CMMC Level 2 Compliance Platform for Small Defense Contractors.

The defense industrial base has a problem. Over the past decade, the number of small businesses in the DIB has declined by more than 40%. Compliance burden is a significant driver. CMMC Level 2 is the latest chapter. For a 15-person manufacturer or a 30-person engineering firm, the same 110 security requirements that apply to a 5,000-person prime contractor also apply to you. Same standard. Fraction of the resources.

This guide exists because most CMMC content on the internet is written by vendors who want to sell you something and consultants who want to bill you. What follows is an honest, specific account of what a CMMC compliance platform actually needs to do for a small defense contractor: what the 110 requirements mean in practice, how to evaluate tools, how to read pricing that vendors deliberately obscure, and what the assessment experience actually looks like from the inside.

Why 1TEN was built

The tools available to small defense contractors when CMMC began taking shape fell into two categories: general-purpose GRC platforms that required expensive configuration and compliance expertise to be useful, and consultants charging by the hour to manually produce documentation that would be outdated six months later.

Neither option reflected how small manufacturers and engineering firms actually operate. A 20-person shop doesn't have a CISO. They have an IT person who also handles the phones, and a quality manager who is already managing ISO certifications, customer audits, and production deadlines. Asking that organization to navigate a 400-page NIST framework and produce a System Security Plan from scratch is not a compliance challenge. It's an existential one.

The result is an air-gapped, on-premises appliance that walks a defense contractor through the entire CMMC Level 2 process: from first assessment interview through fully generated SSP, 14 domain policies, and ongoing compliance calendar. Every piece of output is designed to the standard that C3PAO assessors actually apply.

It is deployed on your premises because your CUI should never leave your network to achieve compliance with regulations designed to protect your CUI. The irony of uploading sensitive compliance data to a shared cloud to prove you handle sensitive data securely is not lost on us.

DIB-focused tools vs. enterprise tools not built for small contractors

The CMMC compliance software market broadly divides into three categories. Understanding what each does — and doesn't do — is essential before you spend money.

The content communication platform problem

Platforms like Kiteworks are built around securing file transfer, email, and content sharing. When vendors say they support "nearly 90% of CMMC Level 2 requirements," that claim requires context: they mean their platform can help satisfy some objectives for the specific use case of content communications. Your SSP, policies, training records, incident response plan, configuration baselines, and risk assessment still need to be built from scratch.

The enterprise GRC platform problem

Enterprise GRC platforms are genuinely capable — if you have the resources to configure them, the expertise to maintain them, and the staff to use them. For most small defense contractors, none of those conditions apply. Configuring them for CMMC typically requires a consultant engagement that costs more than the software itself.

Assessment readiness checklist: all 110 requirements by domain

Use this checklist to assess your current posture. For each requirement, mark status as Met, POA&M (gap with remediation plan), or Not Started. SPRS scoring deducts points for every requirement not marked Met.

What CMMC compliance tools actually cost

Most CMMC vendors deliberately avoid publishing pricing. The reason is not complexity — pricing comparisons favor vendors whose costs are genuinely lower, and most enterprise vendors don't want that comparison happening before a relationship is established.

The honest comparison: enterprise GRC is priced for organizations that have compliance teams. Cloud SaaS introduces a CUI scoping complication. A purpose-built air-gapped platform eliminates both problems — at a price point designed for the organizations that actually need it.

What C3PAO assessors actually look for

C3PAO assessors are not trying to fail you. They're trying to verify that your security controls actually exist and actually work — not just that you wrote down that they do. Understanding the verification standard changes how you document.

The three things assessors verify for every control

Interview questions you should expect

For every domain, assessors conduct structured interviews. Common questions include: "Walk me through how a new user is provisioned and what access they receive." "Show me where your audit logs are and how you review them." "What would happen if an employee's laptop were lost or stolen?" Your platform should prepare you for these — not just ask you to mark a box.

SSP and documentation: what good looks like

Your System Security Plan is the first document your C3PAO assessor reads. It is also the document that sets their expectation for everything that follows. A weak SSP creates suspicion before the assessment even begins. A strong SSP demonstrates that you understand your environment and have thought carefully about how each control is implemented.

Required SSP sections

1TEN generates all of these sections from your environment data automatically. The output reads like a document written about your organization — because it was. Full SSP guide →

After certification: ongoing compliance requirements

CMMC Level 2 certification is valid for 3 years. But the compliance obligations don't pause between assessments. Several ongoing requirements must be maintained:

Certification is the beginning of a 3-year compliance cycle, not the end of a project. The contractors who maintain strong posture between assessments are the ones who build ongoing compliance into their operations — not the ones who sprint to certification and then let their documentation go stale. POA&M guide →

Frequently asked questions

Do small defense contractors really need CMMC Level 2 certification?

Yes — if your contract involves Controlled Unclassified Information (CUI), CMMC Level 2 is a mandatory contract requirement regardless of company size. A 10-person shop supplying a prime contractor handles the same CUI protection obligations as a 500-person firm. The DoD has codified this in 48 CFR 252.204-7021.

How long does CMMC Level 2 certification take?

From initial assessment to C3PAO certification, most small contractors should plan for 6 to 18 months depending on their starting posture. Organizations with weak SPRS scores or no existing documentation typically need 12+ months of remediation. Organizations that are well-prepared with complete documentation, trained staff, and a credible POA&M can complete the process in 6 to 9 months.

What is the difference between a CMMC compliance platform and a GRC tool?

A GRC tool is general-purpose and can be configured for many standards including CMMC, SOC 2, HIPAA, and others. A CMMC-specific platform is built exclusively around the 110 NIST SP 800-171 requirements and C3PAO assessment process, with pre-built SSP templates, embedded assessor questions, SPRS scoring, and domain policies designed specifically for defense contractors. For small contractors without a dedicated compliance team, a purpose-built CMMC platform is almost always faster and more practical.

Can I use a cloud-based CMMC tool if I handle CUI?

You can, but it adds complexity to your scoping and shared responsibility picture. If your compliance documentation — SSPs, policies, evidence — lives on a vendor's cloud, that infrastructure may fall within your CUI boundary and require its own security controls. An on-premises or air-gapped deployment keeps all compliance data inside your network, simplifying your scope and eliminating cloud dependency from your assessment conversation.

What do C3PAO assessors actually look for?

C3PAO assessors verify three things for each of the 110 requirements: that a policy exists, that the policy is implemented and demonstrably functioning, and that evidence supports the claim. Generic or templated documentation fails the second and third tests. The biggest gap between self-assessments and C3PAO-verified scores is documentation that describes a control without proving it works.

What is a POA&M and when is it required?

A Plan of Action and Milestones (POA&M) documents the security gaps in your environment: requirements that are not yet fully implemented, along with remediation timelines, responsible owners, and interim mitigations. Under CMMC Level 2, a limited number of non-critical requirements may be addressed via POA&M at the time of assessment, giving you 180 days post-certification to close them. High-weight requirements and those related to CUI protection generally cannot be deferred. Full POA&M guide →