Services
Services
SOC & Attestations
SOC & Attestations
Payment Card Assessments
Payment Card Assessments
ISO Certifications
ISO Certifications
Privacy Assessments
Privacy Assessments
Federal Assessments
Federal Assessments
Healthcare Assessments
Healthcare Assessments
Penetration Testing
Penetration Testing
Cybersecurity Assessments
Cybersecurity Assessments
Crypto and Digital Trust
Crypto and Digital Trust
Schellman Training
Schellman Training
ESG & Sustainability
ESG & Sustainability
AI Services
AI Services
Industry Solutions
Industry Solutions
Cloud Computing & Data Centers
Cloud Computing & Data Centers
Financial Services & Fintech
Financial Services & Fintech
Healthcare
Healthcare
Payment Card Processing
Payment Card Processing
US Government
US Government
Higher Education & Research Laboratories
Higher Education & Research Laboratories
About Us
About Us
Leadership Team
Leadership Team
Careers
Careers
Corporate Social Responsibility
Corporate Social Responsibility
Strategic Partnerships
Strategic Partnerships

CMMC Assessment

We are excited to be one of the first authorized C3PAOs and the first authorized firm of our type that performs SOC, ISO, FedRAMP, PCI, and HITRUST services to be authorized to perform CMMC assessments as many of our clients also participate as defense contractors and subcontractors that are subject to DFARS and the associated requirements.

Contact a Specialist Build Your Compliance Roadmap

CMMC Middle

What is CMMC?

The Cybersecurity Maturity Model Certification (CMMC) is a new framework with the objective of securing federal contract information (FCI) and controlled unclassified information (CUI) that is stored, processed, or transmitted by defense contractors and the entire defense industrial base (DIB). CMMC builds on the existing NIST SP 800-171 requirements and , in many cases, requires assessment by CMMC third-party assessor organizations (C3PAOs).

CMMC Middle

The 3 Levels of CMMC

With the publication of CMMC 2.0 and changes from CMMC 1.0, there are now 3 levels within the CMMC Model. The model, along with its supporting documentation like assessment guides and scoping guides, does an excellent job presenting the domains and practices in a variety of digestible ways. There are some details that should be paid specific attention to within the information provided in the CMMC Model, including the different levels and their particulars.

  • Level 1

  • Level 2

  • Level 3

Image

Level 1

Level 1 is the minimum basic CMMC level, focused on protecting FCI. It includes 17 of the NIST SP 800-171 requirements with no additional practices. Level 1 is not expected to require assessment by C3PAOs, but instead will require self-assessment by DIB organizations.

Image

Level 2

Level 2 is focused on the protection of CUI. It is the equivalent to NIST SP 800-171 and includes the 110 requirements from NIST 800-171. Level 2 was previously Level 3 in CMMC 1.0 and included additional practices, which have been removed in CMMC 2.0.

Image

Level 3

Level 3 in CMMC 2.0 replaces Levels 4 and 5 in CMMC 1.0. Level 3 will build on the 110 requirements in Level 3 (and NIST 800-171) and include a subset of requirements from NIST SP 800-172.

It is expected that Level 3 assessments will represent a very small number of contract requirements and contractor certifications.

Your CMMC Specialist,
Marci Womack

Marci Womack is a Director and leader in Schellman’s CMMC practice. Marci has eight years of information security experience across various industries – cloud services, government, and financial services.
  • Fixed-Fee Using an outcome-based, fixed-fee pricing model based on our extensive experience
  • Scope Creep We see less than 5% of our clients that see amendments and are often the result of a scope expansion
  • Low Overhead Low overhead means a flexible financial structure

How much will your audit cost?

Whether it is an ISO 27001 certification, SOC 2 examination or a FedRAMP assessment, companies are often challenged by the need to address customer requirements while ensuring a return on compliance investment.

The most important factor in scoping a potential assessment is understanding what deliverable the recipient (i.e. your customer or partner) is expecting.

Once we have scoped your environment and needs, there are several factors that contribute to Schellman’s pricing:

  • Fixed-Fee Using an outcome-based, fixed-fee pricing model based on our extensive experience
  • Scope Creep We see less than 5% of our clients that see amendments and are often the result of a scope expansion
  • Low Overhead Low overhead means a flexible financial structure

Contact Us

Fill out this form to talk with one of our specialists. We'll be in touch soon to continue the conversation and help you find what you're looking for.

Contact Us

Fill out this form to talk with one of our specialists. We'll be in touch soon to continue the conversation and help you find what you're looking for.