The Cybersecurity Maturity Model Certification Level 2 framework requires implementation of all 110 controls defined in NIST Special Publication 800-171 Revision 2. For large defense primes, this is a matter of compliance program management. For small businesses, it is a significant organizational undertaking that most treat as aspirational rather than operational.
Forge & Flight Holdings completed its CMMC Level 2 self-assessment with a SPRS score of 110/110 — all 110 controls implemented — and uploaded the score to sprs.csd.disa.mil in May 2026. Here is what that process involved and why it matters for defense acquisition.
Why CMMC Level 2 Matters for Small Defense Companies
DoD contracts involving Controlled Unclassified Information (CUI) require CMMC Level 2 compliance. This covers a broad range of acquisition categories — UAS platform sales, software licenses, technical data packages, and many professional services contracts where sensitive program information is exchanged.
For small businesses, the practical stakes are straightforward: without a documented SPRS score above the 88-point conditional threshold, you are excluded from a significant portion of the DoD acquisition pipeline. With a 110/110 score, you are not only eligible — you are competitive against primes who may carry partial compliance records.
The 110 Controls and What They Actually Cover
NIST SP 800-171 Rev. 2 organizes its 110 controls across 14 control families. For a small manufacturer, the domains with the most implementation work are typically:
Access Control (22 controls): User account management, multi-factor authentication, least privilege enforcement, and session management across all systems handling CUI.
System and Communications Protection (24 controls): Network segmentation, encrypted communications, boundary protection, and — historically the most common gap for small businesses — FIPS-validated cryptography for VPN and remote access.
Audit and Accountability (9 controls): Logging, log review, and tamper-evident audit trails for all systems touching CUI.
Configuration Management (9 controls): Baseline configurations, change control, and software execution policies.
For most small defense companies, the FIPS-validated cryptography requirement (SC.L2-3.13.11) is where the gap lives. Commercial VPN and remote access tools often do not use FIPS-validated modules by default. Resolving it requires either migrating to FIPS-validated alternatives or implementing compensating controls with documented rationale.
What Closing All 110 Controls Required
The path to 110/110 involved five parallel workstreams:
Documentation: System Security Plan covering all 110 controls with implementation descriptions. Hardware and software inventory. CUI handling procedures. Incident response plan. This documentation alone runs several hundred pages for a full implementation.
Technical implementation: MFA across all systems, network segmentation separating CUI-handling environments, endpoint management, encrypted communications at all layers, and FIPS-validated cryptography for remote access.
CI/CD pipeline security: All repositories configured with automated security scanning — static analysis, dependency auditing, and container hardening as part of every build. This addresses several Configuration Management and Risk Assessment controls simultaneously.
Vendor management: Ensuring all third-party tools and platforms handling CUI also meet the baseline. Cloud infrastructure, communication platforms, and development tools all required review.
Ongoing monitoring: CMMC Level 2 is not a point-in-time certification — it requires continuous monitoring, periodic internal review, and maintained documentation. Building the monitoring infrastructure is part of the work.
C3PAO Third-Party Assessment
Self-assessment and SPRS upload establishes conditional Level 2 eligibility. Full Level 2 certification requires a C3PAO (Certified Third-Party Assessor Organization) assessment. Our C3PAO engagement is scheduled for late 2026.
For procurements requiring assessed Level 2 certification rather than self-assessed, the C3PAO assessment provides the formal certification artifact. Most current DoD solicitations below the $10M threshold accept self-assessed SPRS scores for Level 2 eligibility.
What This Means for DoD Buyers
When evaluating a small defense technology vendor, ask for:
- Their SPRS score and upload date — verifiable at sprs.csd.disa.mil
- Whether they have a current System Security Plan on file
- Whether their CI/CD pipeline includes automated security scanning
- Their C3PAO assessment timeline
Forge & Flight Holdings is fully documented on all four. View our compliance credentials →