CMMC & GCC Compliance Services
Sierra Experts gets you ready for CMMC and keeps you there, starting with ThreatLocker zero trust on every computer and server. One plan that also covers Microsoft 365 GCC or GCC High, Duo Federal MFA, Kiteworks for sharing CUI outside your company, NinjaOne for Government, and support from our team 24x7.
- Veteran-Owned
- Headquartered in Pittsburgh
- Serving customers in 38 states and 3 countries
- Support 24x7
One path to CMMC, instead of four vendors and a spreadsheet.
If you handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on Department of Defense contracts, CMMC is how the DoD checks that you protect it. Level 1 covers FCI. Level 2 covers CUI and is built on the 110 requirements in NIST SP 800-171.
You may already have some of the pieces. The common gaps are where CUI actually lives, how it gets to primes and suppliers, what software can run on a laptop, and how to prove all of it when someone asks. We close those gaps with tools built for the job, and then we run them for you.
To be clear about our role: Sierra Experts does not certify anyone. We get your environment and your evidence ready for a self-assessment or a C3PAO assessment, whichever your contracts require.
Where CMMC stands (updated October 27, 2026)
CMMC is in effect. The program rule, 32 CFR Part 170, took effect December 16, 2024. The DFARS rule that puts CMMC into contracts took effect November 10, 2025 and started Phase 1: Level 1 and Level 2 self-assessments posted in SPRS, with an annual affirmation, when a solicitation or contract calls for them.
Phase 2 is suspended. On July 13, 2026, the Department of War (also known as the Department of Defense) suspended Phase 2, which would have started requiring third-party (C3PAO) Level 2 assessments on November 10, 2026, and set up a CMMC Reform Task Force to review the program. Phase 1 self-assessment requirements stay in place. DFARS 252.204-7012 still requires you to protect CUI with NIST SP 800-171, and the Department says it will enforce that standard through self-assessments and select government-led assessments.
In short: third-party certification is on hold, but the security requirement isn’t. We’ll update this page when the review is published.
CMMC updates: What the CMMC Phase 2 suspension means · SPRS scores and the annual affirmation, explained
Sources: 32 CFR Part 170, 89 FR 83092 · DFARS rule, 90 FR 43560 · Department of War release, July 13, 2026 · DoD CIO: About CMMC
Start with zero trust on every endpoint
ThreatLocker is where we start CMMC projects. Antivirus and EDR watch for bad behavior and react to it. ThreatLocker works the other way around: nothing runs on a computer or server unless it has been approved. Ransomware, unknown tools, and the utility someone downloaded on a whim never get to start.
What ThreatLocker does
- Allowlisting. Deny by default. Only the applications, scripts, and libraries you approve can run.
- Ringfencing. Approved apps only reach what they need. If an attacker hijacks Word or PowerShell, the attack hits a wall.
- Elevation Control. People run the specific apps that need admin rights without being local administrators.
- Storage Control. Decide which USB drives and other storage can connect, who can use them, and whether access is read-only.
- Network Control. Block inbound traffic to protected computers by default and open it only for approved connections.
- Unified Audit. One log of what ran, what was blocked, and what was approved.
Where it lines up with NIST SP 800-171
CMMC Level 2 is built on NIST SP 800-171 Rev. 2. ThreatLocker’s published CMMC mapping lists its tools as helping with these requirements when configured properly:
- 3.4.8 Only authorized software runs (deny all, permit by exception)
- 3.4.9 Control and monitor software users install
- 3.1.7 Keep non-privileged users from running privileged functions, and log it when they do
- 3.8.7 Control removable media
- 3.13.6 Deny network traffic by default, allow it by exception
- 3.3.1 Create and keep audit logs
How we run it: Learning Mode first, then policy tuning, then Secure Mode in stages, so the software your people rely on is approved before anything gets blocked. After that, Sierra Experts Managed Services handles approval requests, keeps policies current, and searches and reviews the ThreatLocker audit log weekly for fully managed clients, and daily for co-managed environments. ThreatLocker doesn’t make you compliant on its own, and Sierra Experts doesn’t certify. It gives you strong controls and the logs to show they work.
ThreatLocker or SentinelOne? They take different approaches. ThreatLocker is prevention by default: only approved software runs. SentinelOne is detection and response: it watches what does run and stops threats it finds. Some companies run both, and Sierra Experts resells and supports both.
Six pieces, one plan for CMMC Level 1 and Level 2
Each piece covers a different part of the problem, and ThreatLocker comes first because it protects every device the rest depends on. We scope and license them together and run them as one environment. Kiteworks’ team installs Kiteworks; we coordinate the rollout and handle its users, access, and audit reports from there.
Lock down endpoints with ThreatLocker
Only software you approve can run. Ringfencing limits what approved apps can reach, Elevation Control removes everyday admin rights, and Storage Control governs USB drives. We search and review the ThreatLocker audit log weekly for fully managed clients, and daily for co-managed environments.
Move to Microsoft 365 GCC or GCC High
Email, files, and Teams in Microsoft’s government clouds. GCC fits FCI and CMMC Level 1. GCC High is typically the fit when CUI, DFARS 252.204-7012, or ITAR/EAR data is involved.
Verify every sign-in with Duo Federal
MFA and device trust from Cisco Duo. We sell, deploy, and support both editions: FedRAMP Moderate for commercial and GCC tenants, FedRAMP High for GCC High. Sign-ins are checked against both the user and the device before access is allowed, including phishing-resistant options like FIDO2 security keys.
Get audit-ready with Kiteworks
CUI doesn’t stay inside your tenant. Kiteworks handles secure email, file sharing, managed file transfer, and SFTP with outside parties, with one audit log across all of them. Kiteworks’ team sets it up; we manage users, access, and audit reports as a managed service.
Patch and manage devices with NinjaOne for Government
Patching, device management, remote access, and inventory for Windows, macOS, and Linux from one console. NinjaOne for Government is FedRAMP Moderate authorized, and we sell and support it.
Keep it running 24x7 with Sierra Experts Managed Services
Our team runs it day to day: monitoring, patching, user and device changes, approvals, and the logs and reports you need when an assessor or prime asks. 24x7.
What each piece answers
The questions that come up in a CMMC assessment, and where the answer comes from.
| What covers it | What Sierra Experts does | |
|---|---|---|
| What software can run on company computers? | ThreatLocker allowlisting, Ringfencing, and Elevation Control | Learning Mode, policy tuning, Secure Mode, approval requests, and audit log reviews (weekly when we fully manage, daily when co-managed) |
| What about USB drives and removable media? | ThreatLocker Storage Control | Set device and file-type policies and review the logs |
| Where is CUI stored, and who can get to it? | Microsoft 365 GCC High (or GCC for FCI only) | Scope the tenant, migrate, and set up identity, MFA, and access policies |
| Who is signing in, and from what device? | Duo Federal MFA and device trust | Deploy the edition that matches your tenant, enroll users, protect apps, VPN, and Windows logons, and set access policies |
| How does CUI get to primes, subs, and suppliers? | Kiteworks secure email, file sharing, MFT, and SFTP | Resell Kiteworks and coordinate the rollout (Kiteworks’ team installs it), then run it as a managed service: users, access, and audit log reports |
| Is every computer patched and accounted for? | NinjaOne for Government patching, inventory, and monitoring | Patch on a schedule, track every device, and fix what fails |
| Can you show it’s working? | ThreatLocker Unified Audit, Kiteworks audit log, Duo and NinjaOne reports, Microsoft 365 audit records | Pull the records together when you need them |
| Who keeps it running? | Sierra Experts Managed Services | Monitoring, patching, and support, 24x7 |
CUI?
Sending drawings, specs, or reports to outside parties?
Those are common weak spots for CUI: personal email, consumer file sharing, an old FTP server. Kiteworks puts those exchanges on one platform with one audit trail.
CMMC Level 1, Level 2 and Level 3 at a glance
Your contract tells you which level applies. Not sure? Look for FAR 52.204-21, DFARS 252.204-7012, or DFARS 252.204-7021 in it, or send it to us and we’ll go through it during scoping.
| Level | Protects | Requirements | Assessment | POA&Ms |
|---|---|---|---|---|
| Level 1 | Federal Contract Information (FCI) | 15, from FAR 52.204-21 | Self-assessment every year, with results and an affirmation in SPRS | Not allowed |
| Level 2 | Controlled Unclassified Information (CUI) | 110, from NIST SP 800-171 Rev. 2 | Self-assessment every 3 years with an annual affirmation in SPRS, or a C3PAO assessment when the contract requires one (on hold while Phase 2 is suspended) | Allowed only for certain lower-weight requirements, and closed within 180 days |
| Level 3 | CUI that needs the highest level of protection | Level 2, plus 24 selected from NIST SP 800-172 | By the government (DCMA DIBCAC), after a final Level 2 C3PAO certification; not required while CMMC is paused in Phase 1 | Allowed for certain requirements, and closed within 180 days |
The contract clauses, in plain English
- FAR 52.204-21: basic safeguarding for systems that handle FCI. Its 15 requirements are CMMC Level 1.
- DFARS 252.204-7012: protect covered defense information (CUI) with NIST SP 800-171, report cyber incidents to the DoD within 72 hours of discovery, and make sure any cloud provider that stores or handles it meets security requirements equivalent to the FedRAMP Moderate baseline. It flows down to subcontractors that handle CUI.
- DFARS 252.204-7019: to be considered for award, have a current NIST SP 800-171 DoD Assessment (no more than 3 years old) in SPRS for each system that’s relevant to the contract.
- DFARS 252.204-7020: give the government access to your facilities, systems, and people if it needs to run a Medium or High assessment, and don’t award covered subcontracts to suppliers without at least a current Basic assessment.
- DFARS 252.204-7021: the CMMC clause. Keep the CMMC level named in the contract current for every system that processes, stores, or transmits FCI or CUI, affirm continuous compliance in SPRS every year, and flow the right level down to subcontractors.
SPRS score, SSP and POA&M: what the terms mean
- SPRS score. The Supplier Performance Risk System is where NIST SP 800-171 assessment scores and CMMC self-assessment results and affirmations are posted. A Basic assessment starts at 110 and subtracts 1, 3, or 5 points for each requirement that isn’t met, so the score can go below zero.
- System Security Plan (SSP). Describes the system boundary, how it operates, how each security requirement is met, and how it connects to other systems.
- Plan of Action and Milestones (POA&M). Lists the requirements that aren’t met yet and when they will be.
The tools we run produce much of the evidence those documents point to: ThreatLocker policies and its Unified Audit, Duo Federal sign-in and device reports, the Kiteworks audit log, NinjaOne patch and inventory reports, and Microsoft 365 audit records. We pull those records together when you or your compliance advisor need them.
Identity and devices
Two pieces that cover sign-ins and the computers people sign in from. Both have FedRAMP-authorized government versions. We sell and support both, and we deploy Duo Federal in either edition.
Duo Federal
- We sell, deploy, and support both editions: FedRAMP Moderate for commercial and GCC tenants, FedRAMP High for GCC High
- MFA and device trust, with phishing-resistant options including FIDO2 security keys and, on the High edition, PIV/CAC smart cards
- Duo Federal (Moderate) is FedRAMP certified; the High edition is part of Cisco Security Cloud for Government, certified at FedRAMP High
- Duo Push and Duo Mobile passcodes are FIPS compliant by default
- No SMS or phone-call codes; users approve sign-ins in Duo Mobile, with a security key, or with a hardware token
- Works with Microsoft Entra ID as external MFA: the Moderate edition for commercial and GCC tenants, the High edition for GCC High
NinjaOne for Government
- We sell NinjaOne for Government, roll it out to your devices, and support it 24x7
- Endpoint management and automated patching for Windows, macOS, and Linux, plus mobile device management
- Remote access, IT asset inventory, and device backup in the same console
- FedRAMP Moderate authorized, listed on the FedRAMP Marketplace
- Patch and device reports you can hand to an assessor or prime
- NinjaOne is clear that tools alone don’t get you to CMMC; policies, training, and an assessment are still required
Which Duo edition? It follows your Microsoft tenant, and we deploy either one: Moderate for commercial and GCC tenants, High if you’re on or moving to GCC High. We confirm the fit during scoping.
How we get you there
A straight line from “we have a contract with a CMMC requirement” to an environment you can stand behind.
Our role: we scope, build, and run the environment, and help you keep evidence ready. We don’t certify, and we don’t replace your compliance or legal advisors.
Scope
Find where FCI and CUI live, which contracts and clauses apply, which CMMC level you need, and which users, systems, and outside parties are in scope.
Gap review
Compare what you have today against that level, NIST SP 800-171 for Level 2, and turn the gaps into a short, ordered list of fixes.
Build
Start ThreatLocker in Learning Mode early, since it needs a normal work cycle before Secure Mode. Move to GCC or GCC High, roll out Duo Federal and NinjaOne for Government, coordinate the Kiteworks rollout with Kiteworks’ team, and tighten backups. We work around your production schedule.
Run and prove
We operate it 24x7, keep policies current as your business changes, review audit logs on a set schedule, and help you gather the records for your self-assessment or C3PAO assessment.
Matching security monitoring: if you move to GCC High, Microsoft Sentinel in Azure Government (FedRAMP High) pairs with it. We can plan that alongside the rest.
CMMC help for Pittsburgh and Western Pennsylvania defense suppliers
A lot of defense work around Pittsburgh runs through small and mid-sized manufacturers, machine shops, and engineering firms, often on CAD/CAM, CNC, and shop-floor systems that weren’t designed with CUI in mind. We’ve supported businesses here from our Pittsburgh headquarters since 2006, including Cranberry Township, Wexford, North Hills, Robinson Township, Moon Township, Monroeville, Greensburg, and Canonsburg.
Whether you’re a prime or three tiers down the supply chain, the first step is the same: a scoping call to find where your FCI and CUI actually live.
Why Sierra Experts for defense work
- Veteran-owned. Founded in Pittsburgh in 2006.
- Our team includes enlisted U.S. Air Force veterans and current service members, the hands-on people who did the work day to day. Some hold applicable security clearances.
- Founder and CEO Bruce Freshwater served as an enlisted Air Force specialist in missile guidance systems.
- Support 24x7 from our in-house team.
- Customers in 38 states and 3 countries.
Frequently asked questions
Is CMMC still required after the July 2026 Phase 2 suspension?
Yes. Phase 1 is still in effect: when a contract calls for a CMMC Level 1 or Level 2 self-assessment, you post your results in SPRS and affirm them every year. What’s on hold is Phase 2, the third-party (C3PAO) Level 2 requirement that was set to start November 10, 2026. DFARS 252.204-7012 still requires you to protect CUI with NIST SP 800-171, and the Department of War says it will enforce that through self-assessments and select government-led assessments.
Does Sierra Experts certify us for CMMC?
No. We get your environment and your evidence ready, and we keep it that way. Depending on your contracts, you either complete a self-assessment or are assessed by an authorized C3PAO. Sierra Experts is not a C3PAO and does not issue CMMC certifications.
Why do you start CMMC projects with ThreatLocker?
Because it protects every computer and server the rest of the plan depends on. ThreatLocker blocks any software you haven’t approved, limits what approved apps can reach, removes everyday admin rights, and controls USB storage, with one log of what ran and what was blocked. It also needs a normal work cycle in Learning Mode before it locks down, so starting early keeps the rest of the project on schedule. We search and review the ThreatLocker audit log weekly for fully managed clients, and daily for co-managed environments.
Which NIST SP 800-171 requirements does ThreatLocker help with?
ThreatLocker’s published CMMC mapping lists, among others, 3.4.8 (only authorized software runs), 3.4.9 (user-installed software), 3.1.7 (privileged functions), 3.8.7 (removable media), 3.13.6 (deny network traffic by default), and 3.3.1 (audit logs). CMMC Level 2 is built on NIST SP 800-171 Rev. 2. ThreatLocker doesn’t make you compliant on its own, and Sierra Experts doesn’t certify; your policies, people, and evidence still count.
ThreatLocker or SentinelOne?
They take different approaches. ThreatLocker is prevention by default: only approved software runs. SentinelOne is detection and response: it watches what does run and stops threats it finds. Some companies run both, and Sierra Experts resells and supports both.
What is an SPRS score and how is it calculated?
It’s the NIST SP 800-171 assessment score posted to the Supplier Performance Risk System. A Basic assessment starts at 110 and subtracts 1, 3, or 5 points for each requirement that isn’t met, so the score can go below zero. DFARS 252.204-7019 requires a current score, no more than 3 years old, to be considered for award on contracts that include NIST SP 800-171.
What is the difference between CMMC Level 1, Level 2 and Level 3?
Level 1 protects Federal Contract Information with 15 basic requirements from FAR 52.204-21 and an annual self-assessment. Level 2 protects CUI with the 110 requirements of NIST SP 800-171 Rev. 2, assessed by you or by a C3PAO, depending on the contract. Level 3 adds 24 requirements selected from NIST SP 800-172 and is assessed by the government. While Phase 2 is suspended, the DoD CIO says the program may only require self-assessments.
What is a POA&M, and can we use one for CMMC?
A Plan of Action and Milestones lists requirements that aren’t met yet and when they will be. Level 1 doesn’t allow them. Level 2 allows them only for certain lower-weight requirements, and only if your score is at least 80% of the total; open items must be closed within 180 days to reach final status.
Do subcontractors need CMMC?
Yes, if they handle FCI or CUI for the contract. DFARS 252.204-7021 requires primes to flow the right CMMC level down to subcontractors and suppliers, and the level follows the information: a supplier that handles only FCI needs Level 1, and one that receives CUI, such as controlled drawings, needs Level 2.
Do we need Microsoft 365 GCC High for CMMC?
It depends on your data. If your work is FCI only and you need CMMC Level 1, Microsoft 365 GCC is usually enough. If CUI, DFARS 252.204-7012, or ITAR/EAR data is involved, GCC High is typically the right fit. Confirm your requirements with your compliance or legal advisors.
We already use GCC High. Why add Kiteworks?
GCC High protects CUI inside your company, but collaboration with outside commercial tenants is more limited there. Kiteworks gives you one controlled way to send and receive CUI with primes, subs, and suppliers by secure email, file sharing, managed file transfer, and SFTP, with one audit log across all of it. For GCC High tenants, ask us about Kiteworks’ FedRAMP High deployment in AWS GovCloud; Kiteworks is FedRAMP Moderate authorized, with FedRAMP High authorization in process.
Do you sell the licenses too?
Yes, for most of it. We sell and support Duo Federal (both editions) and NinjaOne for Government, we are a ThreatLocker certified partner, we resell Kiteworks and SentinelOne, and we quote Microsoft 365 GCC licensing. GCC High licensing goes through channels Microsoft authorizes for its U.S. government clouds, and we help you through that process. Every quote is sized to your users and scope.
Which Duo Federal edition do we need?
It follows your Microsoft tenant and your contracts, and we sell, deploy, and support both editions. Duo’s documentation lists the FedRAMP Moderate edition as working with Microsoft Entra ID in commercial and GCC tenants, and the FedRAMP High edition as the one for GCC High. We confirm the fit during scoping, before anything is ordered.
Is NinjaOne for Government FedRAMP authorized?
Yes. NinjaOne for Government is listed on the FedRAMP Marketplace as FedRAMP certified at the Moderate level. It handles patching, device management, and reporting, which support several CMMC requirements, but like any tool it doesn’t make you compliant on its own. We sell it and support it as part of your managed IT.
We already have some of this in place. Do we start over?
No. We start with what you have, find the gaps against the CMMC level you need, and fix those. If you already have Microsoft 365 or endpoint tools, they may only need to be scoped and configured properly.
Related services
Last reviewed October 28, 2026
This page is general guidance, not legal or compliance advice. Sierra Experts is not a C3PAO and does not certify CMMC compliance. Microsoft determines eligibility for its government clouds. Product capabilities and FedRAMP status are as published by each vendor and the FedRAMP Marketplace (October 2026). ThreatLocker is a registered trademark of ThreatLocker, Inc. SentinelOne is a trademark of SentinelOne, Inc. Kiteworks is a trademark of Kiteworks USA, LLC. NinjaOne is a trademark of NinjaOne, LLC. Cisco and Duo are trademarks or registered trademarks of Cisco and/or its affiliates. Confirm your requirements with your compliance or legal advisors.
Have a contract with a CMMC requirement? Schedule a scoping call.
Send us the contract clause or the prime’s flow-down letter. We’ll go through which level applies, where your CUI lives, and the shortest path from here. Sierra Experts is a veteran-owned IT company headquartered in Pittsburgh, supporting customers in 38 states and 3 countries. Call 412.722.0707 or send us a note.
Talk to an engineer
Tell us what you are working on and a Sierra Experts engineer will get back to you. The first consultation is free.
- Call sales412.722.0707
- Pick a timeBook a meeting with Mark Sokolowski