What is a CMMC assessment?

A CMMC assessment evaluates whether your organization meets the cybersecurity practices and processes required by the Department of Defense to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

What are the CMMC levels?

CMMC has three levels: Level 1 (Foundational) with 17 practices for FCI via annual self-assessment, Level 2 (Advanced) with 110 NIST 800-171 controls for CUI (most contracts require a C3PAO assessment, though some may allow self-assessment per the DFARS clause), and Level 3 (Expert) with additional NIST 800-172 controls assessed by DIBCAC for the most sensitive programs.

How long does CMMC certification take?

Traditional CMMC preparation takes 16-30+ weeks. With Hatty AI, organizations can accelerate this to 6-14 weeks through automated gap analysis, documentation generation, and real-time readiness scoring.

Who needs CMMC certification?

All defense contractors and subcontractors in the Defense Industrial Base (DIB) who handle FCI or CUI must achieve CMMC certification to bid on and maintain DoD contracts.

What is included in a CMMC assessment report?

A comprehensive CMMC assessment report includes a compliance score, gap analysis across all 14 NIST 800-171 domains, risk ratings, a prioritized remediation roadmap, and generated documentation including SSP and POA&M templates.

Hatty AI — CMMC Compliance Platform

AI-powered CMMC Level 2 compliance automation for defense contractors. Automated SSP, POA&M generation, gap analysis, and readiness scoring.

Contact: support@hatty.ai