CMMC 2.0 (Cybersecurity Maturity Model Certification) is the US Department of Defense's contractor cybersecurity certification programme. As of late 2025, primes and subs handling Federal Contract Information or Controlled Unclassified Information have to demonstrate CMMC 2.0 Level 1 (self-assessment) or Level 2 (third-party assessment by a C3PAO) to retain DoD contracts.
For Canadian MSPs, the Canadian Program for Cyber Security Certification (CPCSC) is the parallel programme aligned to CMMC 2.0 — same NIST SP 800-171 control set, same evidence expectations, same general structure.
For MSPs serving DoD-contractor or Government-of-Canada-contractor clients, you have two roles: (1) ensure the client's 110 NIST SP 800-171 controls are implemented and evidenced; (2) prove that your own MSP environment, as the entity managing the client's data, also meets the relevant control set. Both roles require continuous evidence collection, a System Security Plan (SSP), and a Plan of Action and Milestones (POA&M).
What to look for
- NIST SP 800-171 control mapping. CMMC 2.0 Level 2 is built on the 110 controls of NIST SP 800-171. Look for direct, by-control mapping with continuous evidence collection — not generic "NIST-aligned" claims.
- CPCSC alignment. For Canadian MSPs, the same control set serves both CMMC 2.0 and CPCSC. Look for explicit CPCSC framework support so you don't double-pay for two GRC platforms.
- Multi-tenant for MSPs. You will deliver CMMC readiness as a service. The platform must let you onboard a tenant, push the standard CMMC 2.0 Level 1 or Level 2 control profile, and produce client-branded evidence — without rebuilding integrations per tenant.
- Endpoint and cloud evidence. Evidence has to come from the actual Windows, macOS, and Linux endpoints (configuration, patch state, logging) and from the M365 / Entra / Azure / Google Workspace tenants (identity, MFA, audit logs). Look for first-party agents and connectors, not aggregator-only platforms.
- SSP and POA&M generation. A C3PAO assessment expects a System Security Plan and a Plan of Action and Milestones that are coherent, current, and reflective of actual implementation. Look for platforms that generate these from the live evidence — not from a generic template.
- CUI handling discipline. Controlled Unclassified Information requires specific protections (FIPS-validated cryptography, supply-chain risk management, incident reporting under DFARS 252.204-7012). The platform should help enforce and evidence those.
- Audit-firm credibility. Look for platforms built or used by audit firms that have actually delivered NIST 800-171 / CMMC readiness engagements, not by generic GRC software vendors.
Options to evaluate
Lavawall®Multi-tenant CMMC 2.0 / CPCSC compliance platform for MSPs
Maps to CMMC 2.0 (L1 and L2), CPCSC, NIST SP 800-171, and NIST CSF 2.0 directly. Continuous evidence collection from Windows / macOS / Linux endpoints and M365 / Entra / Azure / Google Workspace tenants. Co-branded SSP and POA&M generation. Built and used by ThreeShield Information Security Corporation — an audit firm with CISSP and CISA staff. Multi-tenant by design with native CAD billing and Canadian-resident data hosting in Calgary, Alberta.
Best when: MSPs delivering CMMC 2.0 or CPCSC readiness as a service across multiple client tenants — especially Canadian and US-Canada cross-border firms.
Vanta or DrataSingle-tenant GRC platforms that include CMMC modules
Add-on CMMC 2.0 framework modules layered on a primarily SaaS-aimed GRC product. Useful for a single SaaS company chasing CMMC for its own contract. Single-tenant by default; not designed for MSP multi-tenant delivery.
Best when: A single SaaS or consulting company chasing CMMC 2.0 for its own contracts.
PreVeilEncrypted CUI handling
Specialty product for FIPS-validated CUI email and file sharing. Strong in its niche but does not cover the broader CMMC 2.0 control set on its own.
Best when: Defence contractors that need a FIPS-validated CUI exchange channel as one piece of their broader CMMC 2.0 evidence.
Hyperproof / Tugboat Logic / SecureframeEnterprise compliance program management
Compliance program management platforms with CMMC 2.0 templates. Strong on policy and program structure; weaker on direct endpoint and cloud evidence collection.
Best when: Enterprises with dedicated GRC teams that want compliance program management software and have evidence collection handled separately.
Specialised CMMC consultancies + ExcelManual readiness
Many MSPs run CMMC readiness manually with consultancy support and Excel-based control trackers. Works for one-off projects; does not scale to a continuous-evidence service offering.
Best when: MSPs handling a single CMMC 2.0 client and not building it into a recurring service.
How Lavawall® fits
Lavawall® treats CMMC 2.0 (Level 1 and Level 2) as a first-class framework. The 110 NIST SP 800-171 controls map directly to live evidence Lavawall® already collects from your client tenants — the patching state, the configuration posture, the MFA enforcement, the audit logging, the privileged-access controls, the incident response artefacts, and the supply-chain risk indicators.
For Canadian MSPs and cross-border consultancies, CPCSC support means the same evidence base satisfies both the US and Canadian regimes. You don't pay for two GRC platforms; you don't maintain two parallel control libraries; you don't produce two different SSPs.
Because ThreeShield (the audit firm that built Lavawall®) holds CISSP and CISA credentials and has been writing audit findings for two decades, the control mapping reflects what assessors actually look for — not the literal text of a control read by a software engineer who has never seen a real audit.
Frequently asked
- Is Lavawall® a CMMC C3PAO?
- No. Lavawall® is the platform; ThreeShield is the audit firm. CMMC 2.0 Level 2 assessments must be conducted by an authorised C3PAO. Lavawall® produces the evidence, the SSP, and the POA&M your assessor will work from. ThreeShield offers separate readiness and remediation engagements where helpful.
- Does Lavawall® cover NIST SP 800-171 directly without CMMC?
- Yes. NIST SP 800-171 is one of the 15+ frameworks Lavawall® maps controls and evidence to, alongside CMMC 2.0 (which builds on 800-171), CPCSC, NIST CSF, CIS, SOC 2, ISO 27001, PCI DSS, HIPAA, and the Canadian privacy bundle.
- How does the SSP get generated?
- Lavawall® generates a System Security Plan from the live control implementation evidence — what is configured, where, by whom, and on which devices and tenants — rather than from a generic template you have to fill in by hand.
- What about FedRAMP or IL4 hosting?
- Lavawall® hosts data in Canada (Calgary, Alberta, with current AWS Montreal infrastructure migrating to dedicated Calgary servers). For DoD CUI workloads requiring FedRAMP-Moderate or IL4 boundaries, contact ThreeShield or Lavawall® support to discuss which workloads can be handled and which require a dedicated FedRAMP environment.