US (470) 948-0356 India +91 70321 51545

Tetra Connects

Cybersecurity

CMMC readiness

If you handle Federal Contract Information or Controlled Unclassified Information for the Department of Defense, CMMC requirements are arriving in contracts. We help you find your boundary, close technical gaps and prepare documentation.

Speak with a security expert Plan an assessment

The problem this service solves

The Department of Defense’s CMMC program verifies that contractors protect FCI and CUI. The DFARS rule took effect on November 10, 2025, with a phased introduction of requirements in new solicitations and contracts. Level 2 covers the 110 requirements of NIST SP 800-171 Revision 2, verified by self-assessment or by an authorized third-party assessor (C3PAO), depending on the solicitation.

The hardest part for many small contractors is scoping. If CUI flows through corporate email, shared drives and general-purpose laptops, then all of them are in scope. Creating an enclave for CUI is often more practical than raising the whole company to Level 2.

What is in scope

  • CUI and FCI scoping

    Identify where CUI is created, stored, processed and transmitted, and define the assessment boundary.

  • Gap assessment

    Assess against NIST SP 800-171 practices and score using the DoD methodology.

  • Enclave and architecture options

    Compare a dedicated enclave, a cloud environment authorized for CUI and whole-company scope.

  • Technical implementation

    Access control, MFA, encryption, audit logging, configuration management, incident response and media protection.

  • Documentation

    System Security Plan, policies, procedures and POA&M.

  • Evidence and mock assessment

    Evidence organization and rehearsal of assessor interviews.

  • Supplier flow-down

    Handling of subcontractors that touch CUI.

How the work runs

Scope

Define the boundary.

  1. 1

    CUI data flow

    Map CUI across people, process and technology.

  2. 2

    Boundary decision

    Choose enclave or broader scope.

Close gaps

Implement and document.

  1. 3

    Gap assessment

    Score current state.

  2. 4

    Remediation and documentation

    Implement controls and write SSP and POA&M.

Prepare

Rehearse.

  1. 5

    Mock assessment

    Practice with evidence and interviews.

  2. 6

    Assessor coordination

    Help you engage a C3PAO if one is required.

What you receive

  • CUI data flow and boundary definition
  • Gap assessment and SPRS score estimate
  • System Security Plan draft
  • POA&M
  • Technical implementation support
  • Mock assessment results

Tooling and technique

Methods

  • DoD Assessment Methodology
  • NIST SP 800-171A assessment procedures

Technical

  • Microsoft 365 GCC High
  • Enclave platforms
  • Logging and MFA tooling

Tool categories describe how we work. They are not a claim of vendor partnership or certification.

Standards we map to

Frameworks and references

  • 32 CFR Part 170 (CMMC Program)
  • NIST SP 800-171 Rev 2
  • NIST SP 800-171A
  • DFARS 252.204-7012, -7019, -7020, -7021, -7025

Mapping findings to a framework is not the same as certification against it.

Before we start

What we need from you

  • A list of contracts with DFARS clauses
  • Information on where CUI is handled
  • A named compliance owner

What this service is not

  • Certification assessment (only a C3PAO or DIBCAC performs it)
  • Legal advice on contract clauses

What changes afterwards

  • A defined, defensible CUI boundary
  • Gaps closed or tracked in a POA&M
  • Documentation matches practice

Questions people ask

Is CMMC mandatory now?

The rule is in effect and requirements phase into new solicitations and contracts through 2028. Whether your contract requires it depends on its clauses and your prime. Check your contract and confirm current status with your contracting officer.

Can you assess us for certification?

No. Certification assessments are performed by C3PAOs or the government. Doing both readiness and assessment would be a conflict of interest.

Related

Need to understand your security exposure?

Speak with a security expert

Talk through your environment and goals. We reply to scope the work before anything is tested.

Speak with a security expert

Plan an assessment

Answer a few questions and get a structured preliminary scope you can send us.

Use the planner

Under attack right now?

Call the US office and tell us what you are seeing. Do not wait for a form reply.

Incident response

Phone, United States (470) 948-0356 Phone, India +91 70321 51545 Email info@tetraconnects.com