CMMC compliance resources
Comprehensive guides for the deep questions, articles for what’s happening now — all written for defense contractors.
Guides
The CMMC collection
Start-to-finish reference material: read it in order or jump to the chapter you need.
Understand CMMC
The three levels
What each CMMC level requires, who needs which one, and how assessments differ — from Level 1 self-assessment to Level 3 government evaluation.
Read the guideUnderstand CMMC
The requirements
The 15 Level 1 safeguards, the 110 Level 2 controls across 14 families, the 320 assessment objectives, and the documentation assessors expect.
Read the guideGet certified
The certification process
From determining your level to passing the C3PAO assessment and staying certified: the full path, how long it takes, and what happens on assessment day.
Read the guideGet certified
Scoping & CUI
How to find your CUI, the five asset categories, when an enclave makes sense, and why scope is the biggest lever on CMMC cost and effort.
Read the guideCompare
CMMC vs other frameworks
How CMMC relates to the frameworks you may already know — what carries over, what doesn't, and where reciprocity actually exists.
Read the guideReference
The CMMC glossary
Every CMMC, NIST 800-171, and DFARS term you'll run into — defined in plain English, no acronym soup.
Read the guideArticles
Latest from Fortwise
Timely, focused pieces on deadlines, costs, scores, and what's changing in the CMMC ecosystem.
CMMC Phase 2 Deadline (November 10, 2026): What Defense Contractors Must Do Now
Phase 2 of the CMMC rollout begins November 10, 2026 — and third-party Level 2 assessments start appearing in new DoD solicitations. Here's what changes, who it hits first, and the backward timeline to certify.
Read MoreHow Much Does CMMC Level 2 Certification Really Cost in 2026?
The DoD says roughly $105K. Consultants quote wildly different numbers. Here's an honest breakdown of what actually drives CMMC Level 2 cost — and the levers small contractors can pull to bring it down.
Read MoreThe C3PAO Backlog: Why You Should Book Your CMMC Assessment Early
Tens of thousands of contractors need a Level 2 assessment. Only a few dozen organizations can perform one. Here's how bad the C3PAO bottleneck is, how early to book, and how to be the client assessors say yes to.
Read MoreSPRS Score Explained: How to Calculate, Submit, and Improve It
Your SPRS score is the number DoD sees before anyone talks to you — and under CMMC Phase 1, an inflated one is a legal liability. How the -203-to-110 scale works, which controls crater it, and how to raise it fast.
Read MoreCMMC Level 2 Preparation: Insider Tips from DIB Contractors
Contractors who passed CMMC Level 2 share what actually worked: the 6-month timeline, evidence organization that satisfies assessors, the top 5 failure points, and what it really costs.
Read MoreCMMC Level 1 vs Level 2: How to Choose Your Path
Level 1 covers FCI with 17 practices and self-assessment; Level 2 covers CUI with 110+ practices and usually a C3PAO audit. Here's how to figure out which path your contracts actually require.
Read MorePOA&M Management That Works: DIB Contractor Success Guide
Your gap assessment found 40+ findings and your security budget is tiny. Smart POA&M management is the difference between losing contracts and maintaining DoD relationships while you strengthen security.
Read MoreWalk into your CMMC assessment ready.
Book a 30-minute readiness call with a Fortwise advisor. No high-pressure sales — just a clear read on where you stand and what it takes to certify.
- Confirm which CMMC level your contracts actually require
- Pinpoint the gaps most likely to fail your assessment
- Leave with a clear, prioritized path to certification
One-on-one with a CMMC advisor · No obligation · We never store your CUI
