CMMC

Your prime's flow-down clause is DFARS 252.204-7021. The affirmation behind it is a legal instrument.

What triggers it#

The flow-down clause is DFARS 252.204-7021.

Touch Federal Contract Information or Controlled Unclassified Information and you carry a CMMC status, post it in SPRS, and affirm it every year.

Level 2 is the 110 controls of NIST SP 800-171 Rev 2, scored.

Self-assessed does not mean unexamined#

Since Phase 1 opened on 10 November 2025, most of that is self-assessed, and the move to third party assessment was suspended in July 2026 with no replacement date set.

Aerojet Rocketdyne paid $9M in 2022 to settle allegations it misrepresented its cybersecurity compliance.

You sign the number. We give you the evidence sitting behind it.

How the assessment answers it#

The control set is mapped to NIST SP 800-171 Rev 2, the same 110 controls, and scoped to your mission by payload class, bus model, and orbital layer.

Findings arrive graded U1 to U5: irrecoverable breaches first, then design freeze controls while the freeze is still open, each with a consequence level and the reason it sits there.

Start a conversation and we will tell you whether an assessment answers what your prime asked.