With the official rollout of Cybersecurity Maturity Model Certification (CMMC) 2.0, the U.S. Department of Defense (DoD) has drawn a firm line in the sand:
No certification, no contracts.
Whether you’re a prime contractor or a subcontractor in the Defense Industrial Base (DIB), CMMC compliance is now required—not optional, not delayed, and not something you can simply delegate away.
CMMC: What It Is and What It Isn’t
CMMC 2.0 is a tiered framework that mandates specific cybersecurity practices depending on the type of information you handle.
CMMC: Level 1
Protects Federal Contract Information (FCI)
Any contractor or subcontractor handling basic government contract work, even if they don’t work with sensitive data.
Definition of FCI (Federal Contract Information):
Information provided by or generated for the government under a contract that isn’t intended for public release. This includes operational details, internal policies, pricing structures, schedules, or performance requirements.
Example of FCI:
-
A project schedule for supplying materials to a military base
-
A quote or proposal submitted to the DoD that includes internal cost details
-
Internal communications about a delivery timeline for federal supplies
What Level 1 Covers:
-
15 basic cybersecurity practices from FAR 52.204-21
-
Examples:
-
Require passwords for all devices
-
Enable firewalls
-
Train staff on security basics
-
Limit system access to authorized users only
-
Level 1 is a minimum bar—many organizations will need Level 2 due to how easily FCI can overlap with CUI.
CMMC: Level 2
Protects Controlled Unclassified Information (CUI)
Contractors handling sensitive data related to national security that is not classified—but still restricted.
Definition of CUI (Controlled Unclassified Information):
Government-created or owned information that requires safeguarding under laws, regulations, or policies, but is not classified.
Examples of CUI:
-
Blueprints or technical specs for defense equipment
-
Communications about weapons systems
-
Test data for military-grade components
-
Training procedures for DoD personnel
-
Export-controlled data (ITAR/EAR-regulated)
What Level 2 Covers:
-
110 security practices from NIST SP 800-171
-
Covers 14 control families, including:
-
Access control
-
Multifactor authentication
-
Data encryption
-
Logging and monitoring
-
Incident response
-
Vulnerability management
-
Risk assessment and documentation
-
This is where Microsoft 365 + expert implementation becomes essential. Most small to mid-sized contractors fall into Level 2, especially if they are manufacturers, suppliers, or tech partners in the defense space.
CMMC: Level 3
Adds advanced protections for high-priority defense work
Organizations working on critical national security projects, such as:
-
Nuclear command systems
-
Missile defense programs
-
Cyber warfare tools
-
Satellite communication or surveillance tech
What Level 3 Covers:
-
All 110 controls from NIST 800-171, plus 24 extra controls from NIST 800-172
-
Designed to defend against Advanced Persistent Threats (APTs)
-
Requires Government-led or C3PAO-led assessments
-
Emphasis on continuous monitoring, system hardening, and advanced logging
Very few companies require Level 3—but it represents the gold standard for cybersecurity maturity.
The Myth of the “Easy Button”
Some organizations believe that an IT provider like Kosh can “make them compliant” with just a few technology tweaks.
That’s not how this works.
CMMC is not a tool you can install or a form you can sign. It’s a comprehensive cybersecurity maturity framework.
While Kosh Solutions plays a key role in implementing and managing technical safeguards, true CMMC compliance spans your entire organization:
-
HR policies around offboarding
-
Physical security of your building
-
Background checks for employees
-
Supply chain/vendor risk management
-
Internal risk assessments
-
Policy documentation and training
Kosh cannot “make you compliant.”
But we can support your journey by implementing and managing many of the technical controls required.
Kosh's Role in Your CMMC Compliance
Area
Kosh's Role
Firewalls, MFA, antivirus, patching, backups
Implemented and managed by Kosh (if within your service agreement)
Policy writing, HR documentation, risk management, CUI scope mapping
Not managed by Kosh
Acting as your CMMC compliance officer
Kosh is not your compliance authority
Supporting third-party assessors during audit prep
Yes, we can assist with documentation and evidence of the controls we manage
Why It’s Harder Than You Think
CMMC cannot be rushed. Even companies with mature IT systems often need 6–12 months to reach full readiness. That’s because:
-
All 110+ controls at Level 2 must be in place and fully documented
-
You must prove consistent implementation across people, process, and technology
-
Assessors are looking for maturity, not just checkboxes
-
No Certification = No Contract
-
CMMC is required before you win a contract, not after
-
Prime contractors will soon exclude subcontractors without certification
-
The reputational and financial risks of non-compliance are enormous
This is not just an IT issue. It’s a revenue issue, a reputation issue, and a survivability issue.
The Business Risk of Waiting
Turning Compliance into Opportunity
Done right, CMMC compliance strengthens your business:
-
Fewer cyber incidents
-
Higher operational efficiency
-
Preferred status with prime contractors
-
Competitive edge in a tightening market
What to Do Now
If you’re in the DIB, don’t delay:
-
Conduct a gap analysis (we can recommend partners)
-
Define your CUI scope
-
Prioritize critical technical controls
-
Develop internal policies and training
-
Engage a C3PAO (certified assessor) early
Kosh Solutions is here to support the technical side of your compliance. Let’s work together to ensure your IT systems are ready—but remember, compliance is your responsibility.
Ready to Strengthen Your Compliance Strategy?
Kosh Solutions is helping defense contractors across the Southwest modernize their cybersecurity infrastructure and prepare for CMMC readiness.
Whether you need to secure Microsoft 365, implement technical controls, or understand where to start—we can help you take the next right step.
Start with a conversation.
Let’s talk about how your current IT environment aligns with CMMC expectations—and what adjustments might be needed to support your certification path.
Contact us today to schedule a free discovery call.
You bring your questions—we’ll bring clarity.
CMMC isn't just a cybersecurity framework - it's now the cost of doing business with DoD.
Let’s stop thinking of compliance as a hurdle, and start treating it as what it truly is: a competitive advantage in a high-stakes landscape.
Disclaimer
The information contained in this communication is intended for limited use for informational purposes only. It is not considered professional advice; instead, it is general information that may or may not apply to specific situations. Each case is unique and should be evaluated on its own by a professional qualified to provide advice specifically intended to protect your individual situation. Kosh is not liable for improper use of this information.