CMMC Compliance for Ohio Defense Contractors
CMMC 2.0 is flowing into DoD contracts across the supply chain. If your Ohio company touches CUI as a prime or a sub, the network controls have to match.
Rings Jonathan and the team 24x7.
400+ carriers and platforms, compared.
The flow-down nobody plans for
The Cybersecurity Maturity Model Certification framework is being phased into DoD contracts. If your company handles Controlled Unclassified Information or Federal Contract Information - or subcontracts to someone who does - you have obligations before your next contract is at risk.
Ohio's defense industrial base is concentrated around Wright-Patterson in the Dayton area, Columbus, and Northeast Ohio, but CMMC applies anywhere in the DoD supply chain regardless of location or contract size. The common mistake: assuming a prime's certification covers you. It does not. Each company that handles CUI is independently responsible.
Our scope is the network and communications infrastructure - access control, audit logging, system and communications protection, configuration management. We are an advisor, not a C3PAO and not an assessor. We cannot certify you, and any vendor who says they can is selling something.
CMMC 2.0 levels
Which level applies depends on what data you handle and how the contract is written.
| Level | Practices | Assessment |
|---|---|---|
| Foundational (Level 1) | 15 practices - basic cyber hygiene covering access control, identification, media and physical protection | Annual self-assessment |
| Advanced (Level 2) | 110 practices based on NIST SP 800-171, required for handling CUI | Third-party C3PAO assessment for prioritized acquisitions; self-assessment otherwise |
| Expert (Level 3) | 110+ practices based on NIST SP 800-172 | Government-led assessment, highest-priority programs only |
The technical controls we coordinate
Level 2 covers 110 practices across 14 domains. These are the network and communications domains we work in.
- CUI network segmentation - a documented boundary isolating systems that process, store, or transmit CUI from corporate IT.
- Access Control (AC) - role-based access to CUI, session termination, remote access controls, wireless restrictions.
- Audit and Accountability (AU) - logging of all CUI system access, log integrity protection, retention, and alerting.
- System and Communications Protection (SC) - TLS 1.2 or better, FIPS-validated cryptography where required, boundary protection.
- Identification and Authentication (IA) - MFA on organizational systems and CUI, including remote and privileged access.
- Configuration Management (CM) - baseline configurations, documented change control, and settings recorded for your SSP.
How readiness runs
Gap assessment against NIST 800-171
We review network architecture, access controls, audit logging, and communications security against the 110 practices. You get a written report scored practice by practice, in the format an assessor uses.
CUI boundary design
We define and document the systems, networks, and users in scope. This is the foundation of your System Security Plan and the starting point for every other control.
Technical control implementation
Segmentation, access controls, MFA, audit logging, and communications encryption get implemented alongside your existing IT team, with documentation written for the SSP.
POA&M and ongoing monitoring
The partner we place maintains the Plan of Action and Milestones and monitors the CUI environment. We source that partner, hold them to it, and keep the documentation current so you are assessment-ready on any given day.
CMMC compliance FAQ
Do I need CMMC as a subcontractor?
What changes between Level 1 and Level 2?
Can a small contractor self-assess?
How does CMMC affect our phone system?
Do you write the System Security Plan?
Related
Free tools to use before your next renewal
Practical, fillable tools from a 23-year independent technology advisor. Use them yourself, or have us ru...
Read →HIPAA compliance in OhioHIPAA Compliance for Ohio Healthcare Organizations
Most Ohio healthcare organizations have the administrative policies. The technical safeguards on the phone sys...
Read →SOC 2 readiness in OhioSOC 2 Type II Compliance for Ohio Organizations
Enterprise customers and investors ask for Type II. We coordinate the network infrastructure controls your aud...
Read →Know where you score before an assessor does.
Free gap assessment against NIST SP 800-171, written practice by practice.
Book a call