently over $14,000, and up to more than $28,000, adjusted for inflation every year. Invoice monthly for two years and that’s two dozen separate penalties, stacked on top of the triple damages.
It’s personal. The official who signs is on the hook — and “knowing” isn’t only deliberate lying. It includes reckless disregard and deliberate ignorance. “I didn’t know” can be the violation, not the defense.
Your own people can bring it. An employee can file a whistleblower suit on the government’s behalf and keep a share of what’s recovered. The Justice Department’s Civil Cyber-Fraud Initiative exists specifically to pursue false cybersecurity attestations — and it is active right now.

None of this is hypothetical — a single cyber-fraud settlement has already reached $11.25 million. And the pause on third-party assessments doesn’t lower this risk. It raises it: with no assessor checking your work first, nobody catches an inflated score until the government does.

This is the whole reason ForteFide is built the way it is. It can’t make the False Claims Act go away — nothing can, and anyone who tells you otherwise is selling you a new problem. What it does is let you sign a number you can prove: all 110 controls checked against your real systems, with signed, tamper-evident evidence you can put in front of a skeptical reviewer, one control at a time. The honest score — and the receipts to back it.

General information, not legal advice — for how the False Claims Act applies to you, talk to qualified counsel. Sources: False Claims Act, 31 U.S.C. §§ 3729–3733; DFARS 252.204-7012; 32 CFR 170.24.

What does Level 2 actually require?

110 practices, across 14 families. In plain English, they ask you to have control over:

Who can get in — accounts, least privilege, multi-factor authentication.
What's watched — audit logs and monitoring, so you know who did what.
How things are set up — hardened configurations, only the services you need, patching.
How data is protected — encryption in transit and at rest, secure remote access.
What you do when something goes wrong — an incident response plan you've actually tested.
The paperwork behind it — policies, training records, and a written security plan.

None of it is exotic. Most of it is good IT hygiene, written down and proven.

The steps — and why each one exists

Scope it. Find exactly where CUI lives and flows. Why: you only have to protect what is in scope — getting this right shrinks the whole job.
Write the SSP and POA&M. A System Security Plan documents how each of the 110 is met; a Plan of Action & Milestones lists the gaps and how you will close them. Why: the SSP is the basis of your score — no security plan, no complete assessment.
Score yourself and submit (SPRS). Assess against the 110 and post the resulting score to the DoD’s SPRS system. Why: the DoD requires a current score on file — and it has to be one the SSP substantiates.
Secure the gaps. Actually implement the missing controls — the technical settings and the policies. Why: a plan is not security; the score has to reflect the real system.
Affirm it. A senior official affirms the SPRS score to the government. Why: that affirmation is a signature under False Claims Act liability — a false or inflated score is treble-damages territory, so the number has to be one you can prove.
Reach the bar. Score at least 88 of 110 with only certain gaps remaining for a conditional status, with 180 days to close them; miss one of the critical controls and there is no shortcut. Re-assess as your systems change so the score on file stays true.

How hard is this, honestly?

We won’t pretend it’s a weekend. The real picture:

Most people aren’t close yet. The median score contractors submit is about 60 out of 110. You need 88 for a conditional pass and 110 to be fully compliant.
Not every control is equal. Several of the high-weight ones — patching, boundary firewalls, malicious-code protection — have no do-over: they must be met outright, with no partial credit and no plan-to-secure-later. Every control counts toward your score; the high-weight ones count absolutely.
The work splits in two. Most of the 110 are technical — system and configuration settings that can be assessed and secured with the right tooling. The rest are organizational — policies, training, physical measures — finite, but you have to write and do them.
The score you sign is live now. A current SPRS score is a condition of award, and the score you self-assess and affirm today already carries False Claims Act liability — nobody catches an inflated score until a DoJ or DIBCAC review does, and by then it is treble the amounts paid, plus a penalty on every invoice — and each invoice is a separate claim.

The honest summary: it’s real, it’s finite, and the earlier you see your actual gaps, the smaller the surprise.

Where DenseDefense comes in

This is the part we made easy. Start by seeing exactly where you stand — for free, no sales call.

Scan free. Run ForteFide against your systems and get your real score across all 110 controls in an afternoon, not a quarter.
Secure the technical gaps. For the controls that can be remediated, ForteFide does it — and re-checks to prove it's actually secured.
Walk in with proof. It seals the result into signed, tamper-evident evidence your assessor can independently verify. Everyone else stops at the paperwork; we secure what's vulnerable.

You don't have to commit to anything to find out where you are. See your starting line, then decide.

Run the free scan — see where you stand Still have questions? Let's talk