top of page
Defense Industrial Base (DIB)
The Defense Industrial Base (DIB) is the target of increasingly frequent and complex cyberattacks by adversaries and non-state actors.
Dynamically enhancing DIB cybersecurity to meet these evolving threats, and safeguarding the information that supports and enables our warfighters, is a top priority for the Department.
To safeguard sensitive national security information, the Department of Defense (DoD) launched CMMC 2.0, a comprehensive cybersecurity maturity framework. This special publication provides the framework for assessing cybersecurity systems. and can guide you through the certification process.
AXIOTROP is a Registered Provider Organization (RPO) with the Cyber AB, which certifies our organizational knowledge of NIST SP 800-171.
Our Proven CMMC Process
DIB Related Blog Posts
What Vendor Agnostic Means for CMMC Advising and Assessment
Being vendor agnostic allows a C3PAO (Certified Third-Party Assessment Organization) or RPO (Registered Provider Organization) to prioritize regulatory integrity and the specific needs of the contractor over the sales of particular products. As an advisor, a vendor’s agnostic approach means that your RPO will select the technology solutions for each project through a vendor-agnostic analysis. Vendor agnosticism allows for immense flexibility. The choice of Microsoft GCC High
clairekelley0
Jun 16
The Jump to Level 2 & Transitioning from 15 to 110 Controls
Transitioning from CMMC Level 1 to Level 2 is a monumental shift that requires moving from 15 basic safeguarding requirements to 110 rigorous security controls. While Level 1 focuses on protecting Federal Contract Information (FCI), Level 2 is specifically designed to safeguard Controlled Unclassified Information (CUI), which requires a much higher level of protection. Level 2 is cumulative, meaning you cannot achieve certification without also demonstrating mastery of all
clairekelley0
Jun 9
Why Waiting to Book Your C3PAO Assessment is a High-Stakes Gamble
Data from the Cyber AB town halls reveals a massive acceleration in the certification ecosystem as contractors race to solidify their standing before the November 10th deadline this year. A new report from ISI found that just 18% of defense contractors demonstrated readiness across all foundational CMMC areas. As more organizations achieve Level 2 (L2) status, companies that secured early certification will continue to be eligible for Department of War (DoW) contracts and s
clairekelley0
May 12
9 Critical Factors for Choosing the Right C3PAO for CMMC Level 2 Certification
CMMC is moving rapidly forward as it has already started appearing in Q1 DIB contracts. With authorized C3PAO slots filling months in advance, choosing the right assessor is now an important business priority. Here are some thoughts to consider when selecting a C3PAO. Verify Cyber AB Marketplace authorization Your C3PAO must be listed as an authorized, active organization in the Cyber AB Marketplace. This is the single most important verification step because an unauthorized
clairekelley0
Apr 27
Determining your CMMC Level
As we move through 2026, the DoW has already begun to include C3PAO Level 2 assessment clauses in solicitations. If your organization is part of the Defense Industrial Base (DIB), understanding your required CMMC level is the most important first step toward compliance. There are three levels of compliance that are meant to protect distinct levels of sensitive information. DoW CMMC Levels Graphic Level 1: Level 1 is designed to protect Federal Contract Information (FCI); i
clairekelley0
Apr 16
CMMC Cybersecurity Documentation Guide
Complying with CMMC requirements means strong documentation. Some companies choose to put all their documentation in a single System Security Plan (SSP) to reduce the number of controlled documents. However, we recommend a layered documentation approach to segment the security plan and to ensure the needed information gets to the right people. This documentation approach is built upon four layers: a high-level narrative of the security strategy, security policies, detailed co
clairekelley0
Mar 31
CMMC Compliance Imperatives from the CMMC Northeast Summit
The CMMC Northeast Summit, hosted at Rhode Island College’s Institute for Cybersecurity and Emerging Technologies with AXIOTROP, their partner sponsor. This event was specifically designed to support Organizations Seeking Assessment (OSAs) by bridging the gap between dense Department of War (DoW) policy and the boots-on-the-ground CMMC execution. Joe Devine, President of AXIOTROP, & Senator Jim Langevin, Former United States Representative, giving opening remarks. Photo by
clairekelley0
Mar 18
Phase 1 is Here: CMMC Compliance is Now a Mandatory Checkpoint
The Department of War (DoW) has finalized the acquisition rule in Title 48 of the Code of Federal Regulations (CFR), cementing CMMC as an immediate contract requirement. This swift regulatory action, demonstrated by the Office of Information and Regulatory Affairs (OIRA) clearing the rule in just 34 days, underscores the government’s urgency regarding cybersecurity in the defense supply chain. For organizations seeking to protect sensitive data, the timeframe is extremely ti
clairekelley0
Nov 6, 2025
How CMMC Level 2 Certification Strengthens Your Place as a Trusted Partner
For companies in the Defense Industrial Base (DIB), achieving CMMC Level 2 certification is more than a compliance milestone. Now more...
clairekelley0
Aug 22, 2025
The CMMC Countdown is Over: What Every DoD Contractor Needs to Know NOW
As CMMC Assessors, we have been closely watching the Cybersecurity Maturity Model Certification (CMMC) journey, offering guidance, dispelling myths, and preparing the defense industrial base for the inevitable. Today, we bring you news of monumental significance that confirms what we have stressed for years: CMMC is no longer a distant threat; it is an immediate reality for your DoD contracts. The big reveal, the one we have all been anticipating, happened on July 22nd, 2025
clairekelley0
Jul 29, 2025
CMMC Budgeting 101: What Every Defense Contractor Should Know
As cybersecurity becomes more important for businesses handling defense contracts, understanding the Cybersecurity Maturity Model...
clairekelley0
Jan 7, 2025
CMMC – a long time in the making…
The journey to secure our nation’s military secrets, specifically controlled unclassified information (CUI) has been anything but swift.
clairekelley0
Dec 10, 2024
Boosting Your SPRS Score: Key Steps to Strengthen Cybersecurity Compliance and Win Contracts
In the last blog we walked through the process of posting your SPRS score. But before you can post it you need to accurately determine...
clairekelley0
Nov 5, 2024
Understanding DOD CMMC Level 2 vs. Level 1
If your company works with the Department of Defense (DoD), you’ve probably heard of the Cybersecurity Maturity Model Certification...
clairekelley0
Oct 22, 2024
DIB Rulemaking Update (Q4)
The CMMC 2.0 Final Rule is moving toward final publication. Today, October 15, 2024, Title 32 Part 170 was published by the Department of...
Joe Devine
Oct 15, 2024
Understanding the CMMC Rules: What’s the Difference Between Title 32 and Title 48?
During the CMMC rulemaking process, the DoD has been crafting two separate but co-dependent Code of Federal Regulations (CFR) titles....
clairekelley0
Oct 8, 2024
DIB Rulemaking Update (Q2)
The wheels of government may turn slowly, but they are turning and in the last few months we have a lot of movement to report concerning...
Joe Devine
May 15, 2024
Breaches Increase Despite Greater Cybersecurity Spending - Why?
Breaches increased almost 80% from 2022 while in 2023, global cybersecurity spending reached almost $200 billion. Business leaders are...
Joe Devine
Apr 2, 2024
Public Comment Period Ending soon for CMMC 2.0
The Department of Defense (DoD) published the CMMC 2.0 Proposed Rule on December 26th. This kicked off a 60 day “public commenting...
Joe Devine
Feb 20, 2024
What is a Cybersecurity Assessment and Why Should You Get One?
Cybersecurity risk assessments assist organizations in understanding the cyber risks to their operations (e.g., mission, functions,...
Joe Devine
Nov 7, 2023
Implications of the National Cybersecurity Strategy for SMB’s
With deepening dependencies on digital technologies by industry and public sector entities and increasing software-systems complexity,...
Joe Devine
Apr 6, 2023
Why it’s Time to Complete an Independent Cybersecurity Assessment
Cybersecurity attacks are increasing but the threat landscape in shifting. According to a World Economic Forum February 2023 article,...
Joe Devine
Mar 21, 2023
CMMC 2.0 Is on Its Way - Here's What You Need to Know
We get lots of questions about when CMMC 2.0 will be complete. The Department of Defense (DOD) has been in rulemaking for over a year,...
Joe Devine
Dec 22, 2022
AXIOTROP Attains CMMC Certification for Second Year
AXIOTROP is re-certified by The Cyber AB for 2023 as a Registered Practitioner Organization (RPO) as it relates to CMMC implementation....
Joe Devine
Dec 9, 2022
Strengthening your Cybersecurity Shouldn’t be a Cash Drain
The threat of a breach is forever present and increasing, as we all know from daily media reports. This isn’t surprising; we live in a...
Joe Devine
Dec 6, 2022
What is NIST? Why use the NIST Cyber Security Framework?
A Short History Many people haven’t heard of NIST. The National Institute of Standards and Technology (NIST) was founded in 1901 and is...
Joe Devine
Nov 8, 2022
Strengthening Cybersecurity for Competitive Advantage
Breaches are increasing for companies of all sizes and industries since the number and sophistication of hackers has increased. Indeed,...
Joe Devine
Nov 1, 2022
Why AXIOTROP?
People often ask me why I created AXIOTROP. As the saying goes, good things come in threes – as do my reasons for starting this company:...
Joe Devine
Oct 25, 2022
DIB Client Testimonials
Greg Ferrian President
Varioprint Inc.
"A year ago, as an aspiring contractor to the defense industrial base we weren’t sure how to get started with CMMC. We turned to Axiotrop for help, and they have been a great partner every step of the way. Together, we started from the ground up and Axiotrop worked with us in phases to meet our timing and budget requirements. We started with a plan to meet our prime contractor expectations (all five-point practices met) and have been improving our SPRS score consistently over time. We are on pace for our C3PAO assessment in Q4 of this year."
bottom of page