How to Prepare for CMMC Certification and Strengthen Cybersecurity

If you’ve heard, “We can’t award the PO until your CMMC status shows up in SPRS,” you already know how real the pressure is for defense suppliers and contractors.

The Cybersecurity Maturity Model Certification (CMMC) is reshaping how the Department of Defense (DoD) ensures its supply chain protects sensitive data. For QT9 Software customers, understanding how to address CMMC readiness is essential to maintaining compliance and earning future defense work, especially since Phase 1 enforcement begins November 10, 2025.

In a recent QT9 Q-CAST episode, QT9 spoke with Rhia Dancel, Senior Manager of Information Security at NSF, to demystify CMMC and share what businesses can do to prepare.

Contents

Why CMMC was created

The three CMMC levels

Who needs CMMC certification?

How to prepare for CMMC compliance

How long should CMMC readiness take?

The bottom line

Why CMMC was created

Before CMMC, DoD contractors self-attested compliance with NIST 800-171, a set of cybersecurity guidelines from the U.S. National Institute of Standards and Technology for protecting Controlled Unclassified Information (CUI) in non-federal systems. Unfortunately, many lacked verification data.

As Dancel noted, while intentions may have been sound, good intentions do not equate to secure. CMMC was created to fix that gap by introducing third-party validation.

With CMMC, each organization must demonstrate cybersecurity maturity through documented evidence and certified assessments. CMMC ensures that organizations handling government data can prove their systems and processes are secure.

There are three levels of CMMC certification follow:

1. Level 1: Basic safeguarding

Focus: 15 foundational cybersecurity controls

Applies to: Companies handling Federal Contract Information (FCI)

2. Level 2: Advanced

Focus: Aligns with NIST 800-171;includes all 320 objectives

Applies to: Companies handling Controlled Unclassified Information (CUI)

3. Level 3: Expert

Focus: Adds NIST 800-172  protections for advanced persistent threats (APTs)

Applies to: High-priority defense programs; assessed by Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)

Most QT9 customers working in defense, life sciences or manufacturing likely fall under Level 1 or Level 2, depending on the type of information managed.

Who needs CMMC certification?

Any contractor, subcontractor or supplier in the U.S. Department of Defense supply chain that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must be CMMC compliant. This includes companies of all sizes, from prime contractors to small businesses and even cloud service providers that process or store this data. 

Major primes (think Boeing or Lockheed Martin) are already flowing down CMMC requirements to their supplier, said Dancel. By 2028, every new DoD contract will require CMMC compliance.

Two federal rules define this rollout:

• 32 CFR, Part 170: Implements the CMMC framework
• 48 CFR: Makes CMMC a contractual requirement starting November 10, 2025

How to prepare for CMMC compliance

CMMC readiness takes planning, documentation and structure. Dancel recommends beginning preparations now, before the 48 CFR rule drives up demand for certified assessors.

Here’s a five-step starting point:

1. Conduct a self-assessment

Review your practices against NIST 800-171 controls to identify and document security gaps.

2. Build a System Security Plan (SSP)

Your SSP should describe how each control is implemented and how data is protected.

3. Create a network diagram and asset inventory

Define the systems, software and hardware that process or store FCI or CUI. Make sure the documentation aligns across all sources.

4. Document everything

“If it’s not documented, it didn’t happen,” says Dancel. Even informal practices must be recorded and supported with evidence.

5. Engage a Certified Third-Party Assessment Organization (C3PAO)

Schedule a mock assessment or readiness review with an approved C3PAO like NSF to verify that you’re ready for an official audit.

How long should CMMC readiness take?

Even if you don’t handle CUI, completing a Level 1 self-assessment helps demonstrate a mature cybersecurity posture. It signals trust to partners, primes and customers across regulated markets.

QT9’s Quality Management System (QMS) and Enterprise Resource Planning (ERP) solutions already help companies document, track and manage compliance tasks seamlessly, supporting the same documentation discipline required under CMMC.

The bottom line

CMMC is all about making sure sensitive information is protected.

For QT9 customers, the best steps now are to understand their data – FCI or CUI – and prepare detailed documentation and evidence of security controls. And, as Dancel notes, engage with a C3PAO before assessment demand peaks.

Failing to meet your CMMC level may make you ineligible for contracts associated with the DoD. Preparing now means your organization will be ready when, perhaps, your competitors are not.