CMMC compliance starts by identifying where Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) enters, resides, and leaves your environment.
Determine the CMMC level your contract requires
Start with the contract.
The applicable level depends on solicitation language, award terms, modifications, and flow-down requirements from a prime contractor. Review DFARS 252.204-7012 and DFARS 252.204-7021. Review any program-specific security exhibit before selecting technology or booking an assessment.
CMMC Level 1 applies to organizations handling Federal Contract Information under 15 safeguarding requirements from FAR 52.204-21. CMMC Level 2 applies when Controlled Unclassified Information is in scope. It requires the 110 requirements of NIST SP 800-171. Level 3 serves selected high-priority programs. It builds on Level 2 with enhanced requirements from NIST SP 800-172.
Confirm the assessment path
The contract must also state or otherwise establish the required assessment route. Level 1 uses an annual self-assessment and affirmation. Level 2 can require a self-assessment or an independent C3PAO assessment. Level 3 uses a government-led assessment.
| Level | Information | Requirements | Assessment | Core proof |
|---|
| Level 1 | FCI | 15 practices | Annual self-assessment | Safeguards, assets, affirmation |
| Level 2 | CUI | 110 requirements | Self or C3PAO, per contract | SSP, operating evidence, interviews |
| Level 3 | Selected high-value CUI | Level 2 plus enhanced practices | Government-led | Enhanced technical proof |
A Level 2 SPRS score is not a CMMC Level 2 certification. An NIST SP 800-171 self-assessment, SSP, and Plan of Action and Milestones may be contractually required. They do not replace a third-party assessment when DFARS 252.204-7021 requires one.
Use a contract-first decision sequence. Do not select a CMMC level based only on company size or a customer request. First, determine whether the solicitation, award, modification, or prime flow-down includes the CMMC requirement.
Next, determine whether work involves only FCI or CUI. FCI generally points to CMMC Level 1. CUI generally points to Level 2. Confirm whether Level 3 is specified for selected high-priority CUI.
A subcontractor follows the same logic. Receiving CUI, accessing a CUI environment, or affecting CUI security may create a contractual requirement. This can apply even without a complete technical data package.
The assessment cadence should be documented with the level decision. CMMC Level 1 uses an annual self-assessment and annual senior-official affirmation. For Level 2, the contract sets the assessment route.
A Level 2 C3PAO assessment is generally valid for three years. Annual affirmation is still required. Level 3 uses a government-led assessment on its required cycle. It also requires annual affirmation.
Level 1 follows FAR 52.204-21 safeguards. Level 2 aligns with 110 NIST SP 800-171 requirements. Level 3 adds selected enhanced requirements from NIST SP 800-172.
Recording key dates prevents missed renewal obligations.
Record the clause, level, assessment route, expiration date, and affirmation due date in one register.
Map CUI before expanding your control scope
Map the data first.
A defensible scope starts with a data inventory and flow diagram. Trace CUI from receipt through creation, storage, use, transfer, backup, logging, and destruction. Include the source contract, CUI category, data owner, approved recipients, and retention period.
Build a CUI flow inventory
The inventory must include endpoints, identities, SaaS platforms, repositories, mobile devices, printers, and managed file-transfer services. Include backup platforms, SIEM records, and ticketing systems. Security tools may be in scope when logs retain CUI or derived content.
Choose a boundary that can be operated
A segmented CUI enclave can reduce the assessment population. Users, data paths, admin channels, and shared services must be truly controlled. Conditional access, device compliance, encryption, least privilege, and network segmentation must block uncontrolled movement into business systems.
| Scope model | Best fit | Assessment effect | Failure risk |
|---|
| CUI enclave | Limited CUI users and defined workflows | Fewer assets and identities | Undocumented data spillover |
| Enterprise scope | CUI is broadly shared or hard to isolate | More evidence and remediation | Higher cost and operational load |
Produce level 2 evidence assessors can test
Policies are not enough.
Level 2 evidence must show each required practice works repeatedly within the assessed scope. Assessors review documents and observe configurations. They inspect records, interview personnel, and test stated processes in the actual environment.
Connect every requirement to proof
Create a control matrix for all 110 requirements. Each row should identify the requirement and in-scope system. Include the implementation statement, control owner, evidence source, validation method, and permitted remediation status.
Assemble evidence by operating domain
Use evidence that assessors can reproduce during the assessment window. It should cover several months of operations, not one prepared day. A useful evidence set includes:
- Governance: approved policies, operating procedures, SSP versions, POA&M records, risk decisions, and change approvals.
- Asset and data proof: hardware inventory, software inventory, CUI register, data-flow diagrams, network diagrams, and system boundary statements.
- Identity controls: MFA settings, role assignments, privileged account reviews, termination samples, and access recertifications.
- Technical controls: encryption settings, firewall rules, endpoint reports, vulnerability remediation, backup configurations, and log retention settings.
- Operations: incident tickets, training records, audit logs, change tickets, supplier reviews, and evidence of continuous monitoring.
An SSP describes how the organization meets NIST SP 800-171 requirements within a defined system boundary. It is not a CMMC certificate. An SPRS score records a DoD Assessment Methodology self-assessment under applicable DFARS assessment requirements.
An SPRS score does not prove every control works effectively. A POA&M may document approved NIST SP 800-171 gaps. It does not automatically meet CMMC assessment expectations.
CMMC adds the required assessment and affirmation mechanism to contractual requirements. Certain Level 2 contracts allow self-assessment. Others require an independent C3PAO assessment.
Keep related compliance artifacts separate and current.
Maintain the SSP, SPRS submission record, POA&M, evidence matrix, and CMMC assessment results as separate compliance artifacts.
Prevent supplier gaps and assessment surprises
Suppliers can expand your boundary.
DFARS flow-down management should identify each supplier and the information received. It should record contract authority, system path, and required assessment status. This is both a procurement and security control.
Set supplier obligations before transfer
Classify suppliers as FCI recipients, CUI recipients, or service providers with admin access. Also identify out-of-scope providers. Require written handling restrictions, incident notice terms, approved transfer paths, evidence rights, and flow-downs where applicable.
Use phased readiness gates
Assign accountable owners across security, IT, contracts, engineering, HR, and procurement. This sequence avoids expensive control deployment before scope is known:
- Weeks 1 to 3: review clauses and flow-downs; classify FCI and CUI; name the contract owner and security owner.
- Weeks 3 to 6: complete the CUI inventory, flow diagrams, asset list, supplier register, and preliminary system boundary.
- Weeks 6 to 12: close architecture gaps, configure access controls, update the SSP, and build the requirement-to-evidence matrix.
- Weeks 12 to 18: test evidence, run interviews, correct contradictions, validate supplier records, and decide whether assessment readiness exists.
CMMC should not be the immediate priority without DoD contracts, contractual flow-downs, FCI, or CUI. It does not replace PCI DSS, HIPAA, FedRAMP, export-control duties, or state privacy obligations. These frameworks may share technical controls. Their legal scope and evidence standards differ.
Your questions answered
What does CMMC level 3 require?
CMMC Level 3 requires Level 2 practices plus selected enhanced practices from NIST SP 800-172. It applies only to designated high-priority DoD programs. It uses a government-led assessment.
Does an SPRS score mean we are CMMC certified?
No, an SPRS score does not mean your organization is CMMC certified. It records a NIST SP 800-171 assessment score. Certification depends on the required CMMC assessment route and contract terms.
How do I know whether we handle CUI?
You handle CUI when contract work involves information marked or designated as controlled under federal CUI rules. Review contract attachments, distribution statements, prime instructions, technical data, and actual data flows.
Can a small subcontractor need CMMC level 2?
Yes, a small subcontractor can need Level 2 if it receives, stores, processes, or transmits CUI. Company size does not change the information type. It also does not change a valid flow-down obligation.
Can Microsoft 365 be outside the CMMC boundary?
Microsoft 365 can stay outside the boundary only when no CUI enters, resides, transits, or remains recoverable from that tenant. Validate email, Teams chats, SharePoint copies, audit logs, and backups carefully.
What evidence does a C3PAO review at level 2?
A C3PAO reviews policies, procedures, configurations, records, interviews, and technical demonstrations for all 110 requirements. The assessor tests control operation within the declared scope. A document alone is not enough.
How long should level 2 preparation take?
A defined CUI enclave often needs between 90 and 180 days for Level 2 preparation. The duration grows when CUI is dispersed and when supplier terms are incomplete or operational records are missing.
Make the scope decision before the spend
CMMC planning should start with contract language and a defensible CUI data-flow map. That order identifies the required level and constrains the boundary. It gives security leaders a factual basis for technology and assessment budgets.
Next, compare your NIST SP 800-171 SSP with a CUI flow inventory and evidence matrix. Do this before treating any SPRS score as readiness.
- The essentials: the contract clause and handled information determine the CMMC level, not organization size.
- The essentials: CUI mapping must precede control selection, or the assessment boundary will grow unnecessarily.
- The essentials: Level 2 requires proof that all 110 NIST SP 800-171 requirements operate in practice.
- The essentials: supplier flow-downs and documented data paths are part of the assessment risk.
Further reading
If you want to learn more about this topic, these sources may interest you:
