CMMC and NIST SP 800-171: IT Help for Chicago-Area Manufacturers
What the requirements ask of your IT, and where CIO Landing helps.
Since 2012, CIO Landing has supported manufacturers and other businesses across Chicagoland. If your company handles information for U.S. Department of Defense contracts, you may be asked to show that your systems meet CMMC and NIST SP 800-171. This page explains, in plain language, what those requirements ask of your IT and where we help. It is not legal advice.
- CMMC Level 1 is 15 basic requirements for federal contract information. Level 2 is 110 requirements from NIST SP 800-171 Rev. 2 for controlled unclassified information (CUI).
- The Department of Defense is phasing CMMC into contracts from November 10, 2025 to November 10, 2028. Phase 2, which adds Level 2 third-party assessments, begins November 10, 2026.
- We remediate the technical controls: multi-factor authentication, encryption, logging and monitoring, patching, access control and endpoint protection.
- We do not perform gap assessments, write System Security Plans or certify you. Your contract, prime contractor or counsel decides which level applies.
What CMMC and NIST SP 800-171 are
NIST SP 800-171 is the security standard for protecting controlled unclassified information (CUI) on contractor systems. CMMC is the Department of Defense program that verifies contractors actually meet it. Level 2 maps to the 110 requirements in NIST SP 800-171 Rev. 2. Level 1 maps to the 15 basic safeguarding requirements in FAR 52.204-21. Both are described by the Department of Defense on its CMMC program page.
The three CMMC levels
- Level 1: 15 requirements, for federal contract information (FCI) only. Annual self-assessment.
- Level 2: 110 requirements from NIST SP 800-171 Rev. 2, for CUI. Depending on the contract, a self-assessment or a third-party assessment by a certified assessor organization (C3PAO), valid for three years.
- Level 3: Level 2 plus additional requirements from NIST SP 800-172, for the most critical programs. Government-led assessment.
When it shows up in contracts
The Department of Defense is adding CMMC to contracts in phases over three years, starting with its acquisition rule on November 10, 2025:
- Phase 1 (November 10, 2025): Level 1 and Level 2 self-assessment requirements appear in applicable contracts.
- Phase 2 (November 10, 2026): Level 2 third-party assessments begin to appear.
- Phase 3 (November 10, 2027): Level 3 requirements appear.
- Phase 4 (November 10, 2028): full implementation.
Dates and applicability depend on each solicitation, so check the clauses in your own contract or ask your prime contractor.
Where CIO Landing helps (the technical controls)
NIST SP 800-171 covers more than technology: policy, training, physical security and documentation matter too. We handle the technical side, and we fix what an assessment or self-review finds:
- Multi-factor authentication on user accounts, remote access and cloud services.
- Encryption of devices, laptops and data in transit.
- Logging and monitoring: 24/7 monitoring with AI-based antivirus and managed detection and response.
- Patching of operating systems and applications on a managed schedule.
- Access control: role-based access, least privilege, and removal of access when people leave.
- Endpoint protection on every managed device.
Everyday protection runs underneath: email protection, security awareness training, and backups kept off-site for 90 days in U.S. data centers with a 24-hour restore target. Monitoring runs 24/7; the help desk is Monday to Friday, 7am to 7pm CT.
What we do not do
We do not give legal advice or decide which CMMC level applies to you. This page does not describe gap assessments, System Security Plans, plans of action and milestones, assessor or C3PAO services, or operational-technology network segmentation as part of our service. If you use a specialist for those, we work with them and fix the technical findings.
Manufacturers and ERP environments
Many defense suppliers are manufacturers. We already support ERP and warehouse applications such as Microsoft Dynamics 365 / Business Central, NetSuite, Epicor, Infor and Sage, and we apply the controls above around them. See our manufacturing IT page, or the cybersecurity audits guide to see how an assessment works.
How we work with you
Your Client Success Manager is your account manager, your Technology Alignment Manager (TAM) keeps the roadmap aligned with your growth, and a Fractional CIO (vCIO) is available when you need strategic guidance. Our published range is $150 to $225 per user per month; see Pricing and Service Levels. Onboarding takes about one month, and projects are quoted separately. If you already have your own IT staff, see co-managed IT, or read how it works.
Our office is in Northfield, IL, and we meet clients downtown Chicago by appointment. We serve companies within about a two-hour drive of Northfield. For financial firms, see FTC Safeguards and SEC Regulation S-P.
Frequently asked questions
What is CMMC, and does it apply to my company?
CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense program that checks whether contractors protect the government information they handle. It applies to companies whose Department of Defense contracts include a CMMC requirement. Your contract, your prime contractor or your counsel decides which level, if any, applies to you.
What is the difference between CMMC Level 1 and Level 2?
Level 1 covers 15 basic requirements for federal contract information and is a self-assessment. Level 2 covers 110 requirements from NIST SP 800-171 Rev. 2 for controlled unclassified information (CUI), and depending on the contract it is a self-assessment or a third-party assessment by a certified assessor organization (C3PAO).
When do the CMMC requirements start showing up in contracts?
The Department of Defense is phasing CMMC in over three years from November 10, 2025. Phase 1 added Level 1 and Level 2 self-assessment requirements to applicable contracts. Phase 2 begins on November 10, 2026 and adds Level 2 third-party assessments. The program is fully in place on November 10, 2028.
Can CIO Landing help us meet NIST SP 800-171 or CMMC?
We remediate the technical controls: multi-factor authentication, encryption, logging and monitoring, patching, access control and endpoint protection. Policies, documentation and the assessment itself are separate work, and we do not describe them as part of our service.
Do you perform CMMC gap assessments or write our System Security Plan?
No. This page does not describe gap assessments, System Security Plans, plans of action and milestones or assessor services as part of what we do. We can work alongside the specialist you choose for those and fix the technical findings they identify.
Are you a C3PAO, and can you certify us?
No. Certification comes from the Department of Defense program through an authorized assessment, not from your IT provider. We help you get the technical controls in place before that assessment.
Which technical controls matter most?
The ones assessors look at first are multi-factor authentication, encryption of data at rest and in transit, audit logging, timely patching, least-privilege access control and endpoint protection. We configure and manage these across your devices, servers and cloud accounts.
Will this work with our ERP and shop-floor systems?
Yes for the ERP and warehouse applications we already support, such as Microsoft Dynamics 365 / Business Central, NetSuite, Epicor, Infor and Sage. See our manufacturing page for the full list. We do not describe operational-technology network segmentation as part of this service.
Do you give legal or contract advice?
No. Your counsel, your prime contractor or your contracting officer decides which CMMC level and clauses apply to you.
What does it cost?
Our published range is $150 to $225 per user per month; see Pricing. Remediation projects are quoted separately.
Ready to Stop Worrying About IT?
Book a discovery call today.
Business leaders trust us to simplify their technology decisions. Find out how we can streamline yours in just 30 minutes.
