Cybersecurity Maturity Model Certification (CMMC): A road map to compliance

    government contracting fema

    With the Department of Defense finalizing its plans to start incorporating CMMC requirements into its RFIs and RFPs (requests for information/proposals), many contractors may still be uncertain where to begin. We’ve got you covered.

    Use our high-level road map to help get you started on your journey toward compliance.

    1. Confirm your scope includes Controlled Unclassified Information (CUI) and thus seeking CMMC level 2 status.

    2. Review the CMMC framework to understand the practices and processes your organization will need to meet Level 2 maturity requirements.

    3. Conduct a preparedness assessment – work with a third party or with your team to identify technical gaps in existing vs. required practices.

    4. Develop and implement practices that are found to be non-existent (or fixes for those determined to be partially implemented) based on the results of the assessment.

    5. Deploy technical solutions where needed.

    6. Remediate other process gaps as identified in the preparedness assessment.

    7. If the organization’s SPRS score is greater than 85, identify/select a CMMC Third-Party Assessor Organization (C3PAO) firm for your CMMC audit. 

    8. Obtain your desired CMMC level maturity certification based on the audit.


    Bhavesh Vadhani, Principal, Technology Risk, Cybersecurity, and Privacy


    Subject matter expertise

    • Bhavesh Vadhani
      Contact Bhavesh Bhavesh+Vadhani
      Bhavesh Vadhani

      CISA, CRISC, CGEIT, PMP, CDPSE, Principal, Global Leader, Cybersecurity, Technology Risk, and Privacy

    • Kristen Soles headshot
      Contact Kristen Kristen+Soles
      Kristen Soles

      CPA, Partner - Managing Partner, Advisory - Global Consulting Solutions and Government Contracting Industry Leader

    • Close


      Let’s start a conversation about your company’s strategic goals and vision for the future.

      Please fill all required fields*

      Please verify your information and check to see if all require fields have been filled in.

      Please select job function
      Please select job level
      Please select country
      Please select state
      Please select industry
      Please select topic

    Access Our Resources for Cybersecurity Maturity Model Certification (CMMC)

    This has been prepared for information purposes and general guidance only and does not constitute legal or professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is made as to the accuracy or completeness of the information contained in this publication, and CohnReznick LLP, its partners, employees and agents accept no liability, and disclaim all responsibility, for the consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it.