// The Shield Path · CMMC for small shops

CMMC you can start today, without a security department.

If you hold or bid on DoD work, you already owe a yearly self-assessment and a signed affirmation. Level 1 is 15 safeguards for contract information. Level 2 is the 110 controls of NIST SP 800-171 for CUI. The Shield Path walks you through either one in six steps, and you can do every step yourself.

Find my level (2 min)Book a $250 Gap Assessment

Where CMMC stands right now

Last checked 2026-10-18

Paused

  • Phase 2 third-party (C3PAO) Level 2 certification, originally set for Nov 10, 2026. Paused by the DoW CIO on July 13, 2026.
  • Third-party requirements are being removed from contracts at the next option or modification (Class Deviation 2026-O0025, Rev 3).
  • A CMMC Reform Task Force report has been delivered but not published. There is no restart date.

Still in force

  • Level 1 and Level 2 self-assessments, scored in SPRS.
  • An annual affirmation signed by a senior official of your company.
  • DFARS 252.204-7012 and NIST SP 800-171, including incident reporting.
  • False Claims Act exposure for inaccurate affirmations.
  • Prime contractors can still set their own supplier deadlines.

The six steps below don't depend on how the pause ends. Whatever the Task Force decides, the safeguards are the same.

// Step zero

Find my level

Four questions. No email needed.

level-finder0 / 4 answered
1. Do you hold, or bid on, DoD contracts or subcontracts?
2. Do you receive anything marked CUI, or does your contract include DFARS 252.204-7012?

CUI is Controlled Unclassified Information: drawings, specs or technical data the government marks as controlled.

3. Has a prime or buyer asked you for an SPRS score or a CMMC level?
4. Where does contract information mostly live today?

This one doesn't change your level. It shapes how big your scope is in step 1.

Waiting for answers

Answer the first two questions to see your level.

Most shops with DoD work land on Level 1. Level 2 applies only when CUI is in the picture.

// The framework

The Shield Path, in six steps

Each step has what to do yourself, what a finished step looks like, and where we can take it off your plate.

  1. 1

    Scope

    Level 1: scope is wherever Federal Contract Information lives. For most shops that is email and the file share.

    Do it yourself
    • List where contract information arrives (email, portals, drawings), where it is stored and where it goes.
    • Name the people, laptops, phones, cloud apps and shop-floor machines that touch it.
    • If CUI only touches a few people, consider an enclave to keep scope small.
    Done looks like

    A one-page data-flow sketch and a list of the systems in scope.

    Where we help

    The Gap Assessment confirms your level and draws the boundary with you.

  2. 2

    Baseline

    Level 1: 15 safeguards from FAR 52.204-21.

    Do it yourself
    • Run the self-check below, one safeguard at a time.
    • Answer for how the shop runs today, not how it should run.
    • Write down evidence as you go: a screenshot, a setting, a date.
    Done looks like

    A scored checklist and a list of gaps.

    Where we help

    We map your answers, or a prime's questionnaire, against the framework and rank the gaps.

  3. 3

    Fix the basics first

    Level 1: every gap must be closed before you affirm. There is no plan-it-later option.

    Do it yourself
    • Turn on and enforce MFA for email and remote access.
    • Run real endpoint protection on every laptop and keep it updated.
    • Patch on a schedule, and restore one file from backup to prove backups work.
    • Remove accounts for people who've left, and keep shop-floor machines off the office network.
    Done looks like

    Each fix recorded with its evidence: a screenshot, a setting or a date.

    Where we help

    The retainer starts here, highest-impact gaps first, working alongside your MSP.

  4. 4

    Document

    Level 1: an SSP isn't required, but it makes the annual re-check fast.

    Do it yourself
    • Write short policies (one to two pages each) for access, passwords and MFA, incidents and media disposal.
    • Write a System Security Plan that says what's in scope and how each requirement is met.
    • Keep evidence in one folder, named by requirement.
    Done looks like

    An SSP, your policies and an evidence folder.

    Where we help

    We draft the SSP and policies in plain language your team will actually follow.

  5. 5

    Score and sign

    Level 1: self-assess and affirm every year in SPRS.

    Do it yourself
    • Enter your self-assessment in SPRS (the Supplier Performance Risk System).
    • Have a senior official review the evidence and sign the affirmation.
    • Only affirm what's true today.
    Done looks like

    An SPRS entry and a signed affirmation on file.

    Where we help

    We prepare the score and the evidence packet. You review it and sign. We never sign for you.

  6. 6

    Maintain

    Level 1: re-affirm every year.

    Do it yourself
    • Put the annual re-check and affirmation on the calendar with an owner.
    • Update the SSP whenever systems or people change.
    • Know who you call, and how fast you must report, if something goes wrong.
    Done looks like

    A calendar with owners, and an incident contact list everyone can find.

    Where we help

    Optional check-ins so the next affirmation takes an afternoon, not a month.

// Step 2, hands on

Level 1 self-check

The 15 FAR 52.204-21 safeguards in plain English. Level 1 has no partial credit: every one must be met before you affirm.

level-1-self-check
0 / 15 met
Met 0Partly or not sure 0Not met 0Unanswered 15
  • FAR 52.204-21 b.1.iLimit access to authorized users and devicesOnly current staff and company devices can get in. People who've left are removed.
  • FAR 52.204-21 b.1.iiLimit what each user can doStaff don't use admin accounts for daily work, and shared folders are limited to the people who need them.
  • FAR 52.204-21 b.1.iiiControl connections to outside systemsYou know which personal devices and outside services connect, and you allow them on purpose.
  • FAR 52.204-21 b.1.ivControl what's posted publiclySomeone checks that the website and social posts don't expose contract information.
  • FAR 52.204-21 b.1.vIdentify users and devicesNo shared logins. You can list every user and every company device.
  • FAR 52.204-21 b.1.viVerify identities before accessEveryone logs in with their own credentials, and MFA is enforced on email and remote access.
  • FAR 52.204-21 b.1.viiWipe or destroy old mediaOld drives, laptops and USB sticks are wiped or shredded before disposal or reuse.
  • FAR 52.204-21 b.1.viiiLimit physical accessOffices, server closets and equipment are locked, and only authorized people get in.
  • FAR 52.204-21 b.1.ixEscort and log visitors, and manage keysVisitors sign in and are escorted. Keys, fobs and codes are tracked and changed when people leave.
  • FAR 52.204-21 b.1.xProtect the network edgeA firewall controls what goes in and out, and remote access is locked down.
  • FAR 52.204-21 b.1.xiSeparate public-facing systemsYour website, guest Wi-Fi and anything public sit apart from the internal network.
  • FAR 52.204-21 b.1.xiiFind and fix system flaws on timeWindows, apps, firewalls and routers get patched on a schedule.
  • FAR 52.204-21 b.1.xiiiProtect against malicious codeEvery computer runs endpoint protection (antivirus/EDR).
  • FAR 52.204-21 b.1.xivKeep malware protection up to dateEndpoint protection updates itself automatically.
  • FAR 52.204-21 b.1.xvScan files and downloadsEndpoint protection scans files from email, USB drives and the web as they arrive, plus regular full scans.

Fix these first

Mark anything as Partly, No or Not sure and it shows up here, highest impact first.

Keep your results

Level 2? It's 110 controls in 14 families.

That's a project, not a checklist. Your SPRS score runs from −203 to 110. Start with the Gap Assessment so you score the right systems.

Access Control22
Awareness & Training3
Audit & Accountability9
Configuration Mgmt9
Identification & Auth11
Incident Response3
Maintenance6
Media Protection9
Personnel Security2
Physical Protection6
Risk Assessment3
Security Assessment4
System & Comms Protection16
System & Info Integrity7
// Do it yourself, or hand it to us

Everything above is free. Here's where we come in.

You keep your MSP. We prepare, you sign.

Start here if you're unsure

External Security Health Check

$0

What anyone on the internet can already see about your website and email, in plain English. No agent on your network and no passwords.

Book the free check
Recommended next step

Gap Assessment

$250
  • Confirms your level and what's in scope
  • Maps your setup, or a prime's questionnaire, against the Shield Path
  • Gives you a ranked gap list you can act on yourself
Book a Gap Assessment
After the Gap Assessment

Implementation retainer

$2,800 to start
  • Covers the first few days of hands-on work, highest-impact gaps first
  • Can include the SSP, short policies, POA&M, questionnaire answers and the fixes themselves
  • We quote each next block before it starts
  • You set the pace and can stop at any time. Unused hours carry forward to later work.
Not an auditNot a C3PAONot a certificationWe never sign your affirmation

Prefer to talk? Call (602) 345-1485 · Arcane Digital LLC, Phoenix

Questions owners ask

Is CMMC dead now that Phase 2 is paused?

No. Only the third-party certification rollout is paused. Self-assessments, the yearly affirmation, DFARS 7012 and NIST 800-171 still apply, and a false affirmation can still bring False Claims Act liability.

Do I need Level 2?

Only if you receive, store or send CUI. Many shops with DoD work only have Federal Contract Information, and that is Level 1. If a prime says "Level 2," ask them which CUI you will receive. The Gap Assessment settles this.

Can I affirm Level 1 with a plan to fix gaps later?

No. Level 1 does not allow a Plan of Action and Milestones. All 15 safeguards must be met when you affirm. At Level 2, a POA&M is allowed with limits on score and a deadline to close it.

What's an enclave, and would it save me money?

An enclave is a small, separate environment, often a dedicated cloud tenant, where CUI lives. Only the enclave and the people who use it fall in scope. For a shop where CUI touches a few people, it can shrink a Level 2 project a lot.

Doesn't my MSP already cover this?

Your MSP runs your systems. CMMC also needs scoping, written policies, an SSP and an honest score, and most MSP contracts do not include those. We work alongside your MSP and do not replace it.

Who signs the affirmation?

A senior official of your company. We prepare the evidence and the documents. We never sign on your behalf, and you should be wary of anyone who offers to.

Sources

  • 32 CFR Part 170, CMMC Program rule
  • FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems
  • NIST SP 800-171 Rev 2, Protecting CUI in Nonfederal Systems
  • DFARS 252.204-7012, Safeguarding Covered Defense Information
  • DoD CIO CMMC program pages
  • Phase 2 pause and Class Deviation 2026-O0025 Rev 3, as reported by Secureframe and KSG

General guidance, not legal advice. We count anonymous page activity (which steps people reach) to improve this page. Your answers stay in your browser unless you choose to save them or send feedback. See our privacy policy.