By RODEO INFOSEC CORP · October 21, 2026 · ~6 min read
If you sell to the U.S. Department of Defense, or to a prime that does, the Cybersecurity Maturity Model Certification (CMMC) has turned security hygiene into a contractual gate. The hard part is rarely understanding what the controls say. It is proving, continuously and on demand, that each one is actually in place across a live environment. That is where most compliance programs quietly fall apart.
This note walks through what CMMC 2.0 requires, why a dashboard is not the same as compliance, and what it takes to keep control-level evidence current without a quarterly fire drill.
What CMMC 2.0 actually requires
CMMC 2.0 is the DoD’s mechanism for verifying that contractors protect two kinds of government data: Federal Contract Information (FCI) and the more sensitive Controlled Unclassified Information (CUI). It defines three levels:
- Level 1 (Foundational) — 17 basic practices drawn from FAR 52.204-21, covering FCI, with an annual self-assessment.
- Level 2 (Advanced) — the full set of 110 security requirements from NIST SP 800-171, covering CUI. Depending on the sensitivity of the information, this is either a self-assessment or a third-party assessment by a C3PAO, renewed on a three-year cycle with annual affirmations.
- Level 3 (Expert) — 800-171 plus a subset of the enhanced requirements in NIST SP 800-172, assessed by the government.
For most of the defense industrial base, the center of gravity is Level 2 and its 110 NIST 800-171 controls. That is the set you self-score, post to the Supplier Performance Risk System (SPRS), and must be ready to defend under assessment.
Why a dashboard is not compliance
Plenty of tools will render a tidy grid of green checkmarks. The problem is what sits behind each check. A dashboard typically records an assertion: someone, at some point, declared a control satisfied. It rarely carries the artifact that proves the control was in effect at a specific moment, across the specific systems in scope, and it almost never notices when that state drifts a week later.
Assessors do not score assertions. They ask for evidence: configurations, logs, access records, the actual output of the control doing its job. When your “compliant” status is a spreadsheet of good intentions, assessment season becomes a scramble to reconstruct proof after the fact — and any gap you find then is a gap that has been open the whole time.
Control-level mapping, explained
The alternative is to treat each control as a live question tied to real telemetry, not a checkbox. “Are all privileged actions logged and reviewed?” is answerable from your event stream. “Is multifactor enforced for remote access?” is answerable from identity data. Control-level mapping means every requirement — 800-171 3.1.1, 3.3.1, and so on — is wired to the signals that demonstrate it, so status is derived from the environment rather than typed into a form.
Done once, that mapping pays off twice. NIST 800-171 shares a large amount of its DNA with NIST 800-53, ISO 27001, and SOC 2. A single, well-structured control model lets one piece of collected evidence satisfy the equivalent requirement in several frameworks at the same time, instead of running a separate audit project for each. This is the idea behind R-O-D-E-O’s cross-framework control mapping.
Continuous evidence and your SPRS score
SPRS scoring is unforgiving by design. You start at 110 and subtract weighted points for each unmet 800-171 requirement; some gaps cost one point, others three or five, and a low score can fall well into the negative. Because the score is self-reported and then tested under assessment, the gap between “what we posted” and “what we can prove today” is exactly the risk you want to eliminate.
Continuous evidence collection closes that gap. When each control is monitored rather than attested once a year, your posture is always current: you can see a requirement slip the moment it slips, remediate it, and keep a time-stamped record that it was addressed. A Plan of Action and Milestones (POA&M) stops being a list of unknowns and becomes a short, tracked queue. The point is not a prettier number — it is a number you can stand behind in the room.
What to look for in compliance tooling
- Evidence, not assertions. Can it attach the actual artifact — config, log, record — to each control, automatically?
- Control-level granularity. Does it map to individual 800-171 requirements, or only to high-level “domains”?
- Cross-framework reuse. Will one control model serve 800-53, 800-171, ISO 27001, and SOC 2, or is each a separate effort?
- Continuous, not point-in-time. Does status reflect the environment now, with drift detection, or a snapshot from the last review?
- Works where your CUI lives. Many defense environments are air-gapped or heavily restricted. Can the tool operate on-premises, without calling the internet to function?
- Audit-ready output. Can it produce the logs and mappings an assessor expects, down to the control, without a manual export marathon?
How R-O-D-E-O approaches it
RODEO is built around control-level mapping rather than a status board. Its governance layer ties findings and actions to specific controls across ten frameworks — including NIST 800-53, NIST 800-171, CMMC 2.0, ISO 27001, and SOC 2 — and every high-impact action is human-gated and logged, so the evidence trail is a by-product of operating the platform, not a separate reporting task. A provisional SPRS scorer turns that mapping into a number you can track over time.
Because many of the environments this matters most in cannot reach the internet, the platform is designed to run on-premises and air-gapped, and ships in editions sized to the mission — from a defensive-only Blue/SOC build to the full offense-and-defense platform. If you want the deeper architecture, the R-O-D-E-O whitepaper covers how the control model and evidence pipeline fit together.
Compliance is not the goal in itself; a defensible, always-current security posture is, and the paperwork should fall out of it. The shift that gets you there is simple to state and hard to fake: stop declaring controls satisfied, and start proving it, continuously.