How is Athena different from Secureframe, Strike Graph, Paramify, Risk Cognizance, SMPL-C, or Kiteworks?

Those platforms optimize the contractor's readiness workflow — live SPRS tracking, AI controls dashboards, fast SSP/POA&M drafting, continuous control monitoring, LLM document analysis, or CUI data movement. Athena adds the assessor-facing submission layer that almost none of them ship: SAR narrative drafting, eMASS-ready JSON packaging, OSCAL output, and cryptographic provenance (SHA-256 + chain-of-custody) for every artifact a C3PAO or DIBCAC assessor opens on engagement day.

Does Athena replace Secureframe, Strike Graph, or Paramify?

No — Athena is the assessor-side submission layer that sits on top of whatever readiness GRC you already use. Bring evidence from any tool; Athena drafts the SAR, generates the POA&M with prioritized remediation, scores SPRS, and exports eMASS / OSCAL packages with provenance.

What does Athena export for a CMMC Level 2 assessment?

SAR draft with citations, POA&M with milestone estimates, SPRS scoring package, eMASS-ready JSON, OSCAL package, evidence binder with SHA-256 hashes, and a chain-of-custody manifest signed for the assessor.

CMMC Levels

CMMC Level 1 vs Level 2: Which One Applies to Your Contract?

The fastest way to scope a CMMC program wrong is to misidentify the level. Level 1 and Level 2 sit on completely different control baselines, completely different assessment regimes, and completely different cost curves. This page walks the legal trigger (FCI vs CUI), the control delta (17 vs 110), the assessment delta (self vs C3PAO), and how to read a DFARS clause to know which level your contract actually requires.

Free CMMC Quick Score See pricing

The legal trigger: FCI vs CUI

Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Almost every federal contract creates FCI. The contract clause that triggers FCI handling is FAR 52.204-21. FAR 52.204-21 + FCI = CMMC Level 1.

Controlled Unclassified Information (CUI) is a defined category of unclassified information that requires safeguarding under federal law, regulation, or government-wide policy. CUI handling is required by DFARS 252.204-7012 (the safeguarding clause) and assessed under DFARS 252.204-7021 (the CMMC clause). DFARS 7012 + CUI = CMMC Level 2.

Controls: 17 vs 110

Level 1: 17 basic safeguarding controls drawn from FAR 52.204-21(b). Password management, access control, media protection. No SSP required by the rule; an attestation is.
Level 2: all 110 controls from NIST SP 800-171 Rev. 2, assessed against the ~320 objectives in 800-171A. Full SSP, full POA&M, full evidence package.
The delta isn't 6.5x of work — it's closer to 30x. Level 2 demands documentation density and evidence collection Level 1 doesn't.

Assessment: self vs C3PAO

Level 1 is an annual self-assessment with an affirmation submitted to SPRS. No external assessor.

Level 2 is overwhelmingly a triennial C3PAO assessment. A small subset of Level 2 contracts allow self-assessment (when DoD permits it in the solicitation), but assume C3PAO unless the contract explicitly says otherwise. There is also a Level 3 reserved for the most sensitive CUI; it's assessed by DIBCAC, not a C3PAO, and adds 24 controls from NIST 800-172. Level 3 is rare.

How to read your contract

FAR 52.204-21 only → Level 1.
DFARS 252.204-7012 + 7019 + 7020 → CUI handling required, current regime. Becomes Level 2 once 7021 is added on contract renewal.
DFARS 252.204-7021 → CMMC certification required. Look at the solicitation for the assessment level.
CDI / CTI markings on the data → CUI by another name. Level 2 applies.
Subcontractor flow-down: if your prime has 7021, you almost certainly need the same level. Ask in writing; the prime is responsible for flow-down.

Frequently asked questions

Can I be Level 1 on one contract and Level 2 on another?

Yes. CMMC level is set per contract, not per company. Many contractors run both — a Level 1 attestation for FCI-only work and a Level 2 enclave for CUI work. The risk is letting CUI leak into the Level 1 environment; that requires the whole environment to be assessed at Level 2.

How do I know if my data is CUI?

Look for explicit CUI markings on the documents the government provides. If unmarked but the contract is for defense work (engineering data, technical data, source selection information, export-controlled), assume CUI and ask the contracting officer in writing to confirm. The CUI Registry at archives.gov/cui lists all categories.

Is Level 2 always a C3PAO assessment?

Mostly. The 32 CFR Part 170 final rule allows DoD to designate some Level 2 contracts as self-assessment, but the default and overwhelming majority is C3PAO. Always check the solicitation language — if it specifies 'Level 2 C3PAO,' you need a third-party assessment.

What's the cost difference?

Level 1: low four figures annually (mostly internal time + SPRS submission). Level 2: typically $100k-$400k for a small business across tooling, remediation, and the C3PAO assessment fee itself ($50k-$120k for the assessment alone). The control delta is where the cost lives.