Seat-led · CMMC 2.0 : CMMC Level 2 readiness, with accountability for the SSP.
Your prime wants a score, a plan, and a date. The DoD wants 110 controls, evidenced. We scope the CUI boundary, close the gaps, write the System Security Plan, and walk you through a mock assessment before the C3PAO arrives — and the seat-holder is accountable for the plan.
If any of these is true, CMMC is on your desk.
CMMC 2.0 is being written into DoD contracts in phases: Phase 1 began in November 2025, and Phase 2 — which brings the C3PAO-assessed Level 2 requirement — starts 10 November 2026. The suppliers who feel it first are the ones a prime is already asking.
- You hold, or want to win, a DoD contract with the DFARS 252.204-7012 clause
- You handle Controlled Unclassified Information (CUI) for a prime or a higher-tier subcontractor
- Your prime has asked for your SPRS score, your SSP, or your CMMC Level 2 status
- Your flow-down obligations reach your own suppliers and you have to prove theirs too
The 110 controls, evidenced.
- Scope the CUI boundary — which systems, people, and locations are in scope, and which are kept out
- Gap-assess against the 110 controls of NIST SP 800-171 r2, across all 14 families, scored the way the assessor scores
- Write the System Security Plan (SSP) that describes how every control is met
- Build the Plan of Action & Milestones (POA&M) for what is not yet met, with owners and dates
- Submit and maintain your SPRS score with the evidence to back it
- Produce the policy set and procedures the controls assume exist
- Assemble the evidence pack, organised by control, so the assessor finds what they ask for
- Run a mock assessment walkthrough before the C3PAO arrives
- Flow the obligations down to your subcontractors and evidence their status
What we do. What the C3PAO does.
The separation is not a formality; it is the rule. Golonex prepares you — registered Practitioner (RP) registration with the Cyber AB in process. The assessment is performed by an independent C3PAO.
Golonex (prepares you)
- ·Scoping, gap assessment, and remediation roadmap
- ·SSP, POA&M, policies, and the evidence pack
- ·Mock assessment and readiness attestation
- ·The seat that keeps you ready between assessments
The C3PAO (the assessor)
- ·Performs the Level 2 certification assessment
- ·Examines, interviews, and tests against 800-171A
- ·Issues the assessment result to the DoD
- ·Is independent of Golonex, by rule
Comply once, satisfy many.
NIST 800-171 overlaps heavily with ISO 27001 Annex A and CIS Controls v8. We implement the controls once and crosswalk them, so a firm that also needs ISO 27001 for a commercial customer does not run two projects.
CMMC — your questions, answered
What is the difference between CMMC Level 1 and Level 2? +
Level 1 covers Federal Contract Information (FCI) with 15 basic sractices and an annual self-assessment. Level 2 covers Controlled Unclassified Information (CUI) with the 110 controls of NIST SP 800-171, and for most contracts requires a triennial certification assessment by a C3PAO. If your contract mentions CUI or DFARS 252.204-7012, assume Level 2.
Can we self-assess for Level 2? +
Only for a narrow set of contracts the DoD designates as self-assessment eligible. Most Level 2 contracts require a C3PAO assessment. We prepare you either way; the readiness work is the same, and the SSP and POA&M are required in both cases.
How long does CMMC Level 2 readiness take? +
Typically four to nine months from scoping to assessment-ready, depending on how much of 800-171 you already meet and how cleanly the CUI boundary can be drawn. A narrow, well-defined enclave is faster and cheaper than trying to certify the whole company. Scoping is the first thing we do, for that reason.
What counts as CUI? +
Information the government creates or possesses, or that a contractor creates or possesses on the government’s behalf, that a law, regulation, or policy requires to be protected — technical drawings, specifications, export-controlled data, certain contract details. Your contract and your prime tell you what you hold. Scoping tells you where it lives.
Are you the assessor? +
No, and that separation is required. Golonex prepares organisations for assessment — registered Practitioner (RP) registration with the Cyber AB in process. The assessment itself is performed by an independent CMMC Third-Party Assessment Organization (C3PAO). A firm that prepares you cannot also grade you.
Can you also run the day-to-day once we are certified? +
Yes. That is what the seat is for. Certification is a point in time; the seat keeps the controls running, the evidence current, and the POA&M closing, with a quarterly re-assessment and a signed monthly report. For CUI environments, the day-to-day teams can be US-person-only. Most firms move from the readiness review into the seat.
Walk into the C3PAO assessment ready, not hopeful.
Bring the contract clause or your SPRS score. Leave with the scope, the gap list, and a plan.