Concordant helps defense contractors protect CUI, understand CMMC expectations, and move from uncertainty to assessment readiness with clear guidance, disciplined execution, and practical cybersecurity experience.
Build Your CMMC Environment
From the contract to the technology behind it, Concordant brings a full range of capabilities under one roof, providing you with one accountable partner.
A practical CMMC roadmap that turns requirements into action, so your team always knows what comes next:
Mock Assessment & Audit Prep
A structured readiness review modeled on the CMMC Assessment Process, designed to look and feel like the real assessment before the formal process begins. Instead of a certification decision, you receive a prioritized action plan that identifies readiness gaps, evidence weaknesses, control concerns, and practical next steps to improve your assessment posture.
What you get
A practical assessment-readiness review that shows where you are strong, where you are exposed, and what needs to be corrected before assessment. The goal is not more paperwork, it is clear visibility into whether your environment, evidence, and team can support the claims you will need to make.
The Process
Why work with Concordant
Concordant built its own GCC High environment and completed a CMMC Level 2 C3PAO assessment and DIBCAC assessment.
Certifications
CMMC Level 2
ISO 9001
CyberAB RPO
Certified C3PAO
Frequently Asked Questions
Common CMMC questions answered in plain English, with practical guidance to help you understand your scope, readiness path, and next step.
Federal Contract Information (FCI)
Controlled Unclassified Information (CUI)
Higher-risk programs
Level 03
What is CMMC?
CMMC, or Cybersecurity Maturity Model Certification, is the Department of Defense program for verifying that defense contractors are protecting Federal Contract Information and Controlled Unclassified Information. For many contractors, CMMC determines what cybersecurity requirements apply and what type of assessment is required.
What are the CMMC levels?
CMMC has three levels: Level 1 applies to contractors that handle Federal Contract Information or FCI and is generally self-assessed. Level 2 applies to contractors that handle Controlled Unclassified Information or CUI and is based on the 110 security requirements in NIST SP 800-171. Many Level 2 organizations require a third-party assessment. Level 3 applies to higher-risk programs and includes additional requirements based on NIST SP 800-172.
Readiness vs. the official assessment?
Readiness is the preparation work: confirming scope, closing gaps, improving documentation, organizing evidence, and making sure your team can explain how controls work. The official assessment is the formal CMMC certification assessment conducted by an authorized C3PAO for organizations seeking certification. Concordant helps customers prepare for that process, and once authorized as a C3PAO, will also conduct official CMMC certification assessments for eligible organizations.
How long does CMMC take?
Most organizations spend several months preparing for CMMC, depending on their required level, current cybersecurity posture, documentation quality, technical environment, and available internal resources. Concordant helps identify the practical path from your current state to assessment readiness. It can take anywhere from 2 weeks for an assessment to several months if beginning at step 1.
How much does it cost?
CMMC cost depends on your organization size, required level, CUI scope, number of systems and locations, existing security posture, remediation needs, and assessment path. Concordant helps scope the effort before you commit budget in the wrong direction.
Can you do a practice assessment first?
Yes. Concordant's Mock Assessment & Audit Prep support is designed to identify gaps while there is still time to fix them, organize evidence, and help your team understand what to expect during a formal assessment.
What is a C3PAO?
A C3PAO, or Certified Third-Party Assessor Organization, is an organization authorized by the Cyber AB to conduct official CMMC third-party assessments.
What happens after we're ready?
Once your organization is ready, the next step is to engage an authorized C3PAO for the official assessment. Concordant can help you prepare for that process and, once authorized as a C3PAO, provide official assessment services for eligible organizations.
What is CUI, and how do I know if I have it?
Controlled Unclassified Information, or CUI, is unclassified information that still requires safeguarding or dissemination controls under law, regulation, or government-wide policy. You may have CUI if your contract, prime contractor, drawings, technical data, specifications, reports, system exports, or other project information is marked as CUI or is provided under requirements that call for CUI protection. The right answer depends on your contracts, information flow, and how that information moves through your systems.
What is FCI, and how is it different from CUI?
Federal Contract Information, or FCI, is non-public information provided by or generated for the Government under a contract. CUI is more sensitive and has specific safeguarding or dissemination requirements. The simple difference: FCI supports contract performance and is not intended for public release. CUI requires stronger protection because a law, regulation, or government-wide policy says it must be controlled.
Do subcontractors need CMMC?
Yes, subcontractors may need CMMC if they process, store, or transmit FCI or CUI as part of DoD contract work. CMMC requirements can flow down through the supply chain, not just to prime contractors. If a subcontractor only handles FCI, Level 1 may apply. If a subcontractor handles CUI, Level 2 is usually the minimum starting point, and a third-party assessment may be required depending on the contract and prime flow-down requirements.
What is a CMMC scope boundary?
A CMMC scope boundary defines the people, systems, facilities, applications, cloud services, external service providers, and processes that are included in the assessment. For Level 2, the boundary centers on where CUI is processed, stored, or transmitted, along with assets that provide security protection for that environment. Getting the boundary right matters because overscoping can waste money, and underscoping can create assessment risk.
What evidence do assessors expect to see?
Assessors expect evidence that security requirements are not just documented, but implemented and operating. That may include policies, procedures, system security plans, asset inventories, network diagrams, screenshots, configuration settings, logs, tickets, training records, access reviews, incident response records, and interviews with people who operate the environment. The best evidence is current, specific to your environment, and tied directly to how your organization actually protects CUI.
Can we use cloud or MSP services for CMMC?
Yes, but they must be handled correctly in your CMMC scope. Cloud services that process, store, or transmit CUI generally need to meet FedRAMP Moderate or equivalent requirements. MSPs, MSSPs, and other external service providers may also be in scope if their services support the CUI environment. The key is to document the relationship, define shared responsibilities, and make sure your System Security Plan explains what the provider does, what your organization does, and what evidence supports that model.
What is a POA&M, and when is it allowed?
A Plan of Action and Milestones, or POA&M, identifies security gaps, the actions needed to close them, required resources, milestones, and completion dates. For CMMC, POA&Ms are limited. They are not allowed for Level 1 self-assessments. For Level 2 and Level 3, they may be allowed only for certain unmet requirements and only when the organization meets the required conditions for a conditional CMMC status. Open CMMC POA&M items must be closed within 180 days.
What is an SPRS score?
An SPRS score is the score reported in the Supplier Performance Risk System based on the DoD assessment methodology for NIST SP 800-171 implementation. DoD uses SPRS to review contractor cybersecurity assessment information, including CMMC status, scores, and affirmations. In practical terms, your SPRS score is one way DoD sees whether your organization has assessed its implementation of required cybersecurity controls.
What should leadership do first?
Leadership should start by confirming the business problem before buying tools or writing policies. That means identifying which contracts may require CMMC, whether the organization handles FCI or CUI, where that information flows, what systems and providers are involved, and what level of assessment may apply. From there, leadership should assign ownership, define the CMMC scope, understand the current gaps, and build a practical roadmap with budget, timeline, and accountability.
