CMMC Level 2 Gap Assessment Grant

The CMMC Level 2 Gap Assessment Grant provides an in-kind gap assessment for defense contractors preparing for CMMC Level 2 certification. Eligible organizations must be active in the Defense Industrial Base (DIB), handle Controlled Unclassified Information (CUI), and have fewer than 500 employees. The assessment identifies compliance gaps against NIST SP 800-171 and ranks them by severity. Only need a Level 1 assessment? See the CMMC Level 1 Gap Assessment Grant.

This grant is designed for established organizations that require professional cybersecurity assessments to maintain compliance and protect their business operations. Recipients will receive an in-kind comprehensive CMMC Level 2 gap assessment service that includes a full evaluation of all 110 NIST SP 800-171 controls, gap identification, and a prioritized list of compliance gaps by severity.

Disclosure: This grant is provided in-kind through a partnership between Cyber Grants Alliance and Capital Cyber Compliance. Grant recipients may be contacted by the sponsoring organization.

• Included in This Grant

  • Full evaluation of all 110 NIST SP 800-171 controls
  • Technical infrastructure review
  • Policy and procedure assessment
  • Operational practices evaluation
  • Gap identification across all 14 control families
  • Prioritized list of compliance gaps by severity
  • Clear picture of your current compliance posture

• Not Included

  • Detailed written assessment report
  • C3PAO readiness preparation
  • Remediation roadmap
  • Plan of Action and Milestones (POA&M)
  • These services are available as add-ons through Capital Cyber Compliance after your initial gap assessment is complete.

1. Apply Online

   Complete the grant application form. We review eligibility based on your business size, industry, and compliance needs.

2. Grant Approval

   Once approved, you are connected with an independent certified assessor who will coordinate the assessment timeline with your team.

3. Full Assessment

   Your organization is evaluated against all 110 NIST SP 800-171 controls covering infrastructure, policies, and practices.

4. Results & Next Steps

   Receive your gap identification with prioritized findings. You will know exactly where you stand and what to focus on next.

• Is CMMC Phase 2 still happening?

  On July 13, 2026, DoD paused the CMMC rollout and suspended Phase 2, pending a 60 day review by its CIO. During the review, contracts may call for CMMC Level 1 or Level 2 self-assessments, not third-party (C3PAO) certification assessments.

• What still applies to my company today?

  DFARS 252.204-7012 remains in effect, and NIST SP 800-171 Rev 2 is still the baseline. Level 2 self-assessments, posting your score in SPRS, and the annual affirmation by a senior official all still stand.

• What does CMMC Level 2 cover?

  Level 2 is built on NIST SP 800-171 Rev 2: 110 security requirements across 14 control families that protect Controlled Unclassified Information (CUI). A requirement is met only when every one of its assessment objectives in NIST SP 800-171A is met.

• Why start with a gap assessment?

  Your SPRS score and the affirmation your executive signs must match what is actually in place, and a false affirmation carries False Claims Act risk. A gap assessment shows where you stand against all 110 requirements before anyone signs.

• What does this grant include?

  It includes a full evaluation of all 110 NIST SP 800-171 controls, gap identification across all 14 control families, and a prioritized list of compliance gaps by severity. The written report, C3PAO readiness preparation, remediation roadmap and POA&M are not included; remediation help is available separately from Capital Cyber Compliance.

• What other help is there?

  Cyber Grants Alliance runs other cybersecurity grant programs, including the GSA Gap Assessment Grant, the Penetration Testing Grant and the Cybersecurity Training Grant. For programs run by states and manufacturing extension centers, see the list of state CMMC grant programs.

  Ready to start? Apply for the CMMC Level 2 Gap Assessment Grant above.