CMMC applies when a DoD contract or subcontract includes a CMMC requirement. Your in-scope environment must handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).
Company size, revenue, industry, and past DoD work do not determine the obligation. The contract clause and data flow do.
Does your DoD contract trigger CMMC?
The enforceable requirement begins with the solicitation, award, modification, or subcontract flowdown.
Review the complete contract record
Review the RFP, award, Statement of Work, CDRL, amendments, security attachments, and subcontract documents together. The controlling requirement may appear in Section H or a technical attachment.
It may also appear in a modification or task-order flowdown rather than on the prime contract cover pages.
Create a clause register for each requirement. List the clause number, required level, assessment type, affected entity, performance period, and source document.
Review DFARS 252.204-7021 alongside DFARS 252.204-7012 and DFARS 252.204-7020. Their safeguarding, reporting, and assessment duties are related but different.
Separate supplier status from scope
A manufacturer, consultant, payroll provider, software vendor, or logistics firm is not automatically subject to CMMC. Supporting the defense industry alone does not create the requirement.
The requirement applies when the firm receives an applicable flowdown. Its systems must also create, receive, store, process, or transmit FCI or CUI for covered work.
Preparing for future awards may make commercial sense, but it differs from a current contract duty.
CMMC scope follows the clause and the information path. It does not follow a company’s label as a defense supplier.
Maintain a clause-and-flowdown file
Before authorizing an assessment, retain the RFP, award, SOW, CDRL, and security exhibits. Keep amendments, DD Form 254 where applicable, and every subcontract flowdown.
Do this before making a proposal representation. Assessment decisions need written contract language, a documented data map, and a defined system boundary.
Do not rely on a sales statement or an informal request from a prime contractor.
CMMC is entering contracts through phased implementation. Do not assume every 2026 DoD opportunity has the same assessment deadline.
The CMMC acquisition rule began phased implementation on November 10, 2025. Early solicitations can require Level 1 or Level 2 self-assessments.
Later phases expand Level 2 C3PAO assessments and Level 3 government assessments. Contracting officials may apply requirements under the applicable rule and solicitation.
For bid planning, maintain a pipeline for each expected RFP date. Include the expected CMMC level, assessment status, remediation lead time, and likely flowdown.
This separates an immediate award condition from future readiness work.
Map FCI and CUI before choosing a level
Identify the information first. Then determine which systems and providers can access it.
Identify FCI and CUI from evidence
FCI is information provided by or generated for the U.S. Government under a contract. It is not intended for public release.
CUI requires safeguarding or dissemination controls under law, regulation, or government-wide policy. Trace each data type to a contract task or government source.
Also trace each data type to prime direction, a deliverable, drawing, ticket, or repository. Keep a data inventory and system diagrams.
Keep data-flow diagrams, access lists, cloud records, and backup records. Where NIST SP 800-171 applies, keep the System Security Plan and POA&M.
Trace indirect access paths
Map managed service providers, MSSPs, SaaS platforms, endpoint tools, and help-desk queues. Include email archives, collaboration spaces, backups, and security logs.
Determine whether each provider can view, export, administer, restore, or impersonate access to in-scope information. These rights can create scope.
Security controls reduce risk. They do not remove a provider from scope when its personnel can access CUI.
Contract-to-scope decision path
1. Find the clause
RFP, award, modification, flowdown
2. Identify data
FCI, CUI, source, task, marking
3. Map access
Users, SaaS, MSPs, backups, tickets
4. Match assessment
Only the route named in the clause
Use the clause to set the CMMC level
The contract clause selects the CMMC level and assessment route. Company preference does not select either one.
Distinguish assessment terms
Level 1 covers 15 safeguarding practices for FCI. It generally requires annual self-assessment and affirmation.
Level 2 aligns with the 110 requirements in NIST SP 800-171. The contract determines whether it requires self-assessment or an independent C3PAO assessment.
Level 3 adds selected NIST SP 800-172 practices. It uses a government-led assessment.
A prior 7020 assessment differs from a C3PAO assessment. Both also differ from a Level 2 self-assessment.
| Contract condition | Information and scope | Assessment route | Evidence to verify |
|---|
| No applicable CMMC clause or flowdown | No in-scope FCI or CUI for covered work | No current CMMC assessment | Award, SOW, flowdowns, data map |
| Level 1 named | FCI environment | Annual self-assessment and affirmation | 15-practice evidence and boundary |
| Level 2, self-assessment stated | CUI environment | Annual self-assessment and affirmation | NIST SP 800-171 evidence, SSP, POA&M |
| Level 2, C3PAO stated | CUI environment | Third-party assessment | Clause wording, enclave, assessor readiness |
| Level 3 stated | Specified high-priority CUI scope | Government-led assessment | Level 2 base plus required 800-172 practices |
Budget from scope, not averages
Cost depends on in-scope assets and enclave design. It also depends on external service access and NIST SP 800-171 maturity.
Evidence volume and remediation needs also affect cost. Do not budget from market averages alone.
Engage a C3PAO only after confirming a required Level 2 third-party assessment. Confirm that the CUI boundary is stable first.
Supply-Chain edge cases that change scope
Vendor labels do not determine scope. Access and applicable flowdowns do.
Review privileged service access
Remote monitoring can expose a provider to CUI. Endpoint administration, incident response, and backup restoration can also expose it.
Tenant administration can expose CUI even without a deliverable. Privileged access is the issue.
FedRAMP authorization may matter when choosing cloud services. It does not make the customer CMMC compliant.
The customer must show compliant service configuration, identities, logging, data handling, and contracts. The applicable requirement still controls.
Check business support workflows
Support tickets, screenshots, and CRM notes can expose CUI outside the intended enclave. Source repositories, file-sharing links, chat exports, and email archives can do the same.
A payroll vendor that handles normal employment records may stay outside scope. Access to covered data changes that result.
A recruiter, HR consultant, or SaaS support team may need review if they access program records, contract artifacts, or production systems containing FCI or CUI.
CMMC is not an immediate priority for a company without DoD contracts or subcontracts. The company must also receive no applicable flowdowns and handle no FCI or CUI. It may still need commercial preparation for upcoming DoD supply-chain bid cycles.
Common questions
What if I do not meet the required CMMC
If an applicable contract requires CMMC, complete its required assessment route. The route may be self-assessment with affirmation, third-party assessment, or government assessment.
Failure can block award or affect continued performance eligibility. Maintain the route required by the clause.
How much does CMMC certification cost?
Cost depends on the required level, asset count, and enclave design. Provider access, NIST SP 800-171 gaps, and remediation work also affect cost.
Which DFARS clause requires CMMC?
DFARS 252.204-7021 implements CMMC requirements in applicable DoD contracts. DFARS 252.204-7012 and 252.204-7020 address related obligations.
Do subcontractors need CMMC certification?
Subcontractors need CMMC when an applicable flowdown requires it. Their in-scope systems must handle FCI or CUI.
What are CMMC requirements for 2026?
CMMC enters solicitations and awards in phases during 2026. Review each solicitation, award, modification, and flowdown for level, assessment type, and timing.
Make the contract decision before spending
Treat CMMC as a contract and data-governance decision. Make that decision before investing in an assessment.
Contracts or legal staff should identify the governing clause and flowdowns. Security staff should map FCI and CUI across users and systems.
They should also map cloud services, MSPs, tickets, logs, and backups. Leadership can then approve the assessment path and budget.
That approval should rely on documented scope.
What matters most:- The applicable contract clause and flowdown determine whether CMMC is currently required. Company size does not decide it.
- FCI often aligns with Level 1 and CUI often aligns with Level 2. Award language controls the enforceable assessment path.
- Map indirect access through MSPs, SaaS, support tickets, backups, and collaboration tools. Do this before setting the system boundary.
- Budget after contracts, legal, and security teams document the clause, data flow, and required assessment route.
Noncompliance is not limited to failing an assessment. Before submitting a proposal, verify that representations and affirmations match the actual assessment path.
They must also match the system boundary and available evidence. Do this before accepting a subcontract.
A prime contractor may request proof of subcontractor compliance before releasing CUI. It may also request proof before assigning a covered task.
The government may evaluate compliance during award review or contract administration. The contract clauses and facts will determine the result.
An unsupported representation can create award, performance, payment, termination, and dispute risk. An expired affirmation can create the same risks.
Failure to maintain required safeguards can also create those risks.
Legal, contracts, security, and executive owners should approve the evidence before any compliance statement. This approval should occur before any formal representation.
Learn more
Here are some additional resources on this subject:
