CMMC obligations are contract-specific, not industry-wide. Review the solicitation, award, and subcontract flow-down before budgeting for controls or assessments. Confirm what information your team will receive, create, or transmit.
Not every company that sells to DoD needs CMMC certification. You need it when an applicable CMMC clause appears in a solicitation, contract, or subcontract. The required level depends on FCI or CUI exposure. DoD began its phased rollout in November 2025. A defense-sector customer relationship alone does not create a certification duty.
Does this DoD opportunity require CMMC?
A company needs CMMC only when a specific DoD opportunity includes an applicable CMMC requirement. Defense supplier status alone does not create a current assessment duty.
The contract is the trigger. Review the solicitation, award, task order, modification, or subcontract for DFARS 252.204-7021. That clause establishes Cybersecurity Maturity Model Certification requirements. A supplier questionnaire or security email cannot replace the governing clause.
Contract-first decision: Find the applicable CMMC language. Identify FCI or CUI exposure. Then confirm the required level and assessment route. This sequence prevents unnecessary assessment spending.
A company without a flowed-down clause may still face customer security expectations. That company does not have a CMMC assessment duty for that transaction solely because it supports defense work.
The true risk is misreading the award.
Start with the solicitation clause
Read the full award path before classifying your business. Check the RFP, amendments, contract line items, statements of work, task orders, and subcontract attachments. Look for DFARS 252.204-7021 or explicit CMMC level language.
The most frequent error is treating a future-program requirement as a current-award requirement. DoD phases CMMC adoption through contract actions. Two programs under one prime can have different duties during the rollout.
Ask the prime in writing whether DFARS 252.204-7021 flows down. Ask which CMMC level applies. Ask what FCI or CUI your company will receive or access.
Seek written direction from a DoD contracting officer when the prime conflicts with the solicitation.
Then map FCI and CUI exposure
Federal Contract Information is nonpublic information provided by or generated for the U.S. Government under a contract. Controlled Unclassified Information requires safeguarding or dissemination controls under law, regulation, or government-wide policy.
The distinction changes the result. A scheduling email may be FCI. Controlled technical drawings, covered defense information, or marked engineering data may be CUI.
Do not label all nonpublic information as CUI. Check markings, distribution statements, contract terms, and the CUI program category.
Many teams miss indirect access paths.
Ticketing tools, endpoint management, backups, remote support, email archives, and collaboration platforms can create scope. These systems may touch CUI even when the statement of work does not mention them.
The clause determines whether CMMC applies. The data map determines which level is justified.
CMMC 2.0 verifies protection of sensitive contract information. It uses three levels. Level 1 addresses FCI safeguards. Level 2 applies NIST SP 800-171 to CUI environments. Level 3 adds selected protections for sensitive DoD programs.
CMMC does not replace every DFARS cybersecurity duty. It works with DFARS 252.204-7012, 7019, and 7020. The applicable CMMC clause sets the assessment path for the covered award.
FCI, CUI, and access change the answer
FCI often points to CMMC Level 1. CUI can place a contractor within CMMC Level 2 scope. No access to either category may mean no immediate CMMC duty for that work package.
CMMC Level 1 covers 17 basic safeguards in FAR 52.204-21. Level 2 aligns with 110 requirements in NIST SP 800-171. Those requirements protect CUI in nonfederal systems.
This is not a title-based test. A subcontractor can be out of scope. A managed service provider with privileged rights can be deeply in scope.
A company should classify data from evidence, not assumptions. Check CUI banners, export-control markings, DoD distribution statements, handling instructions, and technical-data labels. Obtain written confirmation from the prime where records conflict.
A file can be commercially sensitive without being CUI. A normal support ticket can contain a CUI hostname or controlled drawing reference. That can bring the ticket into the CUI environment.
Document why information is in or out of scope. NIST assessment practices support this approach. A defensible classification record beats an unsupported claim that no CUI exists.
Classify each information type before setting the system boundary. Include files, emails, tickets, logs, drawings, and system configurations. Record the source evidence for each decision.
The error most teams make is trusting the file name or folder. CUI can appear in metadata, screenshots, backup images, and attached engineering records. Review actual content and access paths.
A written data inventory can protect both the prime and subcontractor. It shows what enters the environment. It also shows what does not enter it.
Scope follows the information, not the job title.
Trace how systems touch the data
Map whether people or systems create, receive, store, process, or transmit information. Include SaaS applications, laptops, phones, VPNs, identity platforms, security tools, backups, and outsourced support.
A common case involves a U.S. machine shop. It receives public specifications for one order. It receives controlled CAD files for another order.
The public-specification order may not create CUI scope. The controlled-drawing order can change applicable obligations entirely.
Incidental access needs close review. A receptionist outside a CUI system differs from an IT administrator. That administrator may reset passwords, read logs, or access CUI backups.
Use segmentation to contain scope
Network segmentation can limit the CUI boundary. The boundary must be real, enforced, and documented. Identity controls, MFA, least privilege, and separate admin paths support that proof.
Segmentation can work, but shared backup tenants can defeat the boundary. Privileged admin accounts can also defeat it. The System Security Plan must describe the real architecture.
Include cloud dependencies and inherited controls in that description. The next issue is contract interpretation. Many organizations confuse NIST assessment scores with CMMC certification.
DFARS 252.204-7021 is the CMMC clause. DFARS 252.204-7012, 7019, and 7020 impose related but separate duties. Treating them as identical can cause excess spending or missed requirements.
DFARS 252.204-7012 requires adequate security for covered defense information. It requires NIST SP 800-171 where applicable. It also requires cyber incident reporting.
That clause does not itself require every contractor to obtain a C3PAO assessment. Contract language decides whether an independent assessment is required.
DFARS 252.204-7019 covers NIST SP 800-171 scores in the Supplier Performance Risk System. DFARS 252.204-7020 permits DoD assessment access or review. Neither clause alone identifies the CMMC level for a procurement.
The clause number changes the legal obligation.
Know what 7021 adds
DFARS 252.204-7021 places the CMMC structure into the contract. It identifies the required level. It also supports flow-down to subcontractors with relevant work or data exposure.
The acquisition requirement controls the assessment type. A Level 2 award may require an annual self-assessment. Another Level 2 award may require a triennial C3PAO assessment.
The U.S. Department of Defense CMMC program and 32 CFR Part 170 are sound starting points. Qualified counsel and the contracting authority should interpret the contract.
Separate scores from certifications
A Supplier Performance Risk System score is not a CMMC certificate. A System Security Plan and POA&M may support NIST SP 800-171 duties. A C3PAO assessment may serve a different contractual purpose.
The most common mistake is buying a Level 2 C3PAO assessment after seeing DFARS 7019 or 7020. Teams often fail to confirm that the acquisition requires a third-party CMMC assessment. That can create major cost before it is needed.
Washington, D.C.-area firms often compete across civilian and defense portfolios. A FedRAMP-focused cloud project and a CUI-bearing DoD subcontract can require different evidence. Their boundaries and assessment expectations may also differ.
The clauses set the legal route. Flow-down decides how that route reaches suppliers.
Prime and subcontractor duties follow data
Prime contractors must flow down applicable CMMC requirements. The level must match subcontracted work and information exposure. Primes should not require the highest level from every vendor.
A prime remains responsible for its own contract duty. It should identify suppliers receiving FCI or CUI. It should also identify their work and required subcontract terms.
A subcontractor should request the exact flow-down language and data description. “You support our DoD program” does not establish a Level 2 requirement.
Written scope prevents expensive assumptions.
Responsibilities across the supply chain
CMMC responsibility map for a DoD work package
Prime contractor
Reads award clause, maps CUI flow, and applies valid flow-down.
Subcontractor
Confirms access, protects in-scope systems, and supplies assessment evidence.
External provider
Falls in scope only when its role supports covered work.
The flow-down must match the work. A component distributor with no contract data differs from an engineering consultant. That consultant may edit controlled drawings in a shared repository.
A prime should give each supplier a data description. The supplier should then identify systems and users with access. This creates a record that supports later assessment decisions.
Questions that force a clear answer
Use a short written request before pricing remediation or booking an assessment:
- Which solicitation, contract, or subcontract clause requires CMMC for this work?
- What CMMC level applies to our scope, task order, or deliverable?
- Will we receive, create, store, process, transmit, or administer FCI or CUI?
- Which systems, tenants, repositories, and roles will access that information?
- Does the prime require self-assessment, C3PAO assessment, or other evidence?
A prime may still be developing supplier controls when it cannot answer these questions. That does not make a vague request a defined CMMC obligation.
Clear answers here set up the role-specific analysis that follows.
Edge cases need a role-by-role review
MSPs, manufacturers, cloud providers, consultants, distributors, and foreign firms need different analysis. Their contract role and actual access determine the result. They are not automatically exempt or subject to one level.
The matrix supports early triage. It cannot replace contract review. One privileged account or controlled file can change the outcome.
| Supplier role | Exposure that changes scope | Likely triage result |
|---|
| Commercial manufacturer | Controlled drawings or CUI specifications | No data access may mean no current duty. CUI can require Level 2. |
| MSP or MSSP | Admin rights, backups, logs, endpoint control | Often in scope when it administers a CUI environment. |
| Cloud provider | Stores, processes, or transmits CUI | Review contract terms, service model, and FedRAMP expectations. |
| Consultant or distributor | CUI portal access or controlled documents | Classify by real access, not business title. |
| Foreign subcontractor | CUI access, system location, export controls | Not automatically excluded. Confirm acquisition and handling limits. |
MSP and MSSP access is decisive
An MSP may patch endpoints, manage identities, hold backup keys, or run remote tools. Those activities can expose the provider to CUI. Data ownership does not remove the security duty.
Treat privileged access as a data-flow question. Technicians may view configurations, logs, shares, or recovery images with CUI. They may need assessment within the applicable contract model.
Cloud and foreign providers need evidence
A cloud service provider needs special review when it hosts CUI. The shared-responsibility model must assign each control. It must show which duties remain with the contractor.
FedRAMP status can matter, but it does not always replace CMMC evidence. Confirm the contract's cloud terms and authorization expectations. Confirm whether CUI enters the service.
A foreign company can perform DoD-related work. Export controls, personnel access, system location, and contract terms can change the result. Labels do not decide scope. Evidence does.
These role facts determine the right level and assessment path.
Choose level 1, 2, or 3 from the award
CMMC Level 1 uses an annual self-assessment. Level 2 may use annual self-assessment or triennial C3PAO assessment. Level 3 requires a government-led assessment.
The acquisition requirement selects the path. A supplier cannot choose its assessment route based on its preference.
Level 1 generally relates to FCI protection. Level 2 applies 110 NIST SP 800-171 requirements to CUI environments. Level 3 adds selected requirements for high-priority programs.
Do not buy a C3PAO assessment because a customer says “CMMC compliant.” Ask whether the opportunity needs Level 2 self-assessment or Level 2 certification. Ask whether a CMMC Third-Party Assessment Organization must assess you.
Zero Trust Architecture is not a CMMC level. NIST SP 800-207 describes an approach that can support CMMC evidence. Controls must map to the documented CUI boundary.
Identity controls, MFA, least privilege, device compliance, logging, monitoring, and segmentation can support NIST SP 800-171 evidence. They do not prove compliance by themselves.
Policies, configurations, logs, test records, and named owners must support the controls. Can the team demonstrate controls to an assessor? That is the practical test.
Screenshots without procedures rarely close the gap.
Avoid premature assessment costs
A Level 2 boundary with 20 to 50 users can need dozens of evidence items. Those items can cover access, incident response, media protection, and configuration management. A narrow enclave can cost less to assess and maintain.
That saving works only when segmentation is enforceable. Shared systems, broad administrator rights, and unmanaged backups can expand the scope.
No standard market price exists. Cost varies with scope, evidence quality, assessor availability, complexity, remediation needs, and third-party review requirements.
This guidance does not replace contract interpretation by qualified counsel. It also does not replace a contracting officer's written direction. It may not apply to commercial firms with no DoD solicitation, award, flow-down, FCI, or CUI connection.
The CMMC rollout began on November 10, 2025. DoD is adding assessment requirements in stages. It is not placing every assessment type into every contract at once.
Early solicitations can require Level 1 and Level 2 self-assessments. Later phases expand Level 2 C3PAO assessments. They also apply CMMC more broadly to covered solicitations, awards, and option periods.
A new solicitation may differ from an older contract. Both may support the same prime or program. Review the version, amendments, and performance period for each opportunity.
What people ask
Does every DoD subcontractor need CMMC?
No, only subcontractors with an applicable CMMC flow-down and required level need CMMC for that work. The clause and data access decide whether the duty applies.
Can a company self-assess for CMMC Level 2?
Some Level 2 acquisitions permit annual self-assessment. Others require a C3PAO assessment every three years. Read the acquisition requirement before selecting an assessor.
Which DFARS clause requires CMMC?
DFARS 252.204-7021 is the clause associated with CMMC requirements. DFARS 252.204-7012, 7019, and 7020 cover related safeguards, scores, and assessment matters.
Does handling FCI require Level 2?
Handling FCI may lead to CMMC Level 1 rather than Level 2. Level 2 generally relates to CUI and 110 NIST SP 800-171 requirements.
Does an MSP need CMMC certification?
An MSP may need CMMC when it administers or can access FCI or CUI systems. Privileged remote access and backup access are common scope triggers.
The essentials: CMMC duties start with an applicable contract clause, not defense-sector status. FCI and CUI exposure determine the likely level. Privileged access can create scope without direct data ownership. Confirm the exact flow-down before funding remediation or assessment.
Related sources
These articles can help you explore the topic in more depth:
