CMMC Compliance for Defense Contractors: Scope, Assess, Maintain

What this covers and who it is for

CMMC compliance for defense contractors means holding the CMMC level your contract names, proving it the way that level requires, and keeping that status valid for as long as you hold the award. Level 1 covers Federal Contract Information (FCI), is self-assessed, and is affirmed once a year. Level 2 covers Controlled Unclassified Information (CUI) and is either self-assessed or certified by a Certified Third-Party Assessment Organization (C3PAO), depending on the program. The obligation arrives through DFARS 252.204-7021 in the contract itself, not through a voluntary program you can schedule at your convenience.

This page is the working hub for the people who have to produce that status: owners and general managers of small defense suppliers, the IT lead who already wears three other hats, prime contractor supply chain security staff, and managed service providers supporting defense work. Virginia is where much of this lands, from Hampton Roads shipyards to Northern Virginia engineering firms, but nothing here is state-specific. The requirement follows the contract, not the address.

The short version

If you have ten minutes and a contract modification with a CMMC clause in it, do these things in this order:

1. Read the clause. DFARS 252.204-7021 names a level and a timeline. That level, not your ambition, defines the target.
2. Find the CUI. List every contract, drawing, specification, and dataset that carries CUI markings or is export-controlled. No CUI, no Level 2.
3. Draw a boundary. Decide which systems store, process, or transmit CUI, and segment everything else away from them.
4. Inventory what sits inside the boundary. Every account, endpoint, server, cloud tenant, and application in it is in scope.
5. Score yourself against the requirement set. Level 1 is the fifteen basic safeguarding requirements of FAR 52.204-21. Level 2 is the 110 requirements of NIST SP 800-171.
6. Fix the loud, cheap gaps first. Multifactor authentication (3.5.3), account hygiene (3.1.1), FIPS-validated cryptography (3.13.11), and media sanitization (3.8.3) close most of the distance for a small firm.
7. Write the System Security Plan (3.12.4) from what you actually do, not from a template you hope to implement later.
8. Choose the assessment path, submit the result where DoD expects it, and put the annual reaffirmation on the calendar.

Key concepts you need first

FCI and CUI are different problems

Federal Contract Information is information the government provides, or that you generate for the government under a contract, that is not public. Invoices, delivery schedules, and statements of work usually land here. It is protected by FAR 52.204-21, and CMMC Level 1 is built directly from those fifteen basic safeguarding requirements.

Controlled Unclassified Information is narrower and much more expensive to get wrong: technical drawings, test data, engineering specifications, export-controlled material, and anything carrying a CUI marking or a distribution statement. CMMC Level 2 is the 110 requirements of NIST SP 800-171 applied to systems that handle it. A supplier that only ever touches FCI can complete Level 1 and stop. A supplier that receives a marked drawing has just become a Level 2 organization, whether or not anyone told the IT department.

The level ladder

• Level 1 — FCI, self-assessed. Annual self-assessment with a senior official affirmation, based on FAR 52.204-21 and the CMMC Level 1 scoping guidance.
• Level 2 — CUI, self-assessed or certified. Based on NIST SP 800-171. Some programs accept a self-assessment; programs DoD designates as critical require a C3PAO certification assessment.
• Level 3 — CUI on critical programs, government-assessed. Adds selected NIST SP 800-172 enhanced requirements and is assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).

Level is set per contract, not per company. The practical answer is to build the higher boundary once and keep the paperwork for both.

The four scoping categories

Scoping is where CMMC differs most from a generic framework. Every asset lands in one of four buckets, and only the first is tested in depth. Getting the classification right, and documented, is the largest lever on cost and timeline.

Scoping worksheet — agree each row before you buy anything
ASSESSABLE      In scope and fully tested (endpoints, servers, M365 tenant config)
CRMA            Contractor Risk Managed Asset — documented, not tested
SPECIALIZED     GFE, OT, or IoT that cannot be assessed — documented separately
OUT OF SCOPE    Segmented, no CUI, no path to CUI — documented, not tested

Assessment paths and where the record lives

Self-assessment produces a score you compute with the DoD assessment methodology, not a number you like. Certification assessment produces a certificate and a report uploaded into the CMMC instance of eMASS. Both end up in the Supplier Performance Risk System (SPRS), which is what a contracting officer actually reads. A Level 2 certification is valid for three years, with an annual affirmation in between. If the affirmation lapses, the status lapses with it.

How to apply this

Work in this order; scoping after you have bought tooling or hired an assessor is how projects double in price.

1. Translate the clause into a written target. One page: contract number, level required, CUI categories involved, date the status must exist, whether certification or self-assessment applies. Circulate it to whoever signs the affirmation.
2. Map where CUI actually goes. Follow one drawing end to end: email inbox, file share, CAD workstation, engineering change process, printed copies in the shop, backup tapes, the vendor who does your plating. Whatever the drawing touches is in scope, including the parts nobody thinks of as IT.
3. Segment to shrink the boundary. A virtual desktop or a dedicated tenant for CUI work is cheaper than hardening the entire company. Document the boundary with a data flow diagram; 3.12.4 requires the System Security Plan to describe the system boundary, and an assessor will test whether reality matches the drawing.
4. Close the high-value requirements. In practice these are 3.1.1 and 3.1.2 (limit access to authorized users and processes, no shared logins on shop-floor PCs), 3.5.3 (multifactor authentication for network access, including remote and administrative access), 3.13.11 (FIPS-validated cryptography — usually achieved by moving CUI to a FedRAMP Moderate cloud service and enforcing BitLocker and TLS properly), 3.8.3 (sanitize media before disposal or reuse outside your control), 3.3.1 (audit logging that is retained and reviewed), and 3.11.2 with 3.11.3 (scan for vulnerabilities and remediate on a tracked schedule).
5. Use the cloud correctly. DFARS 252.204-7012 requires a FedRAMP Moderate or equivalent cloud service for CUI. That covers a large block of the technical requirements, but it does not cover your configuration of it: the tenant settings, the sharing defaults, the guest accounts, and the license tier that decides whether you get the logging you just promised are all yours.
6. Produce the evidence pack while you work. Policies that match the SSP, screenshots and exports showing settings, ticket records showing remediation, and a POA&M for what remains. Evidence rebuilt after the fact rarely survives an assessor’s questions.
7. Pick the path and schedule it. Confirm with the contracting officer or prime whether self-assessment or C3PAO certification is required. Book readiness work first; an assessor who finds the obvious gaps on day one still charges for the visit.
8. Maintain it. Certification is not a filing cabinet event. Change control on the boundary, annual affirmation, quarterly access reviews, and a re-assessment before the three-year mark.

Worked example: a fabrication supplier moving from Level 1 to Level 2

Consider a thirty-five person machining supplier with years of Level 1 work that now receives a purchase order flowing down DFARS 252.204-7021 at Level 2. Drawings with distribution statements arrive by email and land on a general-purpose file server beside quotes, payroll scans, and the shop calendar.

It does not need a company-wide rebuild, it needs a boundary. The IT lead, also the de facto purchasing manager, works through these steps:

• Scoping: email, the share holding drawings, the three CAD workstations, the two engineering laptops, and the Microsoft 365 tenant are assessable. The ERP system is documented as a Contractor Risk Managed Asset because drawings never enter it. The CNC controllers are Specialized Assets — documented, excluded from assessment, still protected physically. Marketing laptops drop out once confirmed to hold no CUI.
• Boundary: a dedicated CUI share limited to six named accounts, MFA on all of them, and drawings opened on the CAD workstations only. That satisfies 3.1.1 and 3.5.3 and removes dozens of accounts from the assessed population.
• Data handling: USB drives removed from the shop floor; the one remaining drive, used for the wire EDM machine, is labeled, tracked, and wiped to 3.8.3 before reuse. Old drives are destroyed with a certificate on file.
• Vulnerability work: monthly authenticated scans of the five in-scope machines and a ticketed remediation deadline, which is 3.11.2 and 3.11.3 in a form one person can actually sustain.
• Documentation: the SSP (3.12.4) is written from these decisions, not from a template. The POA&M carries three items with dates and owners. On the day of the assessment, the assessor sees a drawing, follows it through email to the share to the CAD station, and finds the same story in the SSP.

Every exclusion is written down and every inclusion has evidence, which is what makes it defensible.

Where people get this wrong

• Buying a product instead of building a boundary. A tool cannot decide scope, and contractors who buy first usually scope to the tool.
• Assuming the cloud provider covers it. FedRAMP Moderate authorization does not cover your tenant configuration, identity provider, or log retention. Shared responsibility means you own the half that gets tested.
• Writing the SSP as an aspiration. An SSP describing a future state fails the first time an assessor asks to see the setting. If you cannot evidence it today, put it on the POA&M.
• Treating the POA&M as a parking lot. Items must close inside the window the rule allows, and some requirements cannot be deferred at all. A POA&M older than the contract is a finding, not a plan.
• Inflating the self-assessment score. The SPRS score is a representation to the government, and DoD can run its own assessment under DFARS 252.204-7020. Overstated scores get examined, and correcting them costs more than honesty would have.
• Forgetting the annual affirmation. Status is not permanent. Companies lose eligibility mid-performance because nobody owns the renewal date.
• Missing the reporting duty. DFARS 252.204-7012 requires reporting cyber incidents affecting covered defense information within 72 hours. A firm that can detect, log, and escalate meets it; one that finds the breach during a quarterly review does not.
• Ignoring the flow-down. If you subcontract CUI work, the subcontractor’s status is your problem. Ask for it before the work starts.

Where to go next

Starting from zero? Read the sequencing piece first, then come back for the scoping decisions.

• CMMC Compliance for Defense Contractors: What to Do First — the first ninety days for a firm that has just received the clause.
• CMMC Compliance for Defense Contractors: A Working Guide — the day-to-day execution detail behind each requirement family.
• CMMC Compliance for Defense Contractors: The Practical Hub — the index of everything else in this cluster.
• Zero to Patch: A Practical Patch Management Checklist — the operational backbone for 3.11.2 and 3.11.3.
• Building a Robust Incident Response Playbook — the detection and escalation path behind 3.6.1 and the 72-hour reporting clock.
• Data Loss Prevention Best Practices — useful once drawings start leaving the boundary.
• Zero Trust Architecture — the reasoning behind identity-centric access control at 3.1.1 and 3.5.3.
• Risk Management in Cybersecurity — how to prioritize when the POA&M is longer than the budget.
• Cybersecurity and Privacy Regulations: A Comparative Analysis — where CMMC sits relative to other regimes you may already answer to.

Start with the clause, then the CUI map; those two artifacts decide almost everything else.

Image credit: Andrew Mason, licensed under CC BY 2.0.