You can spend months implementing 110 NIST SP 800-171 practices and still fund the wrong assessment. The decision is not yours to make. Solicitation and contract language determine whether CMMC applies, which level governs, and which assessment you need.
Misreading that requirement can leave a bid team without the required status. That failure often appears when an award or subcontract deadline arrives.
The CMMC certification process starts with contract scope, not a control checklist. Identify whether you handle FCI or CUI. Then confirm the CMMC level and assessment type in the solicitation.
Level 1 uses an annual self-assessment. Many Level 2 contracts require a C3PAO assessment every three years. Map the decision, evidence, owners, costs, and a 90-day preparation path before engaging an assessor.
Let the contract set your CMMC route
Let the solicitation and contract language determine the required CMMC level and assessment route.
Read clauses as routing data
Find DFARS 252.204-7021 first. This clause introduces the CMMC requirement. It should identify the level that applies to the acquisition.
Then review DFARS 252.204-7012. It requires adequate security for covered defense information and cyber incident reporting. Also review DFARS 252.204-7019 and 252.204-7020.
Those clauses cover NIST SP 800-171 assessment scores in SPRS. SPRS means the Supplier Performance Risk System. They also cover DoD assessment access.
The contract clause controls the route, not a sales proposal.
Confirm the assessment authority
Record one of three routes: annual organizational self-assessment, C3PAO certification assessment, or a Level 3 DIBCAC assessment. Level 3 is not a voluntary upgrade path.
Level 3 applies only when the Department of Defense places that level in the acquisition. Do not scope Level 3 from a general risk judgment.
Use the final CMMC rule in 32 CFR Part 170 as the governing framework. Preserve the specific contract language that triggers your route.
Older CMMC 1.0 material cannot override the current contract clause or final rule. This includes commentary from the Katie Arrington era.
⚠️ Do not infer a CMMC level from the prime contractor’s name, program sensitivity, or past work. Only the solicitation, award, or valid flowdown sets the route.
A written requirement record prevents an avoidable assessment mistake. The next phase turns that record into a data-based scope.
Match FCI or CUI to assessment type
Classify FCI or CUI, then follow the assessment route specified by the acquisition.
Compare the available routes
| Route | Contract data | Practice count | Who assesses | Cadence |
|---|
| Level 1 | FCI | 17 | Organization | Annual self-assessment |
| Level 2 self-assessed | CUI | 110 | Organization | Annual self-assessment |
| Level 2 certified | CUI in designated awards | 110 | Authorized C3PAO | Every 3 years |
| Level 3 | Selected priority CUI awards | Level 2 plus selected 800-172 enhancements | DIBCAC | Every 3 years |
Follow the data, not job titles
CMMC decision path for a DoD acquisition
1. Read award language
Find DFARS 252.204-7021 and flowdowns.
2. Identify data
FCI points to Level 1. CUI points to Level 2 or 3.
3. Confirm assessor
Use self-assessment only when the acquisition permits it.
Output: a signed requirement record, a bounded system scope, and a funded assessment path.
The difference between Level 1 and Level 2 is not just 17 versus 110 practices. Level 1 protects Federal Contract Information through basic cyber hygiene.
That includes access control, supported systems, device protection, and user training. Level 2 requires a documented and repeatable security program for Controlled Unclassified Information.
Level 2 needs an accurate SSP, defined policies, and written procedures. It also needs technical configurations, operating records, and staff who can show how controls work.
The assessor tests evidence against the live environment.
For Level 2 certification, an authorized C3PAO tests whether evidence matches actual practice. A policy may require MFA. That policy fails if service accounts bypass MFA.
Remote administration tools can also create bypass paths. A cloud application can create the same issue.
⚠️ Do not classify data by the employee handling it. Classify the data under the contract and mark every system that receives, stores, processes, or transmits it.
Data classification sets the boundary and assessment method. That boundary now needs evidence that can survive assessor testing.
Build a 90-Day Evidence-Ready boundary
Build a bounded CUI environment, truthful SSP, and evidence set before engaging an assessor.
Days 1 through 30: find CUI
Build the CMMC assessment scope from the data outward. Do not start from the network diagram.
Trace every place where FCI or CUI is received, created, stored, processed, or transmitted. Include endpoints, file-sharing platforms, SaaS tenants, backup repositories, mobile devices, and home-office access paths.
Also include managed-service-provider tools. This work takes 10 to 20 minutes per application when owners know the data flow.
Classify each item as a CUI asset, security protection asset, specialized asset, contractor risk-managed asset, or out-of-scope asset. Document why each item has that classification.
A usable scope includes a current asset inventory and CUI data-flow diagram. It also lists authorized users, external connections, and the system boundary statement.
This work exposes unmanaged devices and shadow cloud storage before they become findings. The common error is trusting an old network diagram as the full boundary.
Days 31 through 60: prove controls
Close material gaps in access control, MFA, least privilege, encryption, and endpoint management. Also address vulnerability remediation, audit logging, incident response, and media protection.
Zero Trust Architecture can support this work through identity checks and device posture. It can also support segmented access and continuous monitoring. It does not replace a CMMC assessment objective.
Collect evidence as each control becomes operational. Useful artifacts include conditional-access exports and quarterly access-review records.
Keep endpoint encryption reports, vulnerability tickets, and log retention settings. Keep incident exercises, security-awareness records, and account termination tickets.
The most frequent failure is collecting screenshots at the end. Settings or dates may have changed by then.
Days 61 through 90: rehearse evidence
| Evidence area | Accountable internal role | Operating contributor |
|---|
| Contract clauses and flowdowns | Contracts manager | Program manager |
| SSP, scope, and POA&M | System owner | Compliance lead |
| Identity and privileged access | IT security lead | MSP or IAM provider |
| Logs and endpoint evidence | IT security lead | MSSP or SOC provider |
| Incident response | Executive incident owner | IT, legal, MSP |
| Funding and senior affirmation | Executive leadership | Contracts and compliance |
Rehearse assessor interviews with each named control owner. Ask each owner to show evidence, explain the process, and identify exceptions.
A small CUI environment with 25 to 75 endpoints often needs 60 to 90 focused days. That estimate assumes core identity, endpoint, and cloud controls already exist.
Unmanaged assets and unclear MSP duties extend the work. Missing data flows extend it further.
Evidence must be dated, owned, and reproducible.
⚠️ Do not ask an MSP to own your assessment evidence. The MSP may operate controls, but your company must explain scope, approvals, exceptions, and senior accountability.
A tested boundary makes the assessor engagement predictable. The remaining questions address contract fit and common limits.
This process does not apply as the primary requirement if you do not bid on or support DoD contracts and receive neither FCI nor CUI. It also cannot replace legal or contract counsel when clause applicability, flowdowns, export-controlled data, or subcontractor duties remain unclear.
FAQs
How do I know if CMMC applies to my contract?
CMMC applies when the solicitation, award, or valid subcontract flowdown includes the required CMMC clause. This commonly occurs through DFARS 252.204-7021. Confirm the clause, level, assessment route, and data category with your contracts owner before scoping systems.
Can I self-assess CMMC Level 2?
You can self-assess Level 2 only when the acquisition permits a Level 2 self-assessment. A contract requiring Level 2 certification requires an authorized C3PAO assessment every three years. An internal review does not meet that requirement.
What is the difference between FCI and CUI?
FCI generally maps to CMMC Level 1 and its 17 practices. CUI generally maps to Level 2 and 110 NIST SP 800-171 Rev. 2 requirements. Contract language and data handling facts set the final route.
Does an SPRS score mean we are CMMC certified?
No, an SPRS score is not CMMC certification. DFARS 252.204-7019 and 252.204-7020 address NIST 800-171 assessment reporting and DoD access. CMMC certification follows the acquisition's required assessment route.
Can our MSP certify us for CMMC?
No, an MSP cannot issue certification unless it is an authorized C3PAO conducting the required assessment. Your company still owns scope accuracy, SSP truthfulness, evidence access, and senior accountability. MSP operation does not transfer those duties.
What must be ready before a C3PAO assessment?
Before a C3PAO assessment, prepare a bounded scope, asset inventory, CUI data-flow diagram, and current SSP. Also prepare a controlled POA&M, policies, procedures, and dated technical evidence. Each control owner should explain and demonstrate the practice.
How long does CMMC Level 2 preparation take?
A defined CUI environment with 25 to 75 endpoints often needs 60 to 90 focused days. This assumes identity, endpoint, and cloud controls already exist. Unmanaged assets, unclear MSP duties, and missing data flows can extend that period.
Can Zero Trust replace CMMC compliance?
No, Zero Trust does not replace CMMC because CMMC tests contract-required practices and evidence. Zero Trust can strengthen MFA, least privilege, segmentation, and continuous monitoring. Those controls must still meet the CMMC assessment objectives.
The essentials: The contract clause determines the CMMC level and assessment authority. FCI, CUI, and verified data flows determine the technical boundary. A current SSP must match actual assets and operating practices. Evidence needs named internal owners, even when an MSP operates the control. A POA&M manages approved remediation, not unsupported deferral.
Fund the right assessment next
Fund only the contract-required assessment route after approving scope and ownership.
The next action is narrow. Have contracts, security, and program leadership review the one-page requirement record together.
Then approve only work that closes the verified gap. Compare your current CUI boundary with the contract-required assessment route.
⚠️ Do not schedule a C3PAO date before the SSP, asset inventory, and owner interviews are ready. An early date can turn correctable evidence gaps into a costly reassessment cycle.
Budget the CMMC certification process as separate workstreams. Include scope discovery, technical remediation, documentation, evidence collection, readiness review, and the assessment itself.
A C3PAO fee is only one part of Level 2 certification. Costs often rise when a company centralizes identity management or deploys endpoint protection.
Costs can also rise when logging improves or unsupported systems need replacement. A broad CUI boundary can also increase costs.
Request proposals that state assumed users, endpoints, locations, cloud services, and assessment days. Compare those assumptions with the approved CMMC assessment scope.
Reserve funding for staff interview time and post-assessment remediation. This prevents a low assessment quote from masking larger evidence or contract gaps.
Further reading
If you want to learn more about this topic, these sources may interest you:
