Question 1

Do I need CMMC if I only handle FCI?

Accepted Answer

If you handle Federal Contract Information (FCI) but not Controlled Unclassified Information (CUI), you generally fall under CMMC Level 1 - an annual self-assessment against 15 basic safeguarding requirements. Handling CUI moves you to Level 2 and its 110 NIST 800-171 controls.

Question 2

What's the difference between a CCP and a CCA?

Accepted Answer

A CMMC Certified Professional (CCP) is trained to support readiness and consulting work. A CMMC Certified Assessor (CCA) is authorized to conduct certified assessments as part of a C3PAO team. Summit Cyber's staff hold both.

Question 3

Can I self-assess, or do I need a third-party assessment?

Accepted Answer

It depends on your level and contract. Level 1 and a subset of Level 2 allow self-assessment; most Level 2 CUI work requires a certification assessment by an authorized C3PAO. We help you determine which path your contracts trigger.

Question 4

What's the difference between NIST 800-171 and CMMC?

Accepted Answer

NIST SP 800-171 is the control set. CMMC is the Department's program for verifying - and, at Level 2, certifying - that you've actually implemented those controls. One is the standard; the other is the proof.

Question 5

How long does CMMC readiness take?

Accepted Answer

It varies with your starting posture and scope, but most small and mid-size contractors should plan on a multi-month effort. The gap assessment sets the real timeline - starting early is the single biggest cost saver.

Question 6

What is a C3PAO, and do I need one?

Accepted Answer

A Certified Third-Party Assessment Organization is authorized to conduct Level 2 certification assessments. If your contract requires a certified Level 2 assessment, you'll engage a C3PAO - and Summit Cyber prepares you so that assessment goes smoothly.