AI assesses all 110 NIST 800-171 controls, finds every gap, auto-generates your POA&M and SSP — all on Azure Government infrastructure. Not just compliant tools — compliant infrastructure.
Join the growing number of defense contractors streamlining their CMMC compliance.
Controls
Objectives
Controls
Time
Your Compliance Data Deserves
Federal-Level Protection
Dakeeko runs entirely on Microsoft Azure Government Cloud — the same FedRAMP High authorized infrastructure trusted by the DoD, FBI, and hundreds of federal agencies. Your CMMC data never touches commercial servers.
FedRAMP High Authorized
Built on infrastructure that meets all 421 FedRAMP High security controls — the highest baseline for federal cloud systems. Verified by independent 3PAO auditors.
US Sovereign Data Centers
All data is processed and stored exclusively in U.S. Government data centers operated by screened U.S. persons. Your CUI never leaves sovereign soil.
CUI-Ready Platform
Azure Government is authorized for CUI, ITAR, and DoD IL2/IL4/IL5 workloads — meaning your most sensitive compliance data is stored at a classification level that exceeds CMMC requirements.
How Dakeeko Compares
Most CMMC platforms run on commercial cloud. Dakeeko is built different.
| Security Feature | Dakeeko | Typical GRC Tool |
|---|---|---|
| Cloud Infrastructure | Azure Government | AWS / Azure Commercial |
| FedRAMP Authorization | ✓ High | None or Moderate |
| CUI Authorized | ✓ Yes | ✗ No |
| Data Residency | U.S. Gov Only | Multi-region / Global |
| Screened US Personnel | ✓ Yes | ✗ No |
| DoD IL2/IL4/IL5 Ready | ✓ Yes | ✗ No |
Want to see Dakeeko in action?
Book a free 1-on-1 walkthrough — we'll show you how it works for your specific needs.
See the Platform in Action
Built for compliance teams who need clarity, not complexity
Built for Two Roles
Whether you're managing your own compliance or guiding clients through theirs
What Used to Take Weeks, Our AI Does in Seconds
One click analyzes all 110 CMMC controls, identifies every gap in your compliance posture, and automatically generates a complete remediation plan with POA&Ms, timelines, and downloadable reports.
Why Spend $20K+ on Manual Assessments When AI Does It in Seconds?
CMMC assessments have always been expensive, slow, and painful. Not anymore.
Stop spending weeks on manual assessments — let AI handle the heavy lifting.
Learn More About AI Assessor →Everything You Need to Prove CMMC Compliance
Assessment-ready tools built specifically for defense contractors pursuing CMMC Level 1 and Level 2 certification
Prove Control Implementation
Document and verify all 110 NIST 800-171 controls with evidence-driven tracking. Upload policies, screenshots, and configurations as evidence — then mark controls as Implemented, Planned, or Alternative with audit-defensible documentation for each.
Generate Assessor-Grade SSPs
Instantly generate comprehensive, C3PAO-ready System Security Plans with one click. Automatically populates your control implementations, company information, and compliance documentation into a professional NIST 800-171 formatted document that assessors expect to see.
Audit-Defensible POA&M Management
Create, track, and manage Plan of Action & Milestones for controls that aren't fully implemented. Set priorities, assign owners, and document remediation timelines that satisfy assessor requirements.
SPRS Score Calculator AUTO
Know where you stand instantly. Automatically calculate your Supplier Performance Risk System (SPRS) score based on your control implementations. Required for DoD contracts and updated in real-time as you progress.
Asset Inventory
Maintain a comprehensive inventory of your IT assets, software, and hardware. Organize by asset type and track everything in one centralized location.
Evidence Repository
Store and organize compliance documentation, policies, and evidence in one secure location. Everything you need for your CMMC audit, ready when you need it.
Team Collaboration POWERFUL
Work together as a team. Invite team members to collaborate in real-time. Assign controls, track who implemented what, and keep everyone aligned on compliance progress—all in one shared workspace.
Company Profile Management
Centralize your organization's compliance information including company details, contact information, and certification status.
AI Trained on CMMC Assessment Logic NEW
You stay in control — AI accelerates your work. Our AI writes implementation statements, suggests POA&M remediation plans, and interprets assessment objectives on demand. Get expert-level suggestions in seconds while maintaining full control over your compliance documentation.
Security Tool Integrations AUTOMATE
Connect your existing security tools for automated compliance verification. Integrate with Microsoft 365, endpoint protection, security training, vulnerability scanners (Nessus), backup solutions (Veeam), ticketing systems (Jira), and SIEM (Microsoft Sentinel) to automatically verify up to 95+ controls with GCC High.
🔌 Connects With Your Security Stack
Automate evidence collection and control verification by connecting your existing tools
Ready to Simplify Your Compliance?
Join defense contractors who trust Dakeeko to manage their CMMC journey
Powerful Integrations for
Automated Compliance
Connect your existing security tools to automatically verify controls, generate evidence, and keep your compliance data always up-to-date.
Connect Your Security Stack
One-click integrations with the tools you already use
Your CUI Never Leaves Your Tenant
Understanding how Dakeeko's GCC High integration keeps your sensitive data exactly where it belongs — in your environment
"We Don't Want Your Data. We Want to Know If You're Compliant."
Dakeeko only stores pass/fail compliance status — never your CUI, tokens, configurations, or user data.
How Data Flows — And Where It Stays
Your GCC High Tenant
CUI, configs, users, policies
STAYS HERE
(Read-Only)
Your Browser
OAuth token + API responses
PROCESSED & DISCARDED
Only
Dakeeko
Only "met" or "not_met"
COMPLIANCE STATUS ONLY
Customer-Controlled App Registration
You create the Azure AD App Registration in YOUR tenant. You control all permissions. You can revoke access instantly — Dakeeko never has admin access to your environment.
Client-Side OAuth Authentication
OAuth tokens are returned directly to your browser — never to Dakeeko's servers. Your access token stays in browser memory and expires after 1 hour.
Read-Only Permissions
We only request read permissions: User.Read.All, AuditLog.Read.All, Policy.Read.All, Directory.Read.All. We cannot modify anything in your tenant.
Browser-Based Processing
Your browser calls Microsoft Graph directly. Raw API responses are processed client-side to determine compliance status, then immediately discarded from memory.
Full Auditability
Every Graph API call is logged in your Azure AD audit logs. You can see exactly what data was accessed, when, and by whom — complete transparency.
Instant Revocation
Delete the App Registration in Azure AD and access is immediately revoked. No persistent credentials, no service accounts, no backdoors — you're always in control.
What Dakeeko Stores
met, partial, not_met)
What Dakeeko NEVER Stores
Example: How MFA Verification Works
This architecture means that even if Dakeeko were somehow compromised, attackers would only get compliance status booleans — not CUI, not configurations, not credentials, not tokens.
How Integrations Work
Three simple steps to automated compliance
Connect
One-click OAuth connection or API key — no complex setup required. Your data stays in your systems.
Sync
Dakeeko automatically pulls compliance-relevant data and maps it to NIST 800-171 controls.
Verify
Controls are auto-verified with real evidence. Your SPRS score updates in real-time.
Ready to Automate Your Compliance?
Start your 5-day free trial and connect your first integration in minutes.
About Dakeeko
Dakeeko is the complete CMMC compliance platform built for defense contractors, MSPs, and compliance consultants. We help organizations achieve and maintain CMMC Level 1 and Level 2 certification — replacing scattered spreadsheets and manual workflows with a single, purpose-built solution.
From your first self-assessment to C3PAO readiness, Dakeeko guides you through every step — mapping controls, generating assessor-grade documentation, tracking remediation, and proving compliance with confidence.
Built on Azure Government Cloud
Dakeeko is one of the only CMMC compliance platforms hosted entirely on Microsoft Azure Government — FedRAMP High authorized infrastructure with 421 security controls. Your compliance data is processed and stored exclusively in U.S. Government data centers, operated by screened U.S. persons.
What Makes Dakeeko Different
Most compliance tools are built for large enterprises with dedicated security teams. Dakeeko is built for the rest of the defense industrial base — small and mid-size contractors, IT service providers, and the consultants who support them.
AI-Powered Assessor
Our AI reviews your documentation and evidence against each control, identifies gaps, suggests remediation steps, and auto-generates POA&Ms — saving hours of manual review.
GCC High Integration
Connect your Microsoft 365 GCC High environment and auto-verify up to 95+ controls directly from your tenant configuration — no manual evidence collection required.
Multi-Client Management
Consultants and MSPs can manage multiple client organizations from a single account — each with their own controls, evidence, documentation, and team members.
Assessor-Grade Documentation
Generate complete SSPs, POA&Ms, and SPRS scores that meet assessor expectations. Every document is built from your actual control data — not generic templates.
Meet the Founder
Tim Cleland
With over a decade of experience in government cybersecurity, I founded Dakeeko after seeing how defense contractors — especially small and mid-size companies — struggled to navigate CMMC without enterprise budgets. I've spent years working in federal compliance and understand what assessors actually look for. Dakeeko is built to make that expertise accessible to everyone in the defense industrial base, whether you're a solo contractor or an MSP managing dozens of clients.
Our Mission
CMMC compliance shouldn't require a dedicated security team or six-figure consulting engagements. We're building the tools that make certification achievable for organizations of any size — intuitive enough for a one-person IT shop, powerful enough to satisfy a C3PAO assessor.
Every feature in Dakeeko is designed around real-world assessment workflows. We don't just track controls — we help you understand what each one requires, document how you meet it, and prove it with evidence. You stay in control. We accelerate the work.
Built on Azure Government Cloud
Dakeeko runs entirely on Microsoft Azure Government — the same FedRAMP High authorized, U.S. sovereign cloud infrastructure trusted by the Department of Defense, intelligence community, and hundreds of federal agencies.
FedRAMP High
421 security controls — the highest federal baseline. Verified by independent 3PAO auditors.
US Sovereign Data
All data processed and stored in U.S. Government data centers operated by screened U.S. persons.
CUI Authorized
Authorized for Controlled Unclassified Information, ITAR, and export-controlled data.
DoD Impact Levels
Supports IL2, IL4, and IL5 workloads — exceeding CMMC Level 2 requirements.
What This Means for You
Your compliance data is treated like federal data
SSPs, POA&Ms, evidence files, AI assessments, and control mappings are stored with the same protections the government uses for its own sensitive data.
You practice what you preach
When your C3PAO auditor asks where your compliance tool stores data, the answer is "Azure Government Cloud — FedRAMP High." That speaks volumes.
No data sovereignty questions
Your data never touches commercial cloud or leaves U.S. sovereign soil. No overseas replication, no shared infrastructure with consumer workloads.
AI processing stays sovereign too
Dakeeko's AI Assessor runs on Azure OpenAI within Azure Government — your documents are analyzed by AI that never leaves the government boundary.
How We Compare
Most CMMC platforms run on commercial cloud. We're built different.
| Security Feature | Dakeeko | Typical GRC Tool |
|---|---|---|
| Cloud Infrastructure | Azure Government | AWS / Azure Commercial |
| FedRAMP Authorization | ✓ High (421 controls) | None or Moderate |
| CUI Authorized | ✓ Yes | ✗ No |
| ITAR Compliant | ✓ Yes | ✗ No |
| Data Residency | U.S. Gov Only | Multi-region / Global |
| Screened US Personnel | ✓ Yes | ✗ No |
| DoD IL2/IL4/IL5 | ✓ Yes | ✗ No |
| AI Processing Location | Azure Gov (Sovereign) | Commercial / Unknown |
Ready to See Federal-Grade Compliance?
Start your free trial and run a full CMMC gap assessment in minutes — on infrastructure you can actually trust with CUI.
Simple, Affordable CMMC Compliance
One platform. One price. Complete Level 1 & Level 2 compliance.
Have questions about your compliance needs?
Schedule a Free Consultation →Dakeeko CMMC Platform
Everything you need for CMMC certification
Billed annually
Includes 2 user accounts & 1 additional company
- Complete Level 1 & Level 2 compliance tools
- All 110 NIST 800-171 controls + 17 FAR controls
- 320 assessment objectives
- Auto-verify up to 95+ controls with GCC High
- SSP & POA&M document generators
- SPRS score calculator
- ✨ AI Assessor + Auto POA&Ms
- Asset inventory tracking
- Evidence repository
- Real-time team collaboration
- ☁️ GCC High integration support
✓ No credit card required • ✓ 5-day trial
📈 Need More? Simple Add-on Pricing
Scale as you grow with transparent per-client and per-user pricing.
Additional Client
Per client organization
Separate workspace & controls
Additional User
Per team member
Full platform access
White Label
For MSSP's / C3PAO's
View Partner Program →
🤔 Which level do my clients need?
Level 1 is for contractors handling Federal Contract Information (FCI) only.
Level 2 is required if you handle Controlled Unclassified Information (CUI).
Good news: Our $129/mo plan includes both levels!
🚀 Why Choose Dakeeko?
GCC High Integration
Connect your GCC High tenant to auto-verify 95+ controls. Our platform integrates securely without storing sensitive data.
Auto-Verify Up to 95+ Controls
30+ with basic integrations, 95+ with GCC High — fully automated compliance.
MSP Multi-Tenant
Manage all your clients from one dashboard with seamless switching.
❓ Frequently Asked Questions
Is my data safe?
Absolutely. Dakeeko is hosted on Azure Government Cloud — FedRAMP High authorized, US sovereign data centers. We only store compliance status data (met/not met booleans), never CUI, configurations, or credentials. See our Security Architecture →
Do I need GCC High to use Dakeeko?
No. Dakeeko works fully without GCC High — you can manually assess all 110 controls, use the AI Assessor, upload evidence, and generate documentation. GCC High integration is an optional add-on that auto-verifies up to 95+ controls for you.
What's the difference between Level 1 and Level 2?
Level 1 covers 15 basic safeguarding requirements for Federal Contract Information (FCI). Level 2 covers all 110 NIST 800-171 controls and is required if you handle Controlled Unclassified Information (CUI). Dakeeko includes both levels in every plan.
What happens after my free trial ends?
After your 5-day trial, you'll need to subscribe to keep access. All your data, assessments, and documentation are preserved — nothing is lost. You can pick up right where you left off.
Can I cancel anytime?
Yes. There are no long-term contracts or cancellation fees. You can cancel your subscription at any time from your account settings.
Can I manage multiple clients?
Yes. The first 2 client organizations are included in your base plan. Add more for $49/mo each — every client gets their own isolated workspace with separate controls, evidence, documentation, and team members. Perfect for MSPs and consultants. See our Consultant Program →
Does Dakeeko replace a C3PAO assessment?
No. Dakeeko prepares you for your C3PAO assessment — it doesn't replace it. Think of it as your preparation and readiness platform. Our AI identifies gaps, generates the documentation assessors expect, and helps you track remediation so you walk into your official assessment confident and organized.
The AI Gap Assessment
That Changes Everything.
One click. All 110 NIST 800-171 controls analyzed. Every gap identified. Complete remediation plan generated — with POA&Ms, timelines, and prioritization by SPRS impact. What used to take weeks of manual work now takes seconds.
How It Works
From documentation to full assessment in 5 steps
Document Your Controls
Add "How We Comply" notes to your controls describing your organization's current security implementations, and upload evidence files (policies, screenshots, configurations, PDFs) for AI review. You can type notes manually, import from a spreadsheet, or use AI to help draft implementation statements.
Click "Run AI Assessor"
One button launches the assessment across all documented controls. The AI evaluates each control individually using CMMC assessment methodology — the same logic a C3PAO assessor would use — analyzing your documentation against NIST 800-171 requirements.
Review Detailed Results
Every control gets a detailed assessment with: status determination (Met / Partially Met / Not Met), confidence level, reasoning explaining the determination, identified gaps, and actionable suggestions for remediation.
Apply Results & Auto-Generate POA&Ms
Accept the AI's findings with one click. Control statuses update automatically. For every control marked "Not Met," a POA&M is created instantly with the gap description, remediation steps, and recommended timeline — ready for your assessor.
Export & Repeat
Generate a comprehensive PDF assessment report to share with leadership, your C3PAO, or your CMMC consultant. As you remediate gaps, re-run the assessment anytime to track improvement — unlimited runs included.
The AI scans your uploaded evidence documents — policies, screenshots, configurations — and evaluates them against NIST 800-171 requirements
See What AI Assessment Results Look Like
Every control gets a detailed assessment — here are the three possible outcomes
Control fully meets requirements. AI provides detailed reasoning and improvement suggestions.
Gaps identified with specific remediation suggestions to reach full compliance.
Critical gaps highlighted. POA&M with remediation plan auto-generated on apply.
What the AI Evaluates
Trained on CMMC assessment methodology with deep knowledge of NIST 800-171
Implementation Completeness
Does your documentation address all aspects of the control requirement? The AI analyzes your "How We Comply" notes and uploaded evidence files — policies, screenshots, configurations — against the full control description and assessment objectives.
Assessment Objective Alignment
Each NIST 800-171 control has specific assessment objectives (320 total). The AI evaluates whether your implementation evidence satisfies each objective for the control.
Gap Identification
The AI specifically identifies what's missing — not just "you're not compliant" but exactly which aspects of the requirement your documentation doesn't address, so you know precisely what to fix.
Actionable Suggestions
Beyond identifying problems, the AI suggests specific remediation steps — what to implement, what to document, and how to strengthen your compliance posture for each control.
Confidence Scoring
Every determination comes with a confidence level (High, Medium, Low) so you know which assessments are solid and which might need human review. Full transparency, no black boxes.
Automatic POA&M Creation
Controls determined "Not Met" automatically get a POA&M generated with the identified weakness, remediation milestones, and realistic timelines based on implementation complexity.
Frequently Asked Questions
How accurate is the AI assessment?
The AI is trained on CMMC assessment methodology and NIST 800-171 control requirements. It provides high-quality preliminary assessments with confidence scoring. We recommend treating it as an expert first pass — review the results and make final determinations with your team. The AI is a force multiplier, not a replacement for human judgment.
Is my compliance data sent to third parties?
Your control documentation is processed through our secure AI pipeline and is not stored by the AI model, shared with third parties, or used for training. We take data security seriously — we're a CMMC compliance company, after all.
Can I re-run the assessment after making changes?
Yes — unlimited times. Run a full assessment, remediate the gaps, update your documentation, and re-run to verify improvement. You can also re-review individual controls for a deeper analysis. This iterative approach is how real compliance maturity works.
Does this replace a C3PAO assessment?
No — and it's not meant to. Our AI Assessor is a pre-assessment readiness tool that helps you identify and fix gaps before your official C3PAO assessment. Think of it as your compliance dress rehearsal. Organizations that go into a C3PAO assessment prepared pass faster and with fewer findings.
Do I need to document every control before running it?
No. The AI assesses whichever controls have documentation. You can document a few controls and run a partial assessment, or document all 110 and run a full assessment. Start wherever you are — the AI meets you there.
Is the AI Assessor included in the $129/mo plan?
Yes — fully included with unlimited assessments. No per-run fees, no token limits, no upsells. Every Dakeeko subscription includes the complete AI assessment engine.
Ready to See Where You Stand?
Start your free trial, add your compliance documentation, and run your first AI assessment in minutes. No credit card required.
White Label Dakeeko
Under Your Brand
Offer your clients a fully branded CMMC compliance platform — your logo, your colors, your domain. Powered by Dakeeko's AI assessment engine and hosted on Azure Government Cloud.
Built for Compliance Consultants & MSPs
You already advise defense contractors on CMMC. Now give them a platform with your name on it.
Compliance Consultants
Offer a branded compliance portal to your clients. Manage assessments, documentation, and remediation across your entire client base from one dashboard.
Managed Service Providers
Add CMMC compliance as a service offering. Your clients see your brand — not ours. Increase contract value with a turnkey compliance solution.
RPOs & C3PAOs
Provide your assessed organizations a branded platform to track their compliance posture. Streamline pre-assessment workflows and evidence collection.
What's Included
Everything you need to run a branded compliance practice.
Custom logo, colors, and company name throughout the platform
compliance.yourcompany.com with managed SSL certificate
Full AI-powered assessor, document review, and auto-generated POA&Ms
Manage all client organizations from a single partner view
Auto-verify 95+ controls across all client tenants
FedRAMP High authorized infrastructure — US sovereign data centers
Partner Pricing
Simple, transparent pricing. Scale as your practice grows.
Additional Client Organizations
Each with their own workspace, controls, evidence & team
Get Started in 3 Steps
Schedule a Partner Call
We'll walk through the platform, discuss your practice, and configure your branding. The entire onboarding process takes less than a week.
We Configure Your Portal
Send us your logo, brand colors, and custom domain. We'll set up your white-label instance with managed SSL — ready to show your clients.
Start Onboarding Clients
Add client organizations, run AI assessments, and deliver compliance services under your brand. Add new clients anytime for $49/mo each.
No commitment required. Let's see if it's a fit.
Contact Us
Have questions about CMMC compliance? We're here to help you succeed.
Send Us a Message
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's framework for ensuring that defense contractors adequately protect sensitive information. Here's everything you need to know.
📋 The Basics
CMMC stands for Cybersecurity Maturity Model Certification. It's a verification framework created by the U.S. Department of Defense (DoD) to ensure that companies working in the defense supply chain meet specific cybersecurity standards before handling sensitive government information.
Before CMMC, contractors simply self-attested that they met security requirements under DFARS 252.204-7012. There was no third-party verification. CMMC changes that — it requires independent assessments for most organizations handling Controlled Unclassified Information (CUI).
The CMMC final rule (32 CFR Part 170) was published in October 2024 and became effective December 16, 2024. The companion DFARS rule (48 CFR) is expected to begin appearing in DoD contracts via a phased rollout starting in 2025.
🏢 Who Needs CMMC?
If your company holds or processes Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as part of a DoD contract, you will need some level of CMMC certification. This applies to:
Companies that contract directly with the DoD
Any tier in the supply chain that touches CUI or FCI
Managed service providers supporting defense contractors
Parts, materials, or engineering firms in the defense industrial base
📊 The 3 CMMC Levels
Level 1 — Foundational
Self-Assessment • 15 Practices • FCI OnlyLevel 1 covers basic cyber hygiene for companies handling Federal Contract Information (FCI) only — not CUI. It requires 15 practices from FAR 52.204-21, things like using antivirus, limiting access, and basic password management. Assessment is a self-assessment, affirmed annually by a senior company official.
Level 2 — Advanced
C3PAO Assessment • 110 Controls • CUILevel 2 is where most defense contractors will land. It requires implementation of all 110 security controls from NIST SP 800-171 Rev 2, covering 14 control families. For contracts involving critical CUI, a third-party assessment by a C3PAO (Certified Third-Party Assessor Organization) is required, with triennial reassessments and annual affirmations.
Some Level 2 contracts may allow self-assessment (for non-critical CUI), but most are expected to require third-party assessment.
Level 3 — Expert
Government-Led • NIST 800-172 • APT DefenseLevel 3 is for organizations working on the most sensitive DoD programs. It adds 24+ additional enhanced security requirements from NIST SP 800-172, focused on protecting against Advanced Persistent Threats (APTs). Assessment is performed by the government (DIBCAC), not a C3PAO. Very few contractors will need Level 3.
📖 Key Terms You'll Hear
CUI — Controlled Unclassified Information
Sensitive government information that isn't classified but still requires safeguarding. Think technical drawings, test data, personnel info, export-controlled data. CUI is defined by the National Archives (ISOO) and marked in contracts.
FCI — Federal Contract Information
Information provided by or generated for the government under a contract, not intended for public release. FCI has fewer protection requirements than CUI (Level 1 vs Level 2).
C3PAO — Certified Third-Party Assessor Organization
The independent organizations authorized by the CMMC Accreditation Body (Cyber AB) to conduct Level 2 assessments. They send certified assessors to evaluate your implementation of the 110 controls.
SSP — System Security Plan
Your master document describing how your organization meets each of the 110 NIST 800-171 controls. This is the first thing an assessor reviews. A strong SSP is the single most important CMMC artifact.
POA&M — Plan of Action and Milestones
A document listing controls you haven't fully met yet, along with your plan and timeline to fix them. Under CMMC, limited POA&Ms are allowed — but NOT MET controls with high point values may be disqualifying.
SPRS Score
Your Supplier Performance Risk System score, ranging from -203 to 110 points. Calculated based on which of the 110 controls you've implemented (each has a 1, 3, or 5 point value). You're already required to submit this score today under DFARS 7019/7020.
NIST SP 800-171
The National Institute of Standards and Technology publication that defines the 110 security controls for protecting CUI in non-federal systems. CMMC Level 2 is a direct implementation verification of 800-171 Rev 2.
Scoping — CUI Boundary
The systems, people, and facilities that process, store, or transmit CUI. Defining your CUI boundary is one of the first and most critical steps — it determines what's in scope for your assessment.
🏛️ The 14 Control Families
NIST 800-171's 110 controls are organized into 14 families. Here's what each one covers:
🔍 What a C3PAO Assessor Actually Looks For
A CMMC Level 2 assessment isn't a simple checkbox exercise. Assessors use the CMMC Assessment Guide which breaks each control into individual assessment objectives — 320 total across the 110 controls. For each objective, they look for three things:
Review documentation — policies, procedures, SSP, configurations, screenshots, and evidence artifacts.
Talk to personnel responsible for implementation to confirm they understand and follow the documented practices.
Verify the control is actually working as described — inspect live systems, check configurations, validate technical implementation.
Pro tip: The best way to prepare is to write your SSP as if the assessor is reading it. For each control, document what you do, how you do it, and what evidence proves it. If you can satisfy Examine + Interview + Test before the assessor arrives, you're in great shape.
📅 CMMC Timeline
Streamlined from 5 levels to 3. Aligned Level 2 with NIST 800-171.
CMMC program codified in federal regulation. Defines assessment requirements.
CMMC program officially in effect. C3PAOs can begin conducting assessments.
The companion rule that actually places CMMC requirements in DoD contracts. Expected to roll out in phases.
DoD begins including CMMC Level 1 and Level 2 self-assessment requirements in new contracts and option exercises.
Contracts begin requiring third-party (C3PAO) assessments for Level 2 certification on contracts involving critical CUI.
CMMC requirements expand to all applicable DoD contracts. Level 3 (DIBCAC) assessments begin for the most sensitive programs.
❌ Common Misconceptions
Size doesn't matter — if you handle CUI or FCI on a DoD contract, you need CMMC. Even a 5-person machine shop making parts for a defense prime needs at least Level 1, and likely Level 2 if CUI is involved.
Tools are important, but CMMC is about proving that you've implemented practices — policies, procedures, training, and evidence. You can have the best firewall in the world, but if you can't document how it's configured and why, it doesn't count.
The 32 CFR final rule is already in effect. C3PAOs are authorized and conducting assessments now. Even before CMMC appears in your contract, DFARS 7012/7019/7020 already require you to implement NIST 800-171 and report your SPRS score. Primes are also increasingly requiring it of their subs.
Your MSP might manage your infrastructure, but you are responsible for your CMMC certification. You need to understand your CUI boundary, document your security practices, and own the assessment process. Your MSP is a partner, not a substitute.
Most organizations need 6–18 months to go from starting their compliance journey to being assessment-ready, depending on their starting point. Dakeeko dramatically accelerates this, but implementing real security practices still takes focused effort.
🚀 Getting Started with CMMC
Identify what CUI you handle, where it flows, and which systems, people, and facilities are in scope. This is the foundation everything else builds on.
Evaluate your current security posture against NIST 800-171's 110 controls. Dakeeko's AI assessor can do this in minutes instead of weeks.
Implement missing controls, create policies and procedures, and build your SSP. Create POA&Ms for anything you can't fix immediately.
Gather screenshots, configuration exports, policy documents, training records, and other artifacts that prove each control is implemented.
Upload your SPRS score to the DoD portal and engage a C3PAO when you're ready, or affirm your self-assessment for Level 1.
Ready to Start Your CMMC Journey?
Dakeeko makes CMMC compliance achievable for organizations of any size. Try it free — no credit card required.