Popular: CMMC CCP Boot Camp Bookstore Contract Vehicles
8865 Stanford Blvd., Suite 202, Columbia, MD 21045
Cyber AB Authorized RPO & C3PAO
Get ready for CMMC with hands-on help from our consultants, then earn certification through an authorized C3PAOCertified Third-Party Assessment Organization: a company approved by The Cyber AB to perform official CMMC Level 2 certification assessments. assessment.
Talk to a CMMC ConsultantCMMC for Defense Contractors
Four questions every defense contractor asks before choosing CMMC help, answered in plain language.
CMMC is the Department of Defense program that checks whether contractors protect sensitive information. If you handle FCIFederal Contract Information: information about a government contract that isn't meant for the public, like pricing or delivery schedules. or CUIControlled Unclassified Information: sensitive government information, like technical drawings or specs, that must be protected by law. on a defense contract, you need to meet a CMMC level to win or keep that work.
CMMC requirements now appear in defense contracts, and primes pass them down to their subcontractors. You need to know what information you handle, which systems touch it, and which level applies. Waiting until an assessment is booked leaves little time to fix problems.
A consultant shows you exactly where you stand and what to fix. Our team scopes your environment, runs a gap assessment, helps write your SSPSystem Security Plan: the document that describes your systems and how you meet each security requirement. Assessors read it first. and POA&MPlan of Action and Milestones: your written plan for fixing gaps, with owners and due dates., and works alongside your IT team until you're ready.
Only a C3PAO authorized by The Cyber AB can perform an official Level 2 certification assessment. Make sure it's listed on the Cyber AB Marketplace, ask about its assessors' real-world experience, and confirm it can keep your information secure.
Cyber AB Authorized
The Cyber AB authorizes companies for specific CMMC jobs. Edwards holds four, so you can get ready, get certified, and train your team with one trusted partner.
Registered Practitioner Organization
Our consultants are registered with The Cyber ABThe official accreditation body for CMMC. It authorizes the companies and people allowed to do CMMC work. to help you prepare for a CMMC assessment.
CMMC readiness servicesCertified Third-Party Assessment Organization
We can perform your official CMMC Level 2The level for companies that handle CUI. It has 110 security requirements, and most contracts require a C3PAO assessment every 3 years. certification assessment.
C3PAO assessmentsApproved Training Provider
We teach the official CCPCMMC Certified Professional: the entry-level CMMC certification and the first step toward CCA. and CCACMMC Certified Assessor: the certification required to perform official CMMC Level 2 assessments. certification courses, live online or at your own pace.
CMMC training classesApproved Publishing Partner
We write approved CMMC course materials. In 2021, we were the first in the nationThe Daily Record reported in October 2021 that Edwards was the first company in the nation to earn the CMMC-AB’s approval for its CCP course materials. approved for CCP curriculum.
CMMC bookstoreCheck any credential yourself on the Cyber AB Marketplace (opens in a new tab), or see all Edwards credentials.
Why Edwards
We work on every side of CMMC. We train assessors, write the approved course materials, and perform official assessments. That inside knowledge goes into every consulting project, so you prepare for what assessors actually check.
We find exactly where your CUIControlled Unclassified Information: sensitive government information, like drawings or specs, that the law requires you to protect. lives and draw the smallest correct boundary, so you protect what matters without paying to secure everything.
DoD Level 2 Scoping Guide (PDF, opens in a new tab)We review all 110 requirements in NIST SP 800-171The federal standard behind CMMC Level 2. It lists 110 security requirements for protecting CUI. the same way an assessor would, so nothing surprises you on assessment day.
Readiness servicesEvery gap becomes a clear task with an owner and a due date in your POA&MPlan of Action and Milestones: your written plan for fixing gaps, with owners and due dates.. Then we work alongside your IT team until each one is closed.
Harkins Builders case study (PDF, opens in a new tab)Our team includes CCPsCMMC Certified Professionals: people trained and certified in CMMC requirements and assessment methods. and CCAsCMMC Certified Assessors: the people certified to perform official CMMC Level 2 assessments. who teach the official CMMC classes. You get advice from people who know what assessors look for.
Meet our CMMC instructorsCMMC often overlaps with NIST 800‑53, the NIST Cybersecurity Framework, and SOC 2An independent audit report that shows customers how a company protects their data.. We map the work once, so your effort counts across every framework you follow.
Cybersecurity servicesCMMC Compliance Case Study
Harkins Builders needed a more practical way to prepare for CMMC. Edwards helped the team understand its environment and turn the remaining work into a plan it could actually use.
A document-heavy process made it hard to see what mattered or where to start.
Clear scoping gave Harkins a solid foundation for its cybersecurity work and assessment prep.
Published in the ABC 2023 Tech Report
CMMC Consulting & Assessments
Tell us where you are today. You don’t need your scope, level, or next step figured out. That’s what the first conversation is for, and it’s free.
Scoping, gap assessments, remediation planning, and assessment prep.
Get on our assessment calendar and map out your dates.
Choose “Not sure yet” in the form, and we’ll help you find the right next step.
Prefer to reach out directly?
Start Here
Share what you know, and a CMMC expert will follow up. We only use your details to respond to you. See our privacy policy.
C3PAO Engagement Roadmap
Every Edwards C3PAO assessment follows the same clear path, from your first form to your Level 2 certificate. Here is the whole journey at a glance.
Before you start
Right away
Phase 1
Starts about 90 days before assessment week
Phase 2
About one week
Phase 3
About 10 days after
Phase 4
Right after, or within 180 days
When You Pass
Pass your Level 2 assessment with Edwards and you get a badge to use however you like. It shows your expiration date, and each year has its own color, so customers can tell at a glance that it’s current.
Your certification lasts three yearsA CMMC Level 2 certification from a C3PAO is good for three years from your final results. Your badge shows the month it ends., as long as your company completes its annual affirmationEach year, a senior company official must confirm in SPRS (the DoD’s Supplier Performance Risk System) that you still meet every requirement. each year.
Every message your team sends shows you’re certified.
Add it to your capabilities page, bids, and RFP responses.
Announce it to customers, primes, and partners.
Ready to earn yours? Talk to our C3PAO team about scheduling your Level 2 assessment.
Talk to Us About an AssessmentSample badges shown. Your badge shows your company’s actual expiration date.
Assessment Timeline
A CMMC Level 2 assessment is an official review, done by an authorized C3PAO, that checks whether your company meets all 110 required security practices. Pass, and you can win and keep defense contracts that require Level 2 certification.
Click through an example: you sign up in early April
Early April in our exampleWeek one
Pay your deposit, sign a nondisclosure agreement, and fill out our intake form. We review your starting documents with you, then hold a scheduling call to lock in your dates.
What you’ll need
Mid-April in our exampleAbout 90 days before your assessment week
Meet your lead assessor. Together we confirm exactly which people, systems, and locations are in scope, and you receive the official document request.
What you’ll need
Early May in our exampleWithin 21 days of your kickoff call
Send every document tied to your assessment. By now, most should be finished or need only small changes.
What you’ll need
Late May in our example45 to 60 days before your assessment week
We review your documents and scope and confirm you are ready. If something is missing, you find out now, with time to fix it, not during the assessment.
What you’ll need
Mid-July in our exampleAbout one week, depending on your size
We open with an in-brief meeting. Then our assessors interview your team, review your evidence, and test your systems against all 110 Level 2 requirements.
What you’ll need
Late July in our exampleAbout 10 days after your assessment week
We walk you through your report in an out-brief meeting. Pass, and your Level 2 certification is issued and recorded with the Department of Defense. If only a few eligible gaps remain, you receive conditional status and up to 180 days to close them under a POA&MPlan of Action and Milestones: your written plan for fixing gaps, with owners and due dates..
What you’ll need
Dates are an example. Your real schedule depends on your size, scope, and how ready your documents are. See the full roadmap
CMMC Level 2 follows NIST SP 800-171A federal standard from the National Institute of Standards and Technology. It lists the security requirements for protecting CUI., which groups 110 requirements into 14 families. Tap any family to see what it covers, in plain English.
Only approved people and devices get into your systems, and each person sees only what their job requires. Screens lock after a period of inactivity.
Everyone is trained to spot security risks, like phishing emails, and to report anything suspicious.
Your systems keep logs of who did what and when, and someone reviews them.
You keep an up-to-date list of your hardware and software, use secure settings, and control changes.
Every user has their own login, and multifactor authentication protects network and admin access.
You have a plan to detect, report, and respond to security incidents, and you test it.
System maintenance is approved and supervised, including any work done remotely.
USB drives, laptops, and paper files that hold CUI are protected, encrypted, and destroyed properly.
People are screened before they get access to CUI, and access is removed when they leave.
Offices and equipment are locked down, visitors are escorted, and physical access is logged.
You regularly assess risk and scan your systems for weaknesses, then fix what you find.
You check that your security works, keep your SSP current, and track fixes in a plan.
Data is protected where your network meets the outside world, and CUI is encrypted when it travels.
Flaws are fixed quickly, malicious code is blocked, and systems are watched for attacks.
Read all 110 requirements in NIST SP 800-171 (opens in a new tab)
Your result is recorded with the Department of Defense, and your status appears in SPRSSupplier Performance Risk System: the Department of Defense database where contracting officers check your CMMC status..
You can compete for, win, and keep defense contracts and subcontracts that require Level 2 certification.
Prime contractors must confirm their subcontractors are certified. When they ask, you are ready.
Your certificate lasts three years. A company leader confirms compliance once a year to keep it active.
Tell us your contract deadline and we’ll map out your dates.
or call 443.561.1334
A $5,000 deposit reserves your assessment. You can pay online, by invoice, or through our accounting team. The final balance is due before your out-brief meeting.
Plan for about four months from sign-up to certificate. Your kickoff call happens about 90 days before assessment week, the assessment takes about a week, and results follow about 10 days later.
Companies that handle Controlled Unclassified Information (CUI) on defense contracts that require CMMC Level 2 certification. Some Level 2 contracts allow a self-assessment instead, so check your contract or ask us.
The price depends on your company’s size and how much of your network is in scope. Ask us for a quote.
No. CMMC rules do not allow a C3PAO to assess a company it helped prepare. We can be your consultant or your assessor, and we will help you decide which fits. See our readiness services.
If only a few eligible requirements are not met, you receive conditional status and have 180 days to fix them. If bigger gaps remain, you fix them and schedule a new assessment.
Three years. A senior company official must also confirm compliance every year in SPRS, the Department of Defense’s reporting system.
CMMC Consulting & Assessments
Tell us where you are. We'll help you figure out what applies, what still needs work, and when you're ready for an official assessment.
