CMMC-ready IT for
government contractors.

Understanding CMMC 2.0 and NIST 800-171.

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's framework for verifying that the roughly 200,000 companies in the defense industrial base actually protect the sensitive federal information they handle. Under CMMC 2.0, requirements scale with the data you touch: Level 1 covers basic safeguarding of Federal Contract Information (FCI) through 17 practices and an annual self-assessment, while Level 2 — required for most contractors handling Controlled Unclassified Information (CUI) — aligns with the 110 controls of NIST SP 800-171 and, for many contracts, requires a third-party assessment by a certified C3PAO.

The pressure isn't theoretical. DFARS clause 252.204-7012 has required NIST 800-171 implementation and a SPRS score for years, and primes increasingly refuse to issue purchase orders to subcontractors who can't prove compliance. As CMMC clauses appear in solicitations, a missing or low score quietly removes you from consideration before a human ever reads your proposal.

What JPert actually does

We start with a gap assessment against all 110 NIST 800-171 controls, mapped to your specific contracts and the data you handle. From there we build your System Security Plan (SSP) and a realistic Plan of Action and Milestones (POA&M), implement the technical and administrative controls — access control, multi-factor authentication, encryption, logging, configuration management, and incident response — and stand up a compliant environment, often a Microsoft 365 GCC High CUI enclave. Finally, we calculate and submit your SPRS score and prepare the evidence package an assessor expects, so a C3PAO assessment is a formality, not a fire drill.

Built for small and mid-size contractors

Large defense firms have internal security teams; most subcontractors don't. JPert is built for the small and mid-size prime contractors and subcontractors across Northern Virginia, Washington DC, and Maryland who need to be compliant but can't justify a full-time CISO. You get Fortune 500-grade security and direct access to the founder — the same person who scopes your work also stands behind it.

Frequently asked questions.

Do I need CMMC certification?
If your DoD contracts include DFARS 252.204-7012 and you handle FCI or CUI, yes. Most contractors handling CUI need CMMC Level 2 (the 110 NIST 800-171 controls). We review your contracts and posture to confirm the level you need.

What's the difference between CMMC and NIST 800-171?
NIST 800-171 is the standard (the controls); CMMC 2.0 is the DoD's verification that you've implemented them — by self-assessment or a C3PAO assessment.

Can you improve our SPRS score?
Yes. We close gaps, document them in your SSP and POA&M, implement the missing controls, and recalculate and submit an accurate, defensible SPRS score.

Do you support Microsoft GCC High?
Yes — for contractors handling CUI or ITAR data, we design and manage compliant GCC High environments with the access control, encryption, and audit logging CMMC requires.