Win and keep your DoD contracts with CMMC compliance
If your company handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on a Department of Defense contract, CMMC is now a condition of award. Tech Dispatch, a member of the CMMC ecosystem with CyberAB training, takes you from “where do we start” to an affirmed assessment in SPRS.
Which level do you need?
Level 1 – Foundational
- 15 FAR 52.204-21 requirements (17 practices)
- Annual self-assessment entered in SPRS
- Annual affirmation by a company official
- Every practice must be fully in place
Level 2 – Advanced
- 110 NIST SP 800-171 requirements
- Self-assessment or third-party (C3PAO) assessment, as your contract specifies
- System Security Plan and documented evidence
- Annual affirmation in SPRS
Not sure which applies? Look for DFARS 252.204-7021 or FAR 52.204-21 in your contract, or ask your prime contractor — or just call us and we’ll work it out with you.
How our program works
-
Discovery interview
We meet with your owner or IT lead and walk through a structured questionnaire covering every practice in your level. -
Gap report
You receive a Cybersecurity Exception Register showing exactly what is in place and what is missing, with a quote to close each gap. -
Policies, standards and evidence
We write the required policies, standards, procedures and System Security Plan, and organize the evidence an assessor expects to see. -
Assessment and SPRS affirmation
We sit with you while you create your PIEE account and enter and affirm your assessment in SPRS — or prepare you for your C3PAO assessment at Level 2. -
Stay compliant
Recurring tasks, logs and reviews keep your evidence current, and we remind you before each annual affirmation is due.
What you receive
- Written policies and standards for each CMMC domain
- System Security Plan (SSP)
- Cybersecurity Exception Register (gap report)
- Authorized user, device and role lists
- Step-by-step SPRS self-certification guide
- Ongoing evidence logs and annual review
Closing technical gaps — endpoint protection, MFA, firewall and backup — is quoted separately so you only pay for what you actually need.
Frequently asked questions
What is the difference between CMMC and NIST SP 800-171?
NIST SP 800-171 is the list of security requirements. CMMC is the DoD program that verifies you meet them and records the result in SPRS. Level 2 uses all 110 NIST SP 800-171 requirements; Level 1 uses a basic subset.
Can we self-certify?
Level 1 is always a self-assessment. Level 2 is a self-assessment for some contracts and a third-party (C3PAO) assessment for others — your contract states which.
We are a subcontractor. Does this apply to us?
Yes. CMMC requirements flow down to subcontractors that handle FCI or CUI, and your prime contractor will ask for your SPRS status.
What happens if we affirm and aren’t actually compliant?
The affirmation is a statement to the federal government and carries False Claims Act risk. That is why we document evidence for every practice before you affirm.
Ready to get started?
Talk to a Tech Dispatch CMMC specialist about your contract and the level you need.
