CMMC (Cybersecurity Maturity Model Certification) is a DoD framework requiring defense contractors and subcontractors to demonstrate cybersecurity maturity before being awarded DoD contracts. Companies in the Defense Industrial Base (DIB) that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) need CMMC compliance.

CMMC 2.0 has three levels: Level 1 (17 basic practices, annual self-assessment) for companies handling FCI; Level 2 (110 practices aligned with NIST SP 800-171, third-party assessment required) for companies handling CUI; Level 3 (110+ practices, government-led assessment) for the most critical DoD programs. Pantheon primarily supports Level 1 and Level 2.

An SSP documents how your organization implements each of the 110 NIST SP 800-171 security requirements. It is required for CMMC Level 2 and reviewed during assessments. Pantheon helps create and maintain your SSP by documenting your technical environment and mapping existing controls to NIST requirements.

ITAR (International Traffic in Arms Regulations) requires organizations to restrict access to ITAR-controlled technical data to authorized U.S. persons only, prevent export or transmission to foreign nationals, maintain access logs, and have policies governing ITAR data handling. Pantheon implements access controls, data segmentation, and monitoring to support these requirements.

Yes, with controls. Cloud services must be configured to restrict access to authorized U.S. persons and prevent data from being accessible to foreign nationals or stored on foreign servers. Pantheon helps organizations configure cloud environments — including Microsoft 365 Government editions where required — to meet ITAR access restrictions.

Pantheon provides managed IT and help desk for shop floor and office environments, network design and segmentation between OT/IT environments, endpoint protection and patch management, backup and disaster recovery for production and business systems, and vCIO technology planning and hardware lifecycle management.

A POA&M documents security gaps identified in a CMMC assessment and the planned timeline for remediation. Pantheon helps create the POA&M and tracks progress against it, ensuring your organization demonstrates a credible path to full compliance.