CMMC applies to the contractually defined environment that handles covered data. It does not automatically apply to your whole company. Review the solicitation, classify data, define scope, and budget only for required controls.
What is CMMC? CMMC is the DoD cybersecurity assessment program for Defense Industrial Base companies handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Contract clauses determine whether it is required and which level applies.
Does this DoD opportunity require CMMC?
A DoD opportunity requires CMMC only when its solicitation, award, subcontract, or valid flow-down includes the requirement. It must also state a level. Working with DoD does not automatically put every company system in scope.
Review solicitation clauses, amendments, attachments, and data-handling instructions. Review prime-contractor flow-down terms too. Pay close attention to DFARS 252.204-7021, which sets a CMMC level and assessment condition.
The contract language determines whether CMMC is required and, if so, which level applies.
FCI, CUI, or neither: classify first
FCI is nonpublic information given by the government or created for it under a contract. CUI needs safeguards under law, regulation, or government-wide policy. Confirm its status through markings, contract instructions, and prime-contractor labels.
During the 2026 phase-in, review CMMC requirements for each opportunity. Do not assume prior DoD work sets the current requirement. Review the solicitation, each amendment, award terms, and any prime-contractor flow-down.
Check for DFARS 252.204-7021. Check the stated CMMC Level and assessment type. Also check whether the requirement applies at proposal submission, award, option exercise, or performance.
Ask for clarification before bidding if documents conflict or lack detail. A CMMC requirement can change through an amendment, so an earlier solicitation version may not show the final contract condition.
Match FCI and CUI to the right level
CMMC Level 1 generally fits FCI-only work. Level 2 generally fits CUI work. Level 3 applies only to named high-risk programs. The solicitation, not company size or tools, sets the required level.
| Information in scope | Likely level | Assessment route | Core evidence |
|---|
| No FCI or CUI | No CMMC level unless required | Contract review | Data-flow rationale and clauses |
| FCI only | Level 1 | Annual self-assessment and affirmation | 15 practice records and system boundary |
| CUI | Level 2 | Usually C3PAO assessment | 110 NIST SP 800-171 requirements, SSP, technical proof |
| CUI plus stated enhanced need | Level 3 | Government-led assessment | Level 2 proof plus selected NIST SP 800-172 safeguards |
Level 1 uses 15 basic safeguarding requirements from FAR 52.204-21. Contractors complete an annual self-assessment and senior-official affirmation. Evidence should show restricted FCI access and protected devices.
Level 2 aligns with 110 requirements in NIST SP 800-171. It usually requires a CMMC Third Party Assessment Organization (C3PAO) assessment. An SPRS score or NIST self-assessment does not equal Level 2 certification.
Level 3 adds selected requirements from NIST SP 800-172. The government assesses Level 3. Budget for it only when the acquisition names that need.
The required level follows the covered data and contract.
Define the CUI or FCI boundary before buying tools. It includes people, devices, apps, networks, suppliers, and sites that process covered information. Think of it as a fenced area around the data.
Map every CUI flow and handoff
Trace where CUI enters, gets edited, is sent, backed up, and destroyed. Include email, collaboration platforms, ticket systems, remote access, cloud storage, printers, and removable media.
Set boundaries assessors can verify
Your System Security Plan (SSP) should describe real assets, users, connections, owners, controls, and boundaries. Keep an inventory of hardware, software, identities, interfaces, and providers.
The most common mistake is drawing a boundary that ignores daily work. A shared mailbox or unmanaged cloud folder can pull more systems into scope.
Apply zero trust as proof, not a slogan
Zero Trust checks identity and access for each request. It works like checking a badge at every secure door. Multi-factor authentication, least privilege, controlled administration, logging, encryption, and access-review records show that it works.
A narrow, accurate boundary can cut cost and assessment effort. It must still include every system that touches covered data. The next step is proving that those controls operate.
Evidence that makes a CMMC assessment defensible
A defensible package links each required practice to the scoped environment. It also names an owner and shows operating proof. Policies alone do not prove that access reviews, backups, incident drills, or log checks occur.
Build an audit-ready evidence set
Use one evidence map for each practice. Link it to the SSP, asset inventory, data-flow diagrams, policies, and operating records. Add dated proof, such as configurations, logs, tickets, test results, and screenshots.
CMMC, DFARS, NIST publications, and FedRAMP are related but serve different purposes.
| Framework or rule | Primary audience | What it establishes |
|---|
| CMMC | Applicable DoD contractors | Assessment and certification conditions for contract eligibility |
| DFARS 252.204-7012, -7019, -7020, -7021 | DoD contractors | Contractual safeguarding, reporting, score, assessment, and CMMC obligations |
| NIST SP 800-171 | Nonfederal CUI systems | 110 security requirements used by Level 2 |
| FedRAMP | Cloud services for federal agencies | Cloud authorization process, not contractor CMMC certification |
CMMC is not the main framework if your organization has no DoD contracts or subcontracts. The same applies if it receives no FCI or CUI or does not plan to enter the Defense Industrial Base. FedRAMP is not an automatic substitute. It authorizes cloud services for federal agency use. It does not replace a contractor's CMMC obligations.
Make evidence testable, not just documented
An assessor should trace scope evidence to a requirement, owner, system, and date. Keep the SSP, inventory, diagrams, policies, logs, and configurations. Also keep access-review results, patch records, backup tests, incident exercises, training records, and supplier documents.
Track open fixes in a Plan of Action and Milestones (POA&M). Include an owner, target date, affected requirement, and closure proof. A POA&M does not replace a working control. Use it only when CMMC assessment rules allow it.
Evidence must show what happens in the live environment. This separates a paper program from a defensible assessment. That distinction shapes the questions buyers ask before award.
Your questions answered
What is the CMMC process?
The process includes contract review, data classification, scoping, gap analysis, remediation, evidence collection, assessment, and ongoing maintenance.
CMMC stands for Cybersecurity Maturity Model Certification. It is the DoD program for applicable Defense Industrial Base contractors handling FCI or CUI.
Is CMMC required for every DoD contractor?
No. CMMC applies only when a solicitation, contract, or valid flow-down includes the relevant requirement.
What is FedRAMP versus CMMC?
FedRAMP authorizes cloud services for federal agency use. CMMC assesses eligible DoD contractors. FedRAMP does not replace a contractor's required CMMC level.
Does a SPRS score mean we have CMMC level 2?
No. A Level 2 contract requiring a C3PAO assessment needs independent assessment and affirmation. A NIST SP 800-171 score alone is not enough.
What evidence will a C3PAO ask for?
A C3PAO typically examines the SSP, asset inventory, data flows, policies, records, configurations, logs, and test evidence. These items must support Level 2 requirements.
Decide your CMMC path before you bid
Start with the contract clause and covered data. Do not start with a company-wide certification claim or security product. Assign owners for solicitation review, data-flow mapping, and executive affirmation.
Use a short pre-bid review
Before promising eligibility, confirm the CMMC level and assessment type. Confirm award timing, flow-down language, CUI locations, and outside providers.
Keep the SSP alive after assessment
Update the SSP when systems, cloud services, user roles, or data flows change. Compliance must match the live environment.
The essential points:- CMMC is driven by the solicitation and contract clause, not simply by doing business with DoD.
- FCI usually points to Level 1, while CUI usually points to Level 2 and a C3PAO assessment.
- A defensible scope includes every system, user, provider, and data flow that touches covered information.
- Policies matter only when records and technical evidence show they operate in the live environment.
Plan the path from gap analysis to contract
A practical CMMC timeline starts with contract and data review. It then moves to CUI scoping, gap analysis, remediation, evidence collection, readiness review, and the required assessment or affirmation.
The duration depends on environment size and complexity. Organizations often lose time when they find unmanaged cloud storage late. Unsupported devices, undocumented administrator access, and subcontractors can also cause delays.
Another common delay is an SSP that describes the intended environment rather than the live environment. Start collecting evidence while fixes are underway. The assessment should test operating controls, not last-minute paperwork.
Learn more
Here are some additional resources on this subject:
