Assessment, Architecture, SSP | POA&M Creation

All Defense Industrial Base (DIB) government contractors must complete their CMMC certifications to either start or continue their business relationships with the Department of Defense.  So, forward thinking Contractors need to look at the process of undergoing compliance as a strategic competitive advantage. CMMC-certified organizations will continue to thrive in the defense sector, while those that overlook this opportunity will fall behind their competitors.

The NIST|CMMC Assessment environment is well scripted and requires due diligence and attention to detail through the creation of extensive documentation and preservation of evidence and artifacts.  This particular approach works well for most small to medium sized DIB contractors, but more than likely it will have to be tailored to meet the needs of larger Government Contractors and commercial entities.

Choosing the right partner to help you achieve compliance is the most critical decision your organization will make.

The appropriate partner will ensure your organization achieves CMMC compliance efficiently and promptly, and that you will be in a good position to pass any CMMC certification assessment.

Assessments and the i2ACT Assessment and Compliance Tool

All assessments performed by Imprimis will be done using the i2ACT Software Platform, developed by Imprimis.  The i2ACT (Assessment and Compliance Tool) is a comprehensive, on-premises solution designed to support structured cybersecurity assessments based on NIST 800-171, NIST 800-172, and CMMC Levels 1 through 3. Built for organizations handling FCI and CUI, i2ACT enables users to evaluate, document, and manage compliance with federal cybersecurity requirements.

The latest version, i2ACT 4.0 (2025), introduces enhanced functionality for end-to-end assessments. It supports the latest CMMC/NIST revisions and enables seamless switching between NIST and CMMC assessments.  The tool further provides expanded capabilities for identifying and tracking remediation actions, automatic SPRS scoring, POA&M development, extensive reporting of controls and objectives ‘met’ or ‘not met’, evidence and artifact collection and document management -- all within a single environment. 

It can also be used to assess and track cybersecurity program development within the commercial sector usings its customizable assessment baseline capability. 

The i2ACT software tool is particularly effective for the final conformity assessment you want to complete prior to your C3PAO Assessment.  It allows for tracking compliance with all requirements and associated remediated actions, assimilation of artifacts of evidence, required documentation, and notes for the auditor.

Stand-alone or Packaged Compliance Assessments

Imprimis is available to perform single, stand-alone assessments for CMMC Levels 1 and 2 or NIST 800-171 at any time.  However, many customers have indicated a need to move quickly forward towards remediation after an initial assessment and to meet that need Imprimis has developed our Fixed Price Phase I Packages.

Fixed Price Phase I Assessment and Compliance Planning Packages

To ‘jumpstart’ the compliance process, Imprimis has developed a special Fixed Price Compliance Quickstart Package for CMMC | NIST 800-171 Levels 1 and 2. These packages provide the initial assessment and allow for an architecture review/plan, draft system security plan, an SPRS score, and draft POA&M at an affordable price. The structure of these packages allows Imprimis to move the client quickly to the all-important remediation phase of compliance.

 

 

 

  

DoD Regulations and Assessment Requirements

Finalization of the 48 CFR Final Rule inserted the DFARS 252.204-7021 into contracts and embedded the CMMC requirements into all pertinent DoD contracts.  Subcontractors will be required to comply with the same level.  This Final Rule was effective November 10, 2025, with full roll-out scheduled for November of 2028.  Assessment requirements will differ depending upon what DoD regulation is included in your contract document.

This is a prioritized list of cybersecurity assessment requirements for DoD prime contractors and subcontractors:

  1. Federal Acquisition Regulation (FAR) 52.204-21
      • Applies to all contractors handling Federal Contract Information (FCI)
      • Forms the basis of CMMC Level 1
      • Assessments: Annual self-assessment
  1. Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012
      • Applies to all contractors handling Controlled Unclassified Information (CUI)
      • Flows down to subcontractors
      • Assessments: Annual self-assessment against NIST 800-171 in addition to a System Security Plan (SSP) and Plan of Action & Milestones (POA&M)
  1. DFARS 252.204-7019 & 7020
      • Grants DoD the right to audit contractor systems for compliance
      • Assessments: Contractors must submit their annual NIST 800-171 assessment score to the Supplier Performance Risk System (SPRS)
  1. NIST 800-171 R2
      • Provides technical foundation for protecting CUI in non-federal systems
      • Assessments: Annual self-assessment against NIST 800-171 which must be documented and available for DoD review
  1. Cybersecurity Maturity Model Certification (CMMC)
      • Established a 3-level certification model – Level 1 (Foundational), Level 2 (Advanced) and Level 3 (Expert)
      • Assessments: CMMC Level 1 – Annual self-assessment
      • Assessments: CMMC Level 2 – Either annual third-party (C3PAO) or self-assessment depending on contract sensitivity
      • Assessments: CMMC Level 3 – Annual government-led assessments against NIST 800-171 plus 24 controls from NIST 800-172

All of these requirements will extend to subcontractors and will be enforced as a condition for contract award.  Non-compliance may disqualify companies from competing on contracts and being awarded any future contract options.

Contact US

Contact US to get a quote for your assessment or Phase 1 Package today