CMMC 2.0 Compliance for San Antonio Government Contractors: What You Need to Know

Table of Contents

CMMC 2.0 is the DoD's framework for protecting Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) in the defense industrial base supply chain.

Why It Matters for San Antonio Contractors:

San Antonio is home to Joint Base San Antonio (Lackland, Fort Sam Houston, Randolph), hundreds of defense contractors and subcontractors, cybersecurity and intelligence operations, and a growing aerospace and defense manufacturing sector.

If you do business with the DoD, directly or as a subcontractor, CMMC requirements began appearing in contracts with Phase 1 on November 10, 2025. Phase 1 self-assessments remain in effect; the Phase 2 third-party assessment gate is currently suspended.

CMMC 2.0 simplified the original five-level model to three levels.

Level 1: Foundational

Who Needs It: Contractors handling only FCI (Federal Contract Information)

Level 2: Advanced

Who Needs It: Most contractors handling CUI (Controlled Unclassified Information)

This is the level most San Antonio defense contractors will need.

Level 3: Expert

Who Needs It: Contractors handling the most sensitive CUI

Most San Antonio contractors need Level 2, which requires full implementation of NIST SP 800-171. This standard covers 14 security domains.

1. Access Control (22 requirements)

Control who can access your systems and data. Key requirements include limiting access to authorized users only, controlling what users can access (least privilege), separating duties to prevent conflicts of interest, requiring strong authentication (MFA), and restricting remote access through managed access control points.

San Antonio Implementation: We help contractors implement Azure AD/Entra ID with conditional access policies, providing secure remote access for employees working from home or at customer sites around San Antonio and beyond.

2. Awareness and Training (3 requirements)

Ensure your team understands security responsibilities. Key requirements include security awareness training for all users, role-based training for privileged users, and insider threat awareness.

San Antonio Solution: We provide customized security training that addresses threats specific to defense contractors, including physical security considerations for San Antonio facilities.

3. Audit and Accountability (9 requirements)

Track and review system activity. Key requirements include logging security-relevant events, protecting audit logs from tampering, reviewing logs regularly, and retaining logs for required periods.

Implementation: Microsoft Sentinel or similar SIEM solutions provide centralized logging and automated alerting for suspicious activity.

4. Configuration Management (9 requirements)

Maintain secure system configurations. Key requirements include baseline configurations for workstations and servers, controlling changes to systems, tracking all assets, and restricting software installation.

San Antonio Approach: We use Intune/Microsoft Endpoint Manager to enforce security configurations across your devices, whether they're in your San Antonio office or traveling with employees.

5. Identification and Authentication (11 requirements)

Verify user identities. Key requirements include unique user identification, multi-factor authentication (MFA), strong password requirements, and managing authenticators (tokens, certificates).

Critical for Contractors: MFA is non-negotiable. We implement hardware tokens or mobile authenticator apps for secure access.

6. Incident Response (4 requirements)

Prepare for and respond to security incidents. Key requirements include an incident response plan, tracking and documenting incidents, testing response procedures, and reporting incidents to DoD (within 72 hours for CUI breaches).

San Antonio Support: We provide 24/7 incident response support and help you meet DoD reporting requirements through the DoD Cyber Crime Center.

7. Maintenance (6 requirements)

Maintain systems securely. Key requirements include performing timely maintenance, controlling maintenance tools and activities, approving and monitoring remote maintenance, and sanitizing equipment before disposal.

Implementation: Automated patch management through Microsoft Update for Business or similar solutions keeps systems current.

8. Media Protection (9 requirements)

Protect CUI on all media types. Key requirements include limiting access to CUI, sanitizing or destroying media before disposal, protecting media during transport, and controlling removable media.

San Antonio Services: We provide secure data destruction services and help implement BitLocker encryption on all devices handling CUI.

9. Personnel Security (2 requirements)

Screen personnel with access to CUI. Key requirements include screening individuals before granting access and ensuring CUI access is properly terminated.

Contractor Note: This typically means background checks appropriate to the level of access. We help document these processes.

10. Physical Protection (6 requirements)

Protect facilities and equipment. Key requirements include limiting physical access to systems, protecting against environmental hazards, controlling physical access devices (badges, keys), escorting visitors, and monitoring physical access.

San Antonio Facilities: Many of our clients in San Antonio use access control systems integrated with their IT security monitoring.

11. Risk Assessment (3 requirements)

Identify and manage security risks. Key requirements include conducting periodic risk assessments, scanning for vulnerabilities, and remediating identified vulnerabilities.

Our Approach: Quarterly vulnerability scans and annual risk assessments keep you ahead of threats and demonstrate due diligence.

12. Security Assessment (3 requirements)

Verify security controls work. Key requirements include assessing security controls periodically, creating plans of action for deficiencies, and monitoring remediation progress.

Implementation: We provide ongoing security assessments and help prioritize remediation based on risk.

13. System and Communications Protection (17 requirements)

Protect data in transit and at rest. Key requirements include monitoring and controlling network communications, encrypting CUI at rest and in transit, implementing network segmentation, denying network traffic by default (whitelist approach), and protecting wireless networks.

San Antonio Infrastructure: We design secure networks with proper segmentation, keeping CUI separate from general business systems.

14. System and Information Integrity (10 requirements)

Identify and correct security flaws. Key requirements include identifying and reporting flaws promptly, providing protection from malicious code, updating malware protection mechanisms, and performing network and system monitoring.

Our Solution: Microsoft Defender for Business or enterprise-grade EDR provides real-time threat protection and monitoring.

Understanding the certification process helps you prepare effectively.

1. Determine Your Required Level

Check your contracts or ask your contracting officer. Most San Antonio contractors need Level 2.

2. Conduct a Gap Assessment

Compare your current security posture to CMMC requirements. What controls do you have in place? What's missing or incomplete? What needs improvement?

We Help With: Comprehensive gap assessments that provide a clear roadmap to compliance.

3. Remediate Gaps

Implement missing controls.

Timeline: Most San Antonio contractors need 3-6 months to remediate gaps, depending on starting point.

4. Prepare Your System Security Plan (SSP)

Document your security environment.

We Create: Complete SSP documentation that satisfies assessor requirements.

5. Conduct Self-Assessment (Annual)

For Level 2, you must assess all 110 practices annually, submit self-assessment to DoD SPRS, and maintain assessment documentation.

6. Third-Party Assessment (Every 3 Years)

Certified Third-Party Assessor Organizations (C3PAOs) conduct formal assessments.

Assessment Cost: Typically $15,000-$50,000+ depending on scope and complexity.

Challenge 1: Budget Constraints

CMMC compliance requires investment in technology and processes.

Typical Investment: $20,000-$100,000 depending on company size and starting point, plus ongoing operational costs.

Challenge 2: Limited IT Resources

Many San Antonio contractors lack dedicated IT security staff.

Solution: Managed security services provide expertise without full-time hiring. We serve as your virtual CISO and security team.

Challenge 3: Scope Definition

Determining what systems must be compliant can be complex.

Key Concept: CUI Environment Only systems that process, store, or transmit CUI must be compliant. Properly scoping your environment can significantly reduce cost and complexity.

We Help With: Defining compliant system boundaries and implementing network segmentation to minimize scope.

Challenge 4: Subcontractor Requirements

Prime contractors must ensure their subcontractors are compliant too.

If You're a Subcontractor: Your prime contractor may require proof of compliance before awarding subcontracts.

If You're a Prime: You're responsible for flowing down CMMC requirements to subcontractors.

Challenge 5: Maintaining Compliance

CMMC isn't one-and-done. You must maintain compliance continuously.

San Antonio Expertise

We understand the local defense contractor community. We know the unique requirements of contractors supporting Joint Base San Antonio facilities, provide local support with rapid response times, and stay active in San Antonio defense and cybersecurity communities. We support contractors throughout South Texas.

Comprehensive CMMC Services

Proven Methodology

Our CMMC compliance approach: understand your business, assess current state, plan remediation, implement controls, prepare for assessment, support assessment, and maintain compliance.

Technology Partnerships

We leverage best-in-class solutions.

Step 1: Determine Your Level

Review your DoD contracts or talk to your contracting officer to understand which CMMC level you need.

Step 2: Request a Gap Assessment

Contact us for a free consultation. We'll discuss your situation and provide a quote for a gap assessment.

Step 3: Build Your Roadmap

We'll assess your current state, identify gaps, and create a prioritized remediation plan with timeline and budget.

Step 4: Implement Controls

We'll work with you to implement required security controls, document your environment, and prepare for assessment.

Step 5: Achieve Certification

We'll help you prepare for and coordinate your C3PAO assessment, then support ongoing compliance.

Q: When will CMMC be required in contracts? A: Phase 1 took effect November 10, 2025, and Level 1 and Level 2 self-assessment requirements appear in solicitations today. Phase 2, which would have required third-party assessment, was suspended on July 13, 2026 pending a reform review.

Q: Can I self-certify for Level 2? A: Today, yes. Annual self-assessments and affirmations in SPRS are required. The C3PAO assessment that Phase 2 would have added every three years is suspended as of July 13, 2026, though it may return in modified form after the reform review.

Q: What if I'm a small subcontractor? A: You still need to comply if you handle CUI. Your prime contractor will likely require proof of compliance.

Q: How long does certification take? A: From starting remediation to certification typically takes 6-12 months, depending on your starting point.

Q: What does CMMC compliance cost? A: Initial implementation typically costs $20,000-$100,000, plus ongoing operational costs. The C3PAO assessment itself is $15,000-$50,000+.

Q: What happens if I lose my certification? A: You may lose eligibility for DoD contracts until you regain compliance.

Q: Can cloud services help with CMMC? A: Yes. Azure Government and Microsoft 365 GCC High are designed for DoD contractors and can simplify compliance.

Don't wait until CMMC is required in your next contract. Start preparing now.

We're here to help San Antonio defense contractors succeed with CMMC compliance.

Call us or schedule a consultation through our website.

Your mission is protecting our nation. Our mission is protecting your business.