ARC is CMMC Level 2 (C3PAO) certified. Here's what that means for your program.

The difference is who assesses compliance. Both paths require the same 110 requirements, but a Level 2 self-assessment means the contractor evaluated its own compliance and reported the results. A Level 2 C3PAO assessment means an external, Cyber-AB authorized Third-Party Assessment Organization examined the documentation, interviewed personnel, reviewed the controls, and issued a formal certificate. Self-assessments carry the risk that gaps may be missed or requirements misread, which is exactly why the DoD created the third-party assessment path. Contracts involving sensitive CUI increasingly require the C3PAO assessment specifically, and a self-assessment cannot substitute for it. ARC holds the Level 2 C3PAO assessment certificate.

CMMC (Cybersecurity Maturing Model Certification) is a DoD framework designed to protect Controlled Unclassified Information (CUI) across the entire defense supply chain. In the past, contractors could self-certify their cybersecurity compliance. The DoD found that approach wasn’t producing consistent results. CMMC was introduced to replace self-assessment with eventual third party verified standards. It covers 110 requirements spanning IT systems, organizational processes, training, documentation, supplier management, and facility security.

No. CMMC flows down the entire supply chain. Wherever CUI goes, the requirement follows, with no variances for subcontractors. If your program involves CUI at any level, every vendor handling that data needs to meet the standard.

For programs involving CUI, a supplier without certification is a compliance risk, and increasingly, not an option. The DoD is rolling CMMC out across all contracts, and defense primes are already surveying their supply chains to identify gaps. An uncertified supplier can hold up a program, create flowdown liability for the prime, or simply be disqualified from bidding.

ARC’s certification covers all 110 NIST 800-171 Rev. 2 requirements across the entire organization, verified by a third-party assessment organization. Because ARC handles CUI across engineering, project management, and production, the certification was implemented company wide. This includes documentation practices, training programs, supplier management protocols, and facility security.

When a prime flows CMMC requirements down their supply chain, ARC is already certified and audit-read. That means one less compliance gap to manage, no waiting on a supplier to get up to speed, and confidence that CUI is being handled to DoD standards throughout the program. ARC actively manages CMMC compliance verification across its own supply chain as well.