top of page
Ready for Assessment?
As an authorized C3PAO, AXIOTROP delivers official CMMC assessments to help Defense Industrial Base (DIB) contractors meet DoW cybersecurity requirements.
Our experts have a vast knowledge of NIST SP 800-171 and NIST SP 800-53, providing clear guidance for compliance and certification readiness.
To get started, complete the following form for more information and next steps. We look forward to hearing from you!
C3PAO Capabilities
AXIOTROP is proud to be among the first 80 companies designated as a C3PAO.
Uniquely positioned as both a consulting firm and a C3PAO assessment provider, AXIOTROP offers end-to-end support for your compliance journey.
Not all C3PAOs have a full-time Lead Assessor on staff. AXIOTROP is one of the select few in this category.
With a team of 15 professionals, AXIOTROP is larger than many C3PAO assessors, giving us the capacity and expertise to support your compliance needs effectively.
Our nationwide assessment team allows AXIOTROP to deploy local resources and provide in-person assessment support.
"As Director of Cybersecurity Assessments at Axiotrop, my goal is to lead our team in delivering consistent, objective, and high-quality assessments grounded in transparency, collaboration, and evidence-based decision-making. Through effective leadership, accountability, and continuous improvement, I am committed to ensuring assessments align with applicable cybersecurity standards while upholding the integrity and credibility of every assessment. Ultimately, our mission is to build trust and confidence in the assessment process by helping our customers understand their cybersecurity posture and objectively evaluating the effectiveness of the safeguards in place to protect their sensitive information."
Adam Richards
Lead CCA | Director of Cybersecurity Assessments
AXIOTROP's CMMC Level 2 Journey
From cybersecurity consultancy to becoming a DoW-authorized C3PAO, our mission has always been clear: to safeguard the Defense Industrial Base.
With years of hands-on experience and a deep understanding of evolving compliance standards, we've helped organizations navigate complex security requirements — building trust, one customer at a time.
CMMC Blog Posts
CMMC Certification: In-House vs. Partnering with an External Provider
In-House vs. Partnering with an External Provider Achieving a CMMC Level 2 certification requires organizations to demonstrate that they meet the security requirements outlined in NIST SP 800-171. While implementing those required controls and safeguards often represents a significant investment in IT, cybersecurity, and organizational processes, every organization pursuing certification faces the same fundamental question: Should you manage the implementation internally, or
clairekelley0
Aug 12
CMMC Pause Explained: What Defense Contractors Should Know
We have used the past week and a half to sit back and watch the CMMC storm online. We have seen the champagne popping contingent that is sure that CMMC is dead, and the CMMC die-hards that don't expect any significant changes exchanging barbs on LinkedIn and other online venues. We expect the truth to be somewhere in the middle, and we want to share our thoughts on what this pause could mean. First, let's clear up some of the facts of the current situation. While the curren
clairekelley0
Jul 24
What the 2027 National Defense Authorization Act say about CMMC for Defense Contractors
The National Defense Authorization Act (NDAA) for Fiscal Year 2027 Title XVI, which is working its way through Congress, focuses on cybersecurity requirements and introduces a major shift in how the Department of War (DoW) supports the companies that make up our Defense Industrial Base (DIB). It's great to see Congress addressing the needs of the DIB as CMMC has begun appearing in contracts. For years, the DIB has been moving toward a standardized, verifiable security model t
clairekelley0
Jun 25
What Vendor Agnostic Means for CMMC Advising and Assessment
Being vendor agnostic allows a C3PAO (Certified Third-Party Assessment Organization) or RPO (Registered Provider Organization) to prioritize regulatory integrity and the specific needs of the contractor over the sales of particular products. As an advisor, a vendor’s agnostic approach means that your RPO will select the technology solutions for each project through a vendor-agnostic analysis. Vendor agnosticism allows for immense flexibility. The choice of Microsoft GCC High
clairekelley0
Jun 16
The Jump to Level 2 & Transitioning from 15 to 110 Controls
Transitioning from CMMC Level 1 to Level 2 is a monumental shift that requires moving from 15 basic safeguarding requirements to 110 rigorous security controls. While Level 1 focuses on protecting Federal Contract Information (FCI), Level 2 is specifically designed to safeguard Controlled Unclassified Information (CUI), which requires a much higher level of protection. Level 2 is cumulative, meaning you cannot achieve certification without also demonstrating mastery of all
clairekelley0
Jun 9
Why Waiting to Book Your C3PAO Assessment is a High-Stakes Gamble
Data from the Cyber AB town halls reveals a massive acceleration in the certification ecosystem as contractors race to solidify their standing before the November 10th deadline this year. A new report from ISI found that just 18% of defense contractors demonstrated readiness across all foundational CMMC areas. As more organizations achieve Level 2 (L2) status, companies that secured early certification will continue to be eligible for Department of War (DoW) contracts and s
clairekelley0
May 12
9 Critical Factors for Choosing the Right C3PAO for CMMC Level 2 Certification
CMMC is moving rapidly forward as it has already started appearing in Q1 DIB contracts. With authorized C3PAO slots filling months in advance, choosing the right assessor is now an important business priority. Here are some thoughts to consider when selecting a C3PAO. Verify Cyber AB Marketplace authorization Your C3PAO must be listed as an authorized, active organization in the Cyber AB Marketplace. This is the single most important verification step because an unauthorized
clairekelley0
Apr 27
Determining your CMMC Level
As we move through 2026, the DoW has already begun to include C3PAO Level 2 assessment clauses in solicitations. If your organization is part of the Defense Industrial Base (DIB), understanding your required CMMC level is the most important first step toward compliance. There are three levels of compliance that are meant to protect distinct levels of sensitive information. DoW CMMC Levels Graphic Level 1: Level 1 is designed to protect Federal Contract Information (FCI); i
clairekelley0
Apr 16
Scoped Enclave vs. Full Enterprise: How to Right-Size Your CMMC Compliance
Under Phase 1, CMMC compliance has become a condition of contract award. DIB contractors are now seeing CMMC requirements appear in new solicitations. Success in CMMC 2.0 is about right sizing your environment during the discovery and scoping phases before an assessor ever sets eyes on your CMMC implementation. To define an accurate assessment boundary, you must first track the flow of Controlled Unclassified Information (CUI) through your organization. Starting with how you
clairekelley0
Apr 7
CMMC Cybersecurity Documentation Guide
Complying with CMMC requirements means strong documentation. Some companies choose to put all their documentation in a single System Security Plan (SSP) to reduce the number of controlled documents. However, we recommend a layered documentation approach to segment the security plan and to ensure the needed information gets to the right people. This documentation approach is built upon four layers: a high-level narrative of the security strategy, security policies, detailed co
clairekelley0
Mar 31
CMMC Compliance Imperatives from the CMMC Northeast Summit
The CMMC Northeast Summit, hosted at Rhode Island College’s Institute for Cybersecurity and Emerging Technologies with AXIOTROP, their partner sponsor. This event was specifically designed to support Organizations Seeking Assessment (OSAs) by bridging the gap between dense Department of War (DoW) policy and the boots-on-the-ground CMMC execution. Joe Devine, President of AXIOTROP, & Senator Jim Langevin, Former United States Representative, giving opening remarks. Photo by
clairekelley0
Mar 18
Phase 1 is Here: CMMC Compliance is Now a Mandatory Checkpoint
The Department of War (DoW) has finalized the acquisition rule in Title 48 of the Code of Federal Regulations (CFR), cementing CMMC as an immediate contract requirement. This swift regulatory action, demonstrated by the Office of Information and Regulatory Affairs (OIRA) clearing the rule in just 34 days, underscores the government’s urgency regarding cybersecurity in the defense supply chain. For organizations seeking to protect sensitive data, the timeframe is extremely ti
clairekelley0
Nov 6, 2025
What is the POA&M Process for Final CMMC Certification?
If an Organization Seeking Certification (OSC) has met most, but not all, security requirements, it may be eligible for a Conditional Certificate of CMMC Status. This is possible if the unmet requirements are documented on an existing and valid POA&M that complies with the regulations in 32 CFR §170.21. However, if an OSC has unmet security requirements and a valid POA&M is not attainable, the C3PAO will recommend that no certificate be issued. The details of how POA&Ms work
clairekelley0
Sep 17, 2025
How CMMC Level 2 Certification Strengthens Your Place as a Trusted Partner
For companies in the Defense Industrial Base (DIB), achieving CMMC Level 2 certification is more than a compliance milestone. Now more than ever, it’s a powerful way to reinforce your brand identity as a secure, credible, and forward-thinking partner. Here’s how CMMC Level 2 certification elevates both compliance and credibility. 1. How C3PAO Assessments Build Trust and Confidence The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense’s (DoD) in
clairekelley0
Aug 22, 2025
Proactive CMMC Compliance for the DoD Supply Chain
A common misconception among many at the lower end of the Defense Industrial Base (DIB) supply chain is the assumption that the Cybersecurity Maturity Model Certification (CMMC) won't apply to them. Decades of successful government contracts, often without needing certifications, have fostered a sense of business as usual. But the landscape of cybersecurity for Department of Defense (DoD) contractors has fundamentally shifted, and proactive engagement with CMMC is now essenti
clairekelley0
Jul 31, 2025
The CMMC Countdown is Over: What Every DoD Contractor Needs to Know NOW
As CMMC Assessors, we have been closely watching the Cybersecurity Maturity Model Certification (CMMC) journey, offering guidance, dispelling myths, and preparing the defense industrial base for the inevitable. Today, we bring you news of monumental significance that confirms what we have stressed for years: CMMC is no longer a distant threat; it is an immediate reality for your DoD contracts. The big reveal, the one we have all been anticipating, happened on July 22nd, 2025
clairekelley0
Jul 29, 2025
Securing Business Success with System & Information Integrity Domain
In today’s fast-paced digital landscape, cyber threats evolve at an unprecedented rate. Ensuring the security and reliability of your organization’s data isn’t just an IT concern—it’s a fundamental business imperative. The System and Information Integrity (SI) domain of the CMMC serves as a critical safeguard against threats that can disrupt operations, compromise sensitive data, and erode stakeholder trust. Understanding this domain is key to sustaining business continuity a
clairekelley0
Apr 8, 2025
CMMC Is Taking Effect: What DoD Contractors Can Expect in 2025
Hosted by Virtru & Axiotrop Date: November 19, 2024 11 AM – 12 PM Moderator: Andrew Lynch, Virtru Panelists: Joe Devine, CEO, Axiotrop Webinar Recording Virtru
Nick Garvey
Mar 12, 2025
CMMC Budgeting 101: What Every Defense Contractor Should Know
As cybersecurity becomes more important for businesses handling defense contracts, understanding the Cybersecurity Maturity Model Certification (CMMC) is essential. Budgeting is often the biggest challenge in achieving CMMC compliance. This guide outlines areas you may need to invest in to achieve CMMC certification and ongoing maintenance. Start with a CMMC Assessment Certification begins with understanding your cybersecurity baseline. CMMC certification will cost you a si
clairekelley0
Jan 7, 2025
CMMC – a long time in the making…
The journey to secure our nation’s military secrets, specifically controlled unclassified information (CUI) has been anything but swift.
clairekelley0
Dec 10, 2024
Boosting Your SPRS Score: Key Steps to Strengthen Cybersecurity Compliance and Win Contracts
In the last blog we walked through the process of posting your SPRS score. But before you can post it you need to accurately determine...
clairekelley0
Nov 5, 2024
Understanding DOD CMMC Level 2 vs. Level 1
If your company works with the Department of Defense (DoD), you’ve probably heard of the Cybersecurity Maturity Model Certification (CMMC). It’s a system designed to help companies protect sensitive government information. But what’s the difference between CMMC Level 1 and Level 2? Let’s break it down. FCI vs. CUI: What Kind of Information Are We Talking About? The DoD has many security levels for their information, and CMMC Level 1 and Level 2 focus on protecting two of th
clairekelley0
Oct 22, 2024
DIB Rulemaking Update (Q4)
The CMMC 2.0 Final Rule is moving toward final publication. Today, October 15, 2024, Title 32 Part 170 was published by the Department of...
Joe Devine
Oct 15, 2024
Understanding the CMMC Rules: What’s the Difference Between Title 32 and Title 48?
During the CMMC rulemaking process, the DoD has been crafting two separate but co-dependent Code of Federal Regulations (CFR) titles....
clairekelley0
Oct 8, 2024
DIB Rulemaking Update (Q2)
The wheels of government may turn slowly, but they are turning and in the last few months we have a lot of movement to report concerning DIB primes and subcontractors. First, last week the Department of Defense cleared up some potential confusion with the class deviation to DFARS 252.204-7012. This DFAR was updated to specifically require DIB contractors to meet “revision 2” of NIST SP 800-171. The previous DFAR wording stated that contractors must meet the version "in effe
Joe Devine
May 15, 2024
Breaches Increase Despite Greater Cybersecurity Spending - Why?
Breaches increased almost 80% from 2022 while in 2023, global cybersecurity spending reached almost $200 billion. Business leaders are...
Joe Devine
Apr 2, 2024
Public Comment Period Ending soon for CMMC 2.0
The Department of Defense (DoD) published the CMMC 2.0 Proposed Rule on December 26th. This kicked off a 60 day “public commenting...
Joe Devine
Feb 20, 2024
What is a Cybersecurity Assessment and Why Should You Get One?
Cybersecurity risk assessments assist organizations in understanding the cyber risks to their operations (e.g., mission, functions,...
Joe Devine
Nov 7, 2023
Implications of the National Cybersecurity Strategy for SMB’s
With deepening dependencies on digital technologies by industry and public sector entities and increasing software-systems complexity,...
Joe Devine
Apr 6, 2023
Why it’s Time to Complete an Independent Cybersecurity Assessment
Cybersecurity attacks are increasing but the threat landscape in shifting. According to a World Economic Forum February 2023 article,...
Joe Devine
Mar 21, 2023
CMMC 2.0 Is on Its Way - Here's What You Need to Know
We get lots of questions about when CMMC 2.0 will be complete. The Department of Defense (DOD) has been in rulemaking for over a year,...
Joe Devine
Dec 22, 2022
AXIOTROP Attains CMMC Certification for Second Year
AXIOTROP is re-certified by The Cyber AB for 2023 as a Registered Practitioner Organization (RPO) as it relates to CMMC implementation....
Joe Devine
Dec 9, 2022
Strengthening your Cybersecurity Shouldn’t be a Cash Drain
The threat of a breach is forever present and increasing, as we all know from daily media reports. This isn’t surprising; we live in a...
Joe Devine
Dec 6, 2022
What is NIST? Why use the NIST Cyber Security Framework?
A Short History Many people haven’t heard of NIST. The National Institute of Standards and Technology (NIST) was founded in 1901 and is...
Joe Devine
Nov 8, 2022
Strengthening Cybersecurity for Competitive Advantage
Breaches are increasing for companies of all sizes and industries since the number and sophistication of hackers has increased. Indeed,...
Joe Devine
Nov 1, 2022
Why AXIOTROP?
People often ask me why I created AXIOTROP. As the saying goes, good things come in threes – as do my reasons for starting this company:...
Joe Devine
Oct 25, 2022
bottom of page