ABC Launches Free CMMC Roadmap for Defense Contractors

Associated Builders and Contractors (ABC) has launched a free Cybersecurity Maturity Model Certification (CMMC) roadmap for Department of Defense contractors and subcontractors in the Defense Industrial Base. The resource is aimed at organizations that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), and is designed to help them understand applicable requirements, identify readiness gaps and prepare to demonstrate compliance. ABC’s materials include quick-start guides, checklists, videos, webinars and reports, providing practical support for firms that may not have dedicated cybersecurity teams or prior experience navigating certification requirements.

The roadmap separates preparation into two tracks. Getting Started is intended for contractors beginning the process, including firms responding to a new customer requirement or bid. Finish the Job is for organizations that have already started implementation and want to validate their readiness before a customer review or formal assessment. ABC says the goal is to connect cybersecurity requirements with the operational realities of construction businesses. As ABC construction technology and innovation manager Josef Burkart explained, “At the end of 2025, ABC identified that contractors need practical guidance that connects cybersecurity requirements with how construction businesses operate.” He said the roadmap is intended to help firms understand their responsibilities, identify gaps and take concrete steps to protect sensitive information and compete for defense work.

For procurement planning, firms need to distinguish between CMMC Level 1 and Level 2. Level 1 self-assessment requirements remain in place, while the Department of Defense paused Level 2 third-party assessment and certification requirements in July, ahead of their planned November effective date. The pause is subject to review, so contractors should avoid treating it as a permanent cancellation and should monitor subsequent federal direction. The reported $5,977 estimated compliance cost for small entities offers a planning reference for Level 1, not a universal quote for every contractor; actual work and costs may vary based on a firm’s systems, practices and existing safeguards.

The announcement also reflects a broader business concern: cybersecurity readiness can affect eligibility for defense work and a contractor’s ability to protect government information. ABC Vice President of construction technology and innovation Matt Abeles said contractors that need CMMC can benefit from the roadmap to “win more work and deliver that work securely.” He also said ABC expects cybersecurity certification requirements could expand beyond DoD to other government agencies and private sectors, although that is an expectation rather than a confirmed policy change. ABC plans to track federal requirements and collaborate with cybersecurity specialists, including monitoring the Level 2 pause and review. The organization has advocated for requirements that strengthen national security without creating unnecessary barriers for qualified contractors, particularly small businesses with fewer cybersecurity resources than larger firms.

• ABC’s free CMMC roadmap is for Defense Industrial Base contractors and subcontractors handling FCI or CUI.
• Getting Started supports firms beginning certification preparation, including in response to a new customer requirement or bid.
• Finish the Job helps firms that have begun implementation prepare for customer reviews or formal assessments.
• The toolkit includes quick-start guidance, checklists, videos, webinars and reports to help firms understand requirements and establish cybersecurity processes.
• DoD Level 1 self-assessment requirements remain active; contractors should continue planning for and addressing applicable Level 1 requirements.
• Level 2 third-party assessment and certification requirements were paused in July ahead of a planned November effective date; the pause remains subject to review.
• The reported $5,977 estimate for small-entity Level 1 compliance can inform budgets, but firms should assess their own gaps and implementation needs.
• ABC plans to monitor federal changes and work with cybersecurity specialists; contractors should track updates rather than assume the Level 2 pause is permanent.
• ABC has identified construction companies including Granite Construction as having achieved Level 2 certification; the source also reports that Turner Construction, Kiewit and AECOM faced unauthorized system access this summer.
• Contractors can use the roadmap to organize readiness work, protect sensitive information and support their ability to compete for defense opportunities.