CMMC certification
Work with the Department of Defense
Protect Controlled Unclassified Information and prove it to the standard your contract requires.
What CMMC is
CMMC is the Department of Defense program for verifying that contractors protect Federal Contract Information and Controlled Unclassified Information. The level that applies to you is set by your contract.
Level 1 covers basic safeguarding of Federal Contract Information and is self-assessed. Level 2 aligns to the NIST SP 800-171 controls for Controlled Unclassified Information, and depending on the contract is either self-assessed or assessed by a third party.
The artifacts are specific: a System Security Plan describing how each control is met, a Plan of Action and Milestones for what is not yet met, and a score submitted to the Supplier Performance Risk System.
Who needs CMMC
You hold or are bidding for a Department of Defense contract, or you are in the supply chain of a prime contractor who has one and has passed the requirement down to you.
How TrustLynce helps with CMMC
Scope where CUI lives
Identify which systems store, process, or transmit Controlled Unclassified Information, and keep the boundary evidenced.
System Security Plan
Maintain the SSP describing how each control is implemented, kept current rather than rewritten before an assessment.
POA&M tracking
Track what is not yet met, with owners and dates, in the form an assessor expects.
Evidence for assessment
Control evidence collected continuously, so an assessment reads your real posture rather than a snapshot prepared for it.
CMMC questions
Your contract specifies it. Level 1 covers Federal Contract Information; Level 2 applies where you handle Controlled Unclassified Information.
Level 1 is self-assessed. Level 2 is self-assessed or third-party assessed depending on the contract: the contract is the authority, not us.
A score reflecting your implementation of the NIST SP 800-171 controls, submitted to the Supplier Performance Risk System.
A CMMC Third-Party Assessment Organization where one is required. TrustLynce does not assess or certify.
Level 2 aligns to the 800-171 control set. CMMC adds the verification and assessment program around it.
Other frameworks
Evidence collected for one framework carries into the next.
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.