Protek helps small and mid-sized Utah defense contractors and manufacturers meet CMMC Level 1 and Level 2 requirements, protect FCI and CUI, and stay eligible for Department of Defense work. Our team includes a Certified CMMC Professional (CCP).
24/7/365
Monitoring and Support
The Cybersecurity Maturity Model Certification (CMMC) program is the Department of Defense’s way of checking that contractors and subcontractors actually protect the information they handle. If your company stores, processes, or sends Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on its own systems, a DoD contract can require a CMMC status before award, and before an option year is exercised.
CMMC requirements started showing up in DoD solicitations on November 10, 2025 (Phase 1). On July 13, 2026, the Department suspended the Phase 2 rollout that had been planned for November 10, 2026. For now, new contracts can only require Level 1 (Self) or Level 2 (Self). That doesn’t mean CMMC is going away. The program rule (32 CFR Part 170) and the contract clause (DFARS 252.204-7021) are still on the books. The NIST SP 800-171 safeguards in DFARS 252.204-7012 are still required. Self-assessment scores and annual affirmations still go into SPRS.
For a machine shop in West Jordan, an aerospace supplier in Ogden, or an engineering firm in Salt Lake City, that leaves a practical question: what does our contract require today, and how do we get there without stalling the rest of the business? Protek is a managed IT and cybersecurity provider based in Sandy, Utah. We help Wasatch Front companies answer that question and then do the technical work.
Trusted By
Our Partners
Get the level your contracts require, scoped to your business and budget.
If you only handle FCI, you likely only need Level 1. That means 15 basic safeguarding requirements from FAR 52.204-21, covering access control, user identification and authentication, media disposal, physical security, boundary protection, patching, and malware protection. Protek reviews each requirement with you, closes the gaps, and gathers the evidence. When you’re ready to submit, you have what you need for your annual SPRS entry and affirmation. Level 1 doesn’t allow a POA&M, so every requirement has to be fully met before you affirm.
We expect most contracts involving CUI to call for Level 2 (Self). We assess your environment against all 110 NIST SP 800-171 Rev 2 requirements and calculate your score with the DoD scoring method. Then we build a prioritized remediation plan. You walk away with a clear picture of your score (maximum 110), which items are blocking a passing result, and the documentation you’ll need to submit to SPRS every three years, or when a significant change occurs, and affirm annually. Protek supports our clients with System Security Plan (SSP) generation and policies through IntelliGRC.
Some contracts and some prime contractors may require a third-party Level 2 certification assessment performed by a C3PAO authorized by The Cyber AB. Protek helps you prepare for the assessment by refining your scope, validating evidence against assessment objectives, conducting mock walk-throughs, and guiding your team through the readiness process. This service is billable through Protek. Please note that Protek is not a C3PAO and does not perform certification assessments or issue certifications.
The smaller your CUI footprint, the less you have to protect and assess. We map where FCI and CUI actually flow through your email, file shares, CAD/CAM workstations, ERP, and shop-floor systems. Then we recommend how to contain it, whether that means segmenting your network or setting up a dedicated enclave. Protek deploys and manages Microsoft 365 GCC High and other CUI enclaves.
Most CMMC gaps are fixed with everyday security work: multi-factor authentication, encryption, patching, logging, access control, secure configurations, and backups. As your managed IT and cybersecurity team, Protek does that work and keeps it in place. It’s the same protection described on our Cybersecurity Services page.
CMMC isn’t a one-time project. Every year, a senior official at your company has to affirm in SPRS that the requirements are still met. Protek’s Managed SOC and 24/7/365 monitoring provide the logging, alerting, and incident detection Level 2 expects. Our security team maintains your POA&M and documentation so you’re ready for each affirmation and reassessment. Meanwhile, our vCIO services keep leadership informed with regular reporting and keep your IT budget and goals aligned with your compliance roadmap.
A clear five-step path from contract scope to ongoing compliance.
We review your DoD contracts and flow-down clauses (DFARS 252.204-7012, 252.204-7021), identify which CMMC level your contract requires, and map every system, person, and location that touches FCI or CUI.
We assess your environment against the 15 Level 1 or 110 Level 2 requirements. You get a scored result using the DoD methodology, plus a plain-English report showing what is met, what is not, and what it will take to close each gap. This builds on our IT Audits & Assessments work.
Protek engineers put the technical fixes in place. We also help you build the documentation assessors look for, including the System Security Plan, policies, and evidence, as well as defining a POA&M as needed where compliance allows.
For Level 1 and Level 2 (Self), we support your self-assessment and prepare what your Affirming Official needs to enter scores and affirmations in SPRS. For Level 2 (C3PAO), we prepare you for and support you through the third-party assessment.
We monitor your environment around the clock, track changes that could affect your scope, close any POA&M items within the 180-day window, and get you ready for each annual affirmation and reassessment.
Whether you need a Level 1 self-assessment this year, a Level 2 score you can stand behind in SPRS, or C3PAO readiness for a prime that asks for it, Protek will help you understand where you stand and what it takes to get there. Talk with our team in Sandy.
Sales: (844) 796-1717
542 W 9320 S, Sandy, UT 84070
Work with a team that includes a CCP.
| Level 1 (Self) | Level 2 (Self) | Level 2 (C3PAO) | |
|---|---|---|---|
| Data type protected | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) | Controlled Unclassified Information (CUI) |
| Requirements | 15 (FAR 52.204-21) | 110 (NIST SP 800-171 Rev 2) | 110 (NIST SP 800-171 Rev 2) |
| Who assesses | Your company (self-assessment) | Your company (self-assessment) | An authorized Certified Third-Party Assessment Organization (C3PAO) |
| How often | Every year | Every 3 years | Every 3 years |
| Affirmation in SPRS | After each assessment and annually | After each assessment and annually | After each assessment and annually |
| Where results go | You enter results in SPRS | You enter score in SPRS (e.g., 105 of 110) | C3PAO enters results in CMMC eMASS, which transmits them to SPRS |
| POA&M allowed? | No | Yes, limited; must close within 180 days | Yes, limited; closeout must be verified by a C3PAO within 180 days |
| Status as of Oct 2026 | Can be required in new contracts | Can be required in new contracts | New designations suspended since July 13, 2026; existing requirements to be removed by contract modification |
Table footnote: Level 3 (DIBCAC) covers a small number of programs with the most sensitive CUI. It adds 24 requirements from NIST SP 800-171 Rev 2’s companion, NIST SP 800-172. The assessment is done by the government (DCMA’s Defense Industrial Base Cybersecurity Assessment Center), and you must hold a Final Level 2 (C3PAO) status first. New Level 3 designations are also suspended right now. DoD can’t require C3PAO in new contracts right now, but primes still can.
This page provides general information about the DoD CMMC program as of October 2026 and is not legal advice. CMMC requirements are set by 32 CFR Part 170, the DFARS, and your specific contract, and they are currently under review by the Department. Protek is not a C3PAO and does not issue CMMC certifications.
CMMC compliance means your company has met the cybersecurity requirements for the CMMC level named in your Department of Defense contract, and has a current status for that level in SPRS. CMMC (Cybersecurity Maturity Model Certification) is defined in 32 CFR Part 170 and enforced through DFARS clause 252.204-7021. It applies to contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on their own systems.
Your contract decides your level. If you handle only Federal Contract Information (FCI), you typically need Level 1. If you handle Controlled Unclassified Information (CUI), you typically need Level 2. The solicitation or contract will name the exact status: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC). Subcontractors get their requirement through flow-down from the prime.
CMMC Level 1 has 15 security requirements, taken from FAR clause 52.204-21. CMMC Level 2 has 110 security requirements, taken from NIST SP 800-171 Revision 2. Level 1 requirements must all be fully met. Level 2 is scored out of 110 points, and a limited POA&M is allowed.
Level 1 self-assessments happen every year. Level 2 assessments, whether self-assessed or performed by a C3PAO, happen every three years. At every level, a senior company official must also submit an affirmation of continued compliance in SPRS after each assessment and every year after that. A Level 2 status lapses if the annual affirmation is missed.
An SPRS score is your NIST SP 800-171 assessment result recorded in the DoD’s Supplier Performance Risk System (SPRS). For Level 1 and Level 2 self-assessments, your company enters the results in SPRS. For Level 2, that includes the overall score (for example, 105 out of 110), the assessment scope, CAGE codes, and POA&M status. For a C3PAO assessment, the assessor uploads results to CMMC eMASS, which sends them to SPRS. Contracting officers check SPRS before award.
Yes for Level 2, but not for Level 1. A Level 2 POA&M is allowed only if your score is at least 80% of the 110 requirements (88 points). Each open item also has to be worth 1 point, with a narrow exception for non-FIPS-validated encryption, and certain requirements, such as the System Security Plan, can never be on a POA&M. Every POA&M item must be closed and verified within 180 days, or the conditional status expires.
Not for new contracts at the moment. On July 13, 2026, the Department suspended the Phase 2 rollout that would have started requiring C3PAO assessments on November 10, 2026. During the suspension, new solicitations may only require Level 1 (Self) or Level 2 (Self), and C3PAO requirements in existing contracts are to be removed by modification. The NIST SP 800-171 requirements, SPRS submissions, and annual affirmations still apply. Some primes or future contracts may still ask for C3PAO readiness, so check your contract language.
CMMC Level 3 is the highest level, reserved for a small set of programs with the most sensitive CUI. It adds 24 requirements from NIST SP 800-172 on top of Level 2. Government assessors from DCMA’s DIBCAC perform the assessment, not a C3PAO, and you need a Final Level 2 (C3PAO) status first. New Level 3 designations are suspended along with Phase 2.
This will close in 0 seconds