Question 1

Do I need a third-party assessor for Level 1?

Accepted Answer

No. Level 1 is annual self-attestation submitted to SPRS. Level 2 and Level 3 require C3PAO or DoD assessors.

Question 2

What is FCI?

Accepted Answer

Federal Contract Information — information not intended for public release, provided by or generated for the government under a contract. Distinct from CUI (Controlled Unclassified Information) which is more sensitive and triggers Level 2.

Question 3

How is this different from CMMC 1.0?

Accepted Answer

CMMC 2.0 (the current version) simplified the tiers, dropped maturity processes, and aligned more directly with NIST 800-171. Level 1 is roughly equivalent to old Level 1.

Question 4

Do you work outside a framework engagement?

Accepted Answer

Yes. Penetration testing, network and cloud security, and infrastructure hardening are all standalone services. You don't need a compliance deadline to get more secure; many clients start with the security work and add the framework later.