CMMC, or Cybersecurity Maturity Model Certification, is the Department of Defense’s cybersecurity assessment program for verifying that defense contractors and subcontractors are protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) on contractor information systems. Beginning November 10, 2025, the DoD began incorporating CMMC requirements into applicable solicitations and contracts through DFARS 252.204-7021. If your company bids on DoD work and will process, store, or transmit FCI or CUI, the solicitation will specify the required CMMC level, and your company must have the required CMMC status before award and maintain compliance during contract performance.

Yes, CMMC requirements can apply to small subcontractors. CMMC flows down from prime contractors to subcontractors when the subcontractor will process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on contractor information systems during performance of a DoD contract. If you handle FCI only, you may need CMMC Level 1; if you handle CUI, you may need CMMC Level 2 or higher, depending on the solicitation and flowdown requirements. This app is designed to help small and mid-sized businesses understand and prepare for those requirements without needing a large in-house compliance team.

Ignoring CMMC compliance can put your Defense business at risk. If a solicitation requires CMMC and your company does not have the required current CMMC Status in SPRS, you may be ineligible for contract award. For existing contracts, failing to maintain required cybersecurity compliance may create contract performance issues, affect option exercises or extensions, and increase legal and financial risk, especially if inaccurate cybersecurity scores, assessments, or affirmations were submitted. Preparing early is typically far less costly than losing access to Defense contract opportunities.

An annual affirmation is the required yearly confirmation by the company's Affirming Official that the organization continues to comply with the CMMC requirements for its current CMMC Status. Under 32 CFR Part 170, affirmations are required for all CMMC levels at the time of assessment and annually thereafter. The app helps maintain continuous CMMC compliance by centralizing policies, evidence, assessments, Plans of Action and Milestones (POA&Ms), and other supporting documentation in one place. This gives the Affirming Official a clear view of the organization's compliance posture, making it easier to verify that required controls remain in place before submitting the annual affirmation. While supporting documentation is not submitted to SPRS, the app helps to maintain an organized, traceable record of compliance that can help substantiate the organization's affirmation during a future CMMC assessment, audit, or contractual review.