CMMC

Your prime's flow-down clause is [DFARS 252.204-7021](https://www.acquisition.gov/dfars/252.204-7021-cybersecurity-maturity-model-certification-requirements.). The affirmation behind it is a legal instrument.

What triggers it#

Touch Federal Contract Information or Controlled Unclassified Information and you carry a CMMC status, post it in SPRS, and affirm it every year.

Level 2 is the 110 controls of NIST SP 800-171, scored.

Self-assessed does not mean unexamined#

Since Phase 1 opened on 10 November 2025, most of that is self-assessed, and the move to third party assessment was suspended in July 2026 with no replacement date set.

That is not the relief it sounds like. The affirmation is a legal instrument. Aerojet Rocketdyne paid $9M in 2022 to settle allegations it misrepresented its cybersecurity compliance.

You sign the number. We give you the evidence sitting behind it.

How the assessment answers it#

The control set is mapped to NIST SP 800-171 — the same 110 controls — and scoped to your mission by payload class, bus model and orbital layer. Ground segment controls apply to the ground segment. You are not answering for a constellation you do not fly.

Findings arrive graded U1 to U5, cheapest and most load bearing first, each with a consequence level and the reason it sits there.

Start a conversation and we will tell you whether an assessment answers what your prime asked.