The Cybersecurity Maturity Model Certification applies to companies in the defense supply chain, prime contractors and their subcontractors alike. Level 1 covers federal contract information, the everyday paperwork of a contract, and asks for 17 basic safeguarding practices drawn from the FAR clause 52.204-21. A company assesses itself every year, records the result in the government’s SPRS system, and a senior official affirms it.
Level 1 is pass or fail: every practice must be met, not a percentage. Most of the 17 are housekeeping rather than expensive technology, such as named user accounts, a locked network closet, a visitor log and antivirus that keeps itself updated. This self-check puts each practice in plain words so you can see where you stand before the affirmation.
If your contracts involve controlled unclassified information, Level 2 applies, with 110 practices and, for many contracts, an assessment by an accredited third party. Our vCISO service runs the gap assessment and builds the system security plan, and our manufacturing IT support covers the plant floor as well as the office.
Click “Send this with the form below”, add your details, and we reply with what it would take to close each gap and, if you need Level 2, how the assessment works.
Any contractor or subcontractor whose Department of Defense contract includes the basic safeguarding clause, which is to say almost anyone who handles federal contract information, even a machine shop making a single part.
For Level 1, yes. The company assesses itself against all 17 practices every year, enters the result in SPRS and a senior official affirms it. Keep the evidence for each practice in one place; a false affirmation carries legal exposure.
Level 2 applies when controlled unclassified information is involved. It has 110 practices from NIST SP 800-171, needs a system security plan, and for most contracts an assessment by a certified third-party organisation every three years.
