A CMMC Level 2
Registered Practice.
Building the same readiness for you.

Level 1 applies to contractors handling only Federal Contract Information (FCI). It covers 17 basic safeguarding controls from FAR 52.204-21 and requires an annual self-assessment with executive affirmation in SPRS. Level 2 applies to contractors who store, process, or transmit Controlled Unclassified Information (CUI). It covers 110 controls aligned to NIST SP 800-171 and, for prioritized acquisitions, requires a third-party assessment by a C3PAO every three years.

GCC High is required when you store, process, or transmit CUI subject to ITAR, or when a specific contract clause requires U.S. data sovereignty and U.S.-citizen administration. Many CMMC Level 2 environments are fine in commercial GCC, which is significantly cheaper. We scope this in the Readiness Assessment so you don't over-buy.

Typical timelines: two to four weeks for the Readiness Assessment, three to six months for Remediation and Build, and one to three months for audit preparation. Most environments are ready for a C3PAO assessment six to nine months from kickoff. Scope, current state, and budget cadence drive the actual schedule.

Centuric is a Registered Practitioner Organization in the Cyber AB ecosystem, and our consultants are Registered Practitioners trained on the CMMC standard. We help you prepare. A C3PAO (a different organization) is the body that assesses and certifies you. Treating these as separate roles is required by the standard, and we work alongside the C3PAO of your choice.

CUI is information the government or a prime contractor requires you to protect, even though it is not classified. In manufacturing, common examples include technical drawings under ITAR or EAR, specifications marked with Distribution Statements B through F, and DFARS-flagged contract data. Scoping CUI accurately is the single most important step in a CMMC engagement—most cost overruns come from over-scoping in week one.

You risk losing the contract or being moved off the award. Some primes will accept a documented remediation plan and timeline if the work is genuinely underway and credibly scoped. We can package that plan for you to present to your prime while we execute it—and we've done it before.

Yes. Readiness Assessment is fixed-fee, Remediation and Build is scoped in phases tied to your budget cycle, and Managed Compliance is a recurring monthly engagement. Most manufacturers split the work across two to three fiscal quarters.

For most federal contractors, CMMC compliance costs are treated as cost-allowable indirect or direct charges, subject to your contract terms and your DCAA-approved accounting practices. We can structure deliverables to support your cost tracking. Talk to your contracts team and we'll provide the documentation they need.