Start with a CMMC gap assessment
For a quick first look, try our free CMMC score estimator. Then, in a short engagement, we review your environment against the NIST SP 800-171 controls behind CMMC Level 2 and give you:
- An estimated SPRS score and where it comes from
- Your biggest gaps, ranked by risk and effort
- Where your CUI lives today — email, file shares, cloud apps, laptops
- A practical, prioritized roadmap and budget range
How we get you ready
Five steps take you from first scoping session to a compliant, assessment-ready environment:
- Step 1 · Scope
Find and shrink your CUI scope
Identify your FCI and CUI, map where it flows, and shrink the scope where possible.
CUI data map - Step 2 · Document
Write your SSP and POA&M
Build your System Security Plan (SSP) and Plan of Action & Milestones (POA&M).
SSP · POA&M - Step 3 · Implement
Put the controls in place
MFA, encryption, logging and a managed SIEM, endpoint detection and response, access control, configuration baselines, and Microsoft 365 / Intune hardening — including GCC High where your contracts require it.
Microsoft 365 · Intune - Step 4 · Prove
Collect the evidence
Collect evidence continuously, keep your SPRS score current, and prepare for your assessment.
SPRS score - Step 5 · Maintain
Stay compliant
Our 24×7 NOC & SOC, vulnerability management and vCISO keep you compliant after day one.
24×7 NOC & SOC - Start here
Estimate your score
Mark the 110 NIST SP 800-171 requirements in our free CMMC score estimator to see roughly where your SPRS score stands today.
CMMC score estimator
Built for the coastal aerospace corridor
From Huntington Beach and Long Beach to Irvine and Costa Mesa, Orange County is home to hundreds of aerospace, machining and electronics suppliers — see how we support aerospace and defense suppliers. Our local team works on-site with shop floors and engineering offices — on-site support is included in Managed Care.
CMMC Terms in Plain English
CMMC comes with a lot of acronyms. Here’s what the ones on this page mean.
- CMMC (Cybersecurity Maturity Model Certification) — the Department of Defense program that requires companies in its supply chain to prove they protect contract information.
- FCI (Federal Contract Information) — information provided by or created for the government under a contract that isn’t meant for public release. Protecting it is CMMC Level 1.
- CUI (Controlled Unclassified Information) — sensitive but unclassified government information, such as technical drawings and specifications. Protecting it is CMMC Level 2.
- NIST SP 800-171 — the 110 security requirements that CMMC Level 2 is built on.
- SPRS (Supplier Performance Risk System) — the DoD database where you post your NIST SP 800-171 score, from −203 up to a perfect 110. Estimate yours with our free CMMC score estimator.
- SSP (System Security Plan) — the document that explains how your company protects its systems and sensitive information.
- POA&M (Plan of Action and Milestones) — your cybersecurity to-do list: the gaps that still need to be fixed, who owns each one and when it will be done.
- C3PAO (Certified Third-Party Assessment Organization) — the independent company authorized to conduct the formal CMMC Level 2 assessment.
CMMC timelines have shifted in 2026 — read what the CMMC Phase 2 pause means for Orange County defense contractors. Many of the NIST SP 800-171 controls behind Level 2, such as limiting which software can run, are easier to meet with ThreatLocker application allowlisting.
Why CAL IT Group
- SOC 2 Type II across all five Trust Services Criteria — audited discipline, not just advice
- Highly technical leadership — co-founders Kevin Nichols and Joe Kemp, a CISSP — with 55+ years of combined IT experience
- Best-of-breed security stack: SentinelOne, Microsoft Defender and Intune, Qualys, Liongard, managed SIEM
- Published pricing and fixed-fee projects — no open-ended consulting hours