CMMC 2.0 Checklist for DMV Defense Contractors

With CMMC 2.0 moving toward finalization, federal subcontractors in the DC metro area face strict new hurdles. We provide a simplified roadmap to ensure your network meets the 110 NIST 800-171 controls.

For small to mid-sized defense contractors in the National Capital Region, the grace period for cybersecurity “guesswork” is officially over. With the Department of Defense (DoD) finalizing the Cybersecurity Maturity Model Certification (CMMC) 2.0, your ability to win or renew contracts now depends on a validated security posture.

At Goldman CyberOps, we specialize in the Adversarial Engineering required to move beyond simple compliance and into actual defense. Below is our technical checklist for the 110 controls found in CMMC Level 2 (Advanced).

1. Access Control (AC)

 

• • Limit System Access: Ensure only authorized users and processes can access your internal systems.

• • Remote Access Encryption: All remote sessions must be encrypted and utilize Multi-Factor Authentication (MFA).

• • Control Internal Flow: Use “least privilege” principles so users can only access the data required for their specific role.

2. Identification and Authentication (IA)

 

• • MFA Implementation: Multi-factor authentication is mandatory for all local and network access to privileged accounts.

• • Password Complexity: Enforce strict password policies and regular rotation intervals.

3. Incident Response (IR)

 

• • Establish a Plan: You must have a documented capability to detect, report, and respond to security incidents.

• • Testing & Validation: An incident response plan is useless if it has never been tested. We recommend quarterly “Tabletop Exercises” to simulate a breach response.

4. Physical Protection (PE)

 

• • Limit Physical Access: Secure your server rooms and hardware behind physical locks and surveillance.

• • Visitor Logs: Maintain a physical audit trail of everyone entering and exiting your facility.

5. System and Information Integrity (SI)

 

• • Flaw Remediation: Identify, report, and correct system flaws (patches) in a timely manner.

• Malicious Code Protection: Update antivirus and anti-malware signatures daily across all endpoints.

---

The Bottom Line: Compliance ≠ Security

CMMC 2.0 is a set of rules, but a hacker doesn’t care about your rulebook. While this checklist helps you meet the DoD requirements, our Field Assessments are designed to see if those controls actually work when put under stress.

Don’t leave your next contract to chance..