CMMC Level 2 enforcement is November 2026. Every DoD prime and subcontractor touching CUI must demonstrate a passing SPRS score before award. There is no workaround — DFARS 252.204-7012 and 7019/7020/7021 make CUI protection a contract condition, not a preference. CoreRecon is the only SDVOSB-certified Texas MSSP that drives your SPRS score, manages your POA&M, and delivers C3PAO-ready SSP artifacts — at $89–$129/endpoint.
Texas hosts the second-largest defense industrial base in the country — JBSA, NAS Fort Worth JRB, L3 Technologies, Bell, Lockheed, Raytheon, and thousands of Tier 2/3 suppliers in the DFW corridor. Ransomware affiliates and nation-state actors specifically target the lower tier because primes have hardened their perimeters while suppliers remain unprotected CUI conduits.
CoreRecon is SDVOSB-certified. When DoD primes bundle our managed SOC into their subcontract stack, it counts toward their small-business subcontracting goals under FAR 19.7 — and specifically toward the SDVOSB participation targets required by DFARS 252.219-7003 on DoD contracts. No other Texas MSSP offers this.
CMMC Level 2 aligns to all 110 practices in NIST SP 800-171 Rev 2 across 14 domains. Here's exactly how CoreRecon covers each domain — and which tier gets you there. For the full compliance guide, see the CMMC Compliance Guide.
| Domain | NIST 800-171 Ref | Key Controls | CoreRecon Coverage |
|---|---|---|---|
| Access Control (AC) | 3.1.x — 22 practices | Least privilege, remote access controls, mobile device access, CUI access limits | Sentinel RBAC, least-privilege enforcement, remote access policy, MFA on all CUI-touching systems |
| Awareness & Training (AT) | 3.2.x — 3 practices | Security awareness, role-based training, insider threat awareness | Sentinel Annual training, simulated phishing, role-based CUI handling modules, documented completion records |
| Audit & Accountability (AU) | 3.3.x — 9 practices | Audit log creation, protection, review, and retention; user-level accountability | Sentinel SIEM log collection, 90-day retention, user-level audit trails, monthly log review reports |
| Configuration Management (CM) | 3.4.x — 9 practices | Baseline configs, change control, blacklisting unauthorized software | Fortress CMDB, change approval workflow, application allowlisting, baseline documentation |
| Identification & Authentication (IA) | 3.5.x — 11 practices | Unique IDs, MFA for privileged users, authenticator management | Sentinel Unique ID enforcement, phishing-resistant MFA, password manager policy, authenticator lifecycle |
| Incident Response (IR) | 3.6.x — 3 practices | IR capability, reporting (72-hr DoD notification), IR testing | Command 30-min SLA, 24/7 SOC, DFARS 7012 72-hr notification workflow, tabletop exercise annually |
| Maintenance (MA) | 3.7.x — 6 practices | Controlled maintenance, sanitize media before off-site, MFA for remote maintenance | Fortress Maintenance control policies, remote maintenance MFA, media sanitization procedures |
| Media Protection (MP) | 3.8.x — 9 practices | CUI media marking, secure transport, encryption, sanitization/destruction | Sentinel Media encryption, DLP tagging, chain-of-custody, certified destruction certificates |
| Personnel Security (PS) | 3.9.x — 2 practices | Personnel screening, CUI access termination on separation | Sentinel Offboarding automation, 24-hr access revocation, separation checklist, background check tracking |
| Physical Protection (PE) | 3.10.x — 6 practices | Physical access controls, escort of visitors, CUI in controlled areas | Sentinel Physical security assessment, badge access standards, visitor log requirements, workstation lock policy |
| Risk Assessment (RA) | 3.11.x — 3 practices | Periodic risk assessments, vulnerability scanning, remediation | Fortress Annual risk assessment, quarterly vulnerability scans, SPRS-aligned scoring, remediation tracking |
| Security Assessment (CA) | 3.12.x — 4 practices | Periodic security assessments, POA&M management, system security plan | Command C3PAO-ready SSP, POA&M management, annual assessment, evidence package |
| System & Communications Protection (SC) | 3.13.x — 16 practices | Boundary protection, CUI in transit encryption, network segmentation, DNS filtering | Fortress Perimeter protection, TLS enforcement, network segmentation, DNS filtering, east-west monitoring |
| System & Information Integrity (SI) | 3.14.x — 7 practices | Malware protection, security alerts, patch management, email/web protection | Fortress EDR/XDR, 30-day patch SLA, email security, web filtering, real-time malware detection |
Your SPRS score is live in the PIEE system — contracting officers check it before award. CoreRecon runs the assessment, builds your POA&M, tracks remediation to closure, and produces the System Security Plan artifacts a C3PAO will accept. You own the score; we do the work to earn it.
Sentinel covers the awareness, access, and logging domains. Fortress adds the technical controls that move most SPRS scores above 90. Command is the tier for contractors who need a C3PAO-ready SSP, full POA&M management, and the 30-minute incident response SLA that satisfies DFARS 7012.
The enterprise MSSPs can cover defense contractors — but they weren't built for CMMC, SPRS, or SDVOSB teaming. Here's how the five dimensions that matter in the DIB compare.
| Dimension | CoreRecon | Cybriant | Trustwave | Secureworks |
|---|---|---|---|---|
| SDVOSB Status | ✅ SDVOSB-certified (VA VetCert). Counts toward prime's FAR 19.7 subcontracting goal & DFARS 252.219-7003 SDVOSB targets. | ❌ Not SDVOSB-certified. No DoD set-aside credit. | ❌ Not SDVOSB. Enterprise-only contract structure. | ❌ Not SDVOSB. No small-business credit for prime subcontracting plans. |
| CMMC Level 2 Support | ✅ All 14 CMMC domains mapped to tier. SSP authoring, POA&M management, C3PAO readiness package. Fortress/Command paths to certification. | ⚠️ MDR and SIEM coverage. Customer maps independently to CMMC framework. | ⚠️ Compliance modules available at enterprise pricing. CMMC-specific playbooks not published. | ⚠️ Broad compliance reporting. CMMC practice-level mapping not documented publicly. |
| SPRS Score Support | ✅ NIST SP 800-171 self-assessment, SPRS score management in PIEE, POA&M tracked to closure. Score driven up, documented for contracting officer review. | ❌ No SPRS-specific service offering documented. Assessment scope is customer responsibility. | ❌ No SPRS or PIEE management service documented. | ❌ No SPRS score management. Customer handles PIEE submission independently. |
| 30-Min Incident SLA | ✅ 30-min analyst response, any time, including weekends. DFARS 7012 72-hr notification workflow built into Command tier. Pre-authorized playbooks for CUI incidents. | ⚠️ SLA varies by engagement tier. 30-min response not published as standard. | ⚠️ Enterprise SLAs available. Mid-market DIB contractors typically on shared SOC queue. | ⚠️ 24/7 SOC with tiered response. 30-min SLA not standard for sub-500 endpoint accounts. |
| CUI Handling & DLP | ✅ CUI data classification, DLP tagging, media encryption (MP domain), ITAR data scoping during SSP development. Forensic preservation for DFARS 90-day image requirement. | ⚠️ DLP available as add-on module. CUI-specific scoping is customer responsibility. | ⚠️ DLP solutions offered. Defense-specific CUI handling protocol not documented. | ⚠️ Broad data security services. CUI boundary scoping typically out of scope for standard MDR. |
| Transparent Pricing | ✅ $89/$109/$129/endpoint published. Month-to-month. 10-endpoint minimum. No 3-year lock-in, no RFP cycle. | ❌ Quote-only. No published pricing for sub-500 endpoint defense contractors. | ❌ Enterprise contracts. Six-figure annual commitment for standard deployment. | ❌ Quoted per engagement. Pricing not publicly disclosed for mid-market DIB scope. |
We assess your current SPRS-equivalent posture against all 110 NIST 800-171 practices,
identify the gaps most likely to cost you contract awards, and deliver a prioritized
remediation plan. No credit card. No commitment. Delivered in 14 days.
SDVOSB-certified team. Texas-based. The CMMC clock is running.
Delivered within 14 days • No credit card • SDVOSB-certified • CMMC Level 2 specialists
See a sample report — redacted 12-page PDF, real findings.
Need a SOW for your contracting officer or program manager? Build your Scope of Work PDF →
61% of CMMC L2 gaps are vendor/supply-chain related. Score your vendor risk against CMMC SCRM SR family →
DFARS 252.204-7012 is the foundational clause — it requires you to provide adequate security for CUI, report cyber incidents within 72 hours to the DIBNet portal, and preserve images of compromised systems for 90 days. It has been in contracts since 2016 and applies broadly.
DFARS 252.204-7019 requires contractors to conduct a NIST SP 800-171 self-assessment and post a current score in SPRS before contract award. The score must be current within 3 years and must reflect your actual implementation — not an aspirational self-grade.
DFARS 252.204-7020 requires contractors to cooperate with DoD assessment teams if the Government conducts a medium or high confidence assessment of your implementation. It also requires flow-down of 7019/7020 to subcontractors handling CUI.
DFARS 252.204-7021 is the CMMC compliance clause — it requires the contractor to have a current CMMC certificate at the required level as a condition of contract performance. For CMMC Level 2, either a self-attestation (most contractors) or a C3PAO assessment (for contracts designated as requiring formal certification) satisfies this clause. CoreRecon Command tier prepares you for both.
Not strictly FedRAMP, but it must meet an equivalent standard. CMMC Level 2 requires that cloud services used to process, store, or transmit CUI meet security requirements equivalent to FedRAMP Moderate. This is often called "FedRAMP Equivalent" in the CMMC rule. In practice, this means:
CoreRecon Fortress and Command tiers include a cloud environment assessment to identify CUI residing in non-compliant cloud tenants — a common gap that tanks SPRS scores and triggers C3PAO findings.
ITAR (International Traffic in Arms Regulations) and CMMC address overlapping but distinct data categories. CUI is the CMMC category; ITAR-controlled technical data is a separate export control regime. However, most ITAR-controlled technical data in a DoD contract context qualifies as CUI — meaning your CMMC controls also protect your ITAR data, but ITAR compliance itself is not satisfied by CMMC certification alone.
Key intersection points:
CoreRecon Command tier includes ITAR data classification tagging as part of the CUI scoping exercise during SSP development.
CMMC Level 1 applies to contracts with Federal Contract Information (FCI) only — 17 basic practices. Most simple commercial contracts fall here.
CMMC Level 2 applies when your contract involves Controlled Unclassified Information (CUI) — 110 practices aligned to NIST SP 800-171. This is the level that affects the vast majority of defense subcontractors. If your contract contains any of the following clauses, you're almost certainly in scope: DFARS 252.204-7012, 7019, 7020, or 7021.
CMMC Level 3 applies to a small subset of the DIB working on the highest-priority DoD programs — it adds 24 practices from NIST SP 800-172 on top of NIST 800-171. DoD designates Level 3 contracts; you'll know if you're in scope because the contracting officer will tell you. Level 3 requires a formal Government-led assessment, not C3PAO or self-attestation. CoreRecon does not currently cover Level 3.
Managed IT and managed security are different functions that most IT companies conflate. Your IT company patches, configures, and troubleshoots systems. A SOC monitors for adversary behavior — and the two activities create a conflict of interest: the same team that maintains systems cannot objectively detect when those systems have been compromised.
For CMMC purposes specifically:
CoreRecon operates as the independent security function alongside your existing IT provider. We don't replace IT; we add the SOC layer that CMMC requires to be separate.