Camcode, a division of Horizons Inc., has achieved Cybersecurity Maturity Model Certification (CMMC) Level 2 from independent evaluator Sera Brynn, a Certified Third-Party Assessment Organization (C3PAO).
That verification is above and beyond what the Department of Defense (DoD) currently requires. The DoD suspended the rule mandating third-party assessments in July 2026, so suppliers can satisfy CMMC Level 2 requirements today through self-assessment. Camcode elected to undergo an independent third-party verification anyway. For our defense agencies, prime contractors and suppliers who use our UID labels and asset tracking services, that’s one less supplier risk to evaluate.
The Cybersecurity Maturity Model Certification (CMMC) is the DoD’s initiative to ensure companies in the defense industrial base (prime contractors and sub-tier manufacturers and suppliers) are adequately protecting sensitive government data that they have stored on their own networks.
There are three levels of CMMC certification, depending on the type of information a company handles or stores in its systems:
The program’s final rule went into effect in December 2024. Contract requirements showing CMMC levels began appearing in new DoD solicitations on November 10, 2025. All major primes, including Lockheed Martin, Northrop Grumman, Boeing and RTX are now requiring their suppliers to provide their CMMC level.
Level 2 applies to any company that stores, processes or transmits Controlled Unclassified Information (CUI). CUI refers to sensitive government information that has not been classified but still requires protection. This includes technical information like engineering drawings, technical data, specifications and test reports related to defense programs.
To achieve Level 2, companies must have implemented all 110 security requirements outlined in the National Institute of Standards and Technology’s (NIST) Special Publication 800-171. These requirements cover 14 different categories including access control, multi-factor authentication, encryption, logging and monitoring, incident response, physical security and employee training.
The DoD assesses companies’ progress through the Supplier Performance Risk System (SPRS). Scores range up to 110, which means a company has implemented all requirements with no remaining items on a remediation plan. Camcode’s SPRS score is 110.
Companies can achieve CMMC Level 2 in one of two ways. A company can perform its own self-assessment and self-assert the result in SPRS, or they can hire a C3PAO to perform an independent assessment. A C3PAO is a certified auditor who has been authorized by the CMMC accreditation body to perform assessments.
| Level 2 (Self) | Level 2 (C3PAO) | |
| Who verifies | The company itself | An accredited, independent third-party auditor |
| Evidence reviewed | Internal | Policies, systems and controls are tested on site by assessors |
| Frequency | Every 3 years, plus annual affirmation | Every 3 years, plus annual affirmation |
| Camcode status | Achieved, SPRS score 110 | Achieved, assessed by Sera Brynn |
Under the original rollout, most contractors working with CUI would have been required to have a C3PAO assessment by November 10, 2026. On July 13, 2026, the DoD suspended that milestone, citing cost concerns and a lack of certified assessors. They also initiated a program-wide review. For the time being, contracts can only mandate Level 2 (Self).
None of the underlying security requirements changed. Contractors are still required to comply with all 110 controls outlined in NIST SP 800-171. The difference is who validates that the required controls are in place. Camcode’s proactive C3PAO assessment places it a tier above competitors relying only on self-assertion. Our customers gain the confidence that comes with third-party validation that our controls are implemented correctly, and we already hold the credential should the DoD make third-party assessments mandatory again.
A label may look like a simple product, but labeling programs for defense assets can carry sensitive data right on the package. Our customers supply us with part numbers, CAGE codes, serial number format matrices and engineering drawings to manufacture MIL-STD-130 UID labels and data plates. Our UID services and on-site data collection teams can work directly with asset registers for ships, vehicles and equipment.
If any of that information qualifies as CUI, DoD expects each supplier that touches it to protect it to the same standard as the prime contractor does. Primes are responsible for flowing down CMMC requirements to subcontractors and validating each supplier’s status in SPRS. Working with a supplier that has already achieved Level 2 status makes this process simpler:
CMMC builds on an existing contract clause currently used by the DoD in solicitations and contracts: DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting.” Existing contractors that work with CUI are required to:
CMMC adds independent or self-assessment verification that these safeguards are implemented.
Certification isn’t a one-time event. Camcode will:
Camcode has been providing U.S. military and defense contractors with durable identification since 1950. Our Metalphoto® labels are compliant with MIL-STD-130 and UID standards from primes such as Lockheed Martin and Boeing. CMMC Level 2 demands no less when it comes to safeguarding your information.
Metalphoto was originally adopted by the U.S. Navy in 1958 for use on shipboard labels, placards and damage control signs. In a recent Navy environmental survivability test of UID label materials, eight companies submitted 26 different materials. Camcode’s Metalphoto UID labels received more top performance scores than any other material tested, proving its resistance to abrasion, chipping, heat and chemical exposure. Click here for our certifications and test results.
Call 800-627-3917 or contact our team to request documentation of our CMMC status or to discuss your UID or asset tracking needs.
CUI refers to information created or possessed by the government that is not classified but still requires protection under law, regulation or policy. Typical examples in defense manufacturing would be engineering drawings, technical data packages, specifications and test reports.
No. Level 2 is for companies that store, process or transmit CUI. Companies that work with just Federal Contract Information require Level 1. The solicitation will specify which level is required for a given contract.
Both validations require compliance to the same set of 110 NIST SP 800-171 controls. For Level 2 (Self) the company self-tests and then self-affirms the result in SPRS. For Level 2 (C3PAO), an accredited independent tester assesses the company’s controls and provides the result.
No, not at this time. The DoD put a pause on phase 2 of the rollout that would have mandated C3PAO assessments for most CUI contracts beginning November 10, 2026. Until the suspension is lifted, contracts are only allowed to mandate level 2 (Self). They are currently reviewing the program.
110 is the highest possible SPRS score using the NIST SP 800-171 DoD assessment methodology. It reflects that all 110 security requirements have been assessed as satisfied. Having a self-reported score of 110 does not inherently prove third-party CMMC certification.
Approved final CMMC Level 2 status will be valid for three years, assuming the organization remains in compliance and submits annual affirmations of compliance. If the company was granted conditional status, it will have 180 days to remediate eligible pending requirements for final status.
DFARS 252.204-7012 is the clause in contracts that requires contractors to safeguard CUI by using NIST SP 800-171 and report cyber incidents to DoD within 72 hours. CMMC ensures those protections are implemented.
Contact our team to request documentation of our CMMC Level 2 status and SPRS score for your supplier records.
Our sales engineers are experts in automatic asset tracking, tagging and identification, and can answer all your questions. Get in touch now.
Lets Talk ›Enter your information and get a free checklist of the top questions to answer and tips to plan a successful asset tagging project for any asset management or tracking system implementation.
