Compliance
CMMC Compliance Consulting for Defense Contractors
CFBTEL helps defense contractors and subcontractors in Orange County get ready for CMMC. We find the gaps against the controls your contracts require, help close them and organize the evidence an assessor will ask for.
- Supporting businesses since 2011
- Office in Costa Mesa
- 24/7 remote support
What changed on November 10, 2026
| Phase | Start date | What it adds |
|---|---|---|
| Phase 1 | November 10, 2025 | Level 1 or Level 2 self-assessments as a condition of award where the solicitation requires them |
| Phase 2 | November 10, 2026 | Level 2 certification assessments by a C3PAO as a condition of award where specified |
| Phase 3 | November 10, 2027 | Level 2 C3PAO assessments on all applicable solicitations and contracts, and Level 3 assessments where specified |
| Phase 4 | November 10, 2028 | Full implementation, including option periods on contracts awarded earlier |
Sources: 32 CFR 170.3(e), which starts each phase one year after the last, and the DFARS final rule, effective November 10, 2025.
Which CMMC level applies to you
| Level | Information it protects | Requirements | Assessment |
|---|---|---|---|
| Level 1 | Federal Contract Information (FCI) | 15 requirements in FAR 52.204-21 | Self-assessment |
| Level 2 | Controlled Unclassified Information (CUI) | 110 requirements in NIST SP 800-171 Rev. 2 | Self-assessment, or a certification assessment by a C3PAO, as the contract specifies |
| Level 3 | CUI on the most sensitive programs | Level 2 plus 24 requirements from NIST SP 800-172 | Certification assessment by DCMA DIBCAC |
Source: 32 CFR Part 170.
How CFBTEL gets you ready
- Step 1
Scope
We find where FCI and CUI live in your business and which systems touch them.
- Step 2
Gap analysis
We compare your setup with the requirements for your level.
- Step 3
Plan of action
Each gap goes into a plan of action and milestones (POA&M) with an owner and a date.
- Step 4
Controls put in place
We set up the required controls in your Microsoft 365, computers and network.
- Step 5
System Security Plan and evidence
We write your System Security Plan and organize the evidence an assessor will ask for.
- Step 6
Assessment preparation and monitoring
We prepare you for the assessment and keep the controls monitored afterwards.
Who does what
| Task | Your company | CFBTEL | C3PAO |
|---|---|---|---|
| Decide which contracts and data are in scope | Decides | Maps where FCI and CUI live | None |
| Close the gaps | Approves the changes | Puts the controls in place | None |
| Write the System Security Plan | Reviews and owns it | Drafts it and gathers the evidence | Reviews it during the assessment |
| Level 2 certification assessment | Takes part | Prepares you | Performs it |
| Affirm compliance | A senior official signs the affirmation | Prepares the evidence behind it | None |
Areas we serve
- Costa Mesa
- Long Beach
- Orange
- Los Angeles
- Garden Grove
- Mission Viejo
- Santa Ana
- Anaheim
- Beverly Hills
- Fullerton
- Glendale
- Newport Beach
- Huntington Beach
- Irvine
- Laguna Beach
- Tustin
- Lake Forest
- San Juan Capistrano
- Pasadena
- Seal Beach
- Laguna Niguel
- Dana Point
- Laguna Hills
- Rancho Santa Margarita
- Cypress
See every city on the service areas page.
FAQ
Questions we hear first
Book a free CMMC consultation
Related services
Contact CFBTEL
Book a free consultation with our Costa Mesa team
- 949-381-2525
- 3151 Airway Ave, Suite B2, Costa Mesa, CA 92626
Serving all of Orange County & Greater Los Angeles. - On-site staff: Mon-Fri 3:00am-7:00pm, Sat 8:00am-4:00pm
Remote support and infrastructure monitoring: 24/7