Gap analysis against all 110 controls
A control-by-control map of where you stand on NIST 800-171, scored the way assessors score it — so the plan reflects reality, not optimism.
Services CMMC Level 2
CMMC Level 2
Pass the assessment. Keep the contract.
We map NIST 800-171's 110 controls, close the gaps, and manage assessor preparation from start to finish — so handling CUI doesn't cost you your DoD pipeline.
Got it — we're on it.
Check your email.
Something went wrong. Try again, or email hello@ysecurity.io.
What is CMMC Level 2?
CMMC (Cybersecurity Maturity Model Certification) Level 2 is the Department of Defense's certification for contractors and subcontractors that handle Controlled Unclassified Information (CUI). It requires implementing the 110 security controls of NIST SP 800-171 and, for most contracts, passing an assessment by a certified third-party assessor (C3PAO). Without it, you can't win — or keep — DoD work that involves CUI.
What you get
Enclave scoping that shrinks the bill
Scoping CUI into an enclave is the single biggest cost lever in CMMC. We design the boundary so certification covers what must be covered and nothing more.
An SSP and POA&M assessors accept
The System Security Plan is the document your assessment lives or dies on. We write it from your real environment, with a POA&M that holds up.
Assessor preparation end to end
Evidence packaging, interview prep, and C3PAO coordination — we sit with you through the assessment so nothing gets lost in translation.
How it works
- 1
Assess
Free gap check, then ~1-2 weeks.We score you against NIST 800-171, design the CUI enclave boundary, and hand you a remediation plan with timeline and price — plus your realistic SPRS picture.
- 2
Remediate
Sized to your gaps.We close the control gaps, build the SSP and POA&M, and implement the enclave — with your engineers in the loop, not on the hook for all of it.
- 3
Certify
C3PAO assessment.Mock assessment first, then the real one: we prepare the evidence, coach the interviews, and manage the assessor relationship through to certification.
CMMC Level 2 questions, answered
What's the difference between CMMC Level 1 and Level 2?
Level 1 covers basic safeguarding of Federal Contract Information (FCI) — 17 practices, self-assessed. Level 2 applies when you handle CUI: all 110 NIST 800-171 controls, and for most contracts a third-party C3PAO assessment rather than self-attestation. If your contract mentions CUI, plan for Level 2.
What is an SPRS score and why does it matter now?
SPRS is the DoD's Supplier Performance Risk System, where contractors submit their NIST 800-171 self-assessment score. Primes check it when choosing subcontractors — a realistic, improving score is table stakes for staying in the pipeline while you work toward full certification. We compute yours honestly and fix what drags it down.
Can we scope an enclave instead of certifying the whole company?
Usually yes, and you should. Confining CUI to a defined enclave — separate identity, infrastructure, and workflows — shrinks the assessment boundary, the cost, and the disruption. Enclave design is the first thing we look at in the gap check.
How long does CMMC Level 2 readiness take?
It depends on your gap count and enclave decisions — which is what the free gap check establishes. Our job is to get you there quickly and confidently: gaps closed, SSP written, and a mock assessment passed before the real assessor arrives.
What does it cost?
Our work bills in 15-minute increments with an optional monthly cap. The C3PAO's assessment fee is separate; enclave scoping is the lever that keeps both sides of the bill down.
The RFP says CMMC Level 2. Your competitors are already remediating.
Keep your DoD pipeline
Send your company email and we'll come back with your gap check.