Cyberneza is based in Orlando, and one of the biggest pockets of defense work in town sits in the Central Florida Research Park next to UCF. Naval Support Activity Orlando is home to the Navy's Naval Air Warfare Center Training Systems Division (NAWCTSD) and the Army's simulation and training office, now called CPE ST3 (formerly PEO STRI). The Air Force and Marine Corps have simulation and training offices there too.
Those offices buy training systems, simulations, courseware, research and AI work. Many of the companies that build them are small businesses, either prime contractors or subcontractors. If that's you, here's what CMMC means in practice.
Start with your contract
CUI comes to you through the contract: the DFARS 7012 clause, flow-downs from your prime, and CUI markings on the technical data, specs or drawings you receive. If those are there, you're looking at CMMC Level 2. If you only handle basic contract information, Level 1 may be your level.
Know where the CUI lives
Simulation work often means engineering files, source code and test data spread across many machines. Decide where CUI is allowed to live and keep it in a small, separate environment. That means fewer systems to protect and simpler compliance.
Get your SPRS score right
Level 2 maps to the 110 requirements in NIST SP 800-171. Score yourself honestly against the DoD Assessment Methodology and post the result in SPRS. Primes check that number before they team with you.
Expect your prime to ask
Even while parts of the CMMC rollout are on hold, DFARS 7012 and self-assessments are in force. Primes are already asking subcontractors for their SPRS score and System Security Plan.
Use the free help
NAWCTSD's own "Doing Business" sheet points small businesses to Project Spectrum and to CISA's free cyber services for CMMC readiness. They're worth a look before you spend money.
Where to go next
- CMMC Level 1 vs. Level 2
- How to calculate your SPRS score
- CMMC for small business
- CMMC consultant in Orlando
Cyberneza is a veteran-owned, Orlando-based firm with a 100% US-based team. If you're a local contractor working through CMMC, send us a message.