CMMC Compliance for Defense Contractors: The Practical Hub

What this covers and who it is for

CMMC compliance for defense contractors means proving, with artifacts, that your organization meets the cybersecurity level written into its DoD contract, and having that proof recorded where the Department of Defense can see it. Level 1 is the 15 basic safeguarding requirements of FAR 52.204-21, self-assessed. Level 2 is the 110 requirements of NIST SP 800-171, either self-assessed or certified by a C3PAO depending on the acquisition. Level 3 adds a selected subset of NIST SP 800-172 and is assessed by government assessors. The rules sit in 32 CFR Part 170 and reach you through DFARS clause 252.204-7021, with results recorded in SPRS.

This hub is for the people who have to produce that evidence: the IT lead at a 40-person machine shop whose customer drawings are covered defense information, the vCIO at an MSP whose defense customers assume the MSP is already compliant, and the compliance manager at a prime pushing requirements down a supplier tier that has never been assessed. Demand is heaviest in the Virginia defense corridor, from Northern Virginia primes to Hampton Roads shipbuilding and ship-repair suppliers to the subcontractor tier around Richmond.

Everything here is about scope, evidence, and sequencing. Product selection is a downstream question.

What this hub does not cover

CMMC is not a classified-information regime; classified work falls under the NISPOM and 32 CFR Part 117, not DFARS 252.204-7012. It is not a product certification, and it is not a substitute for a risk program, only a contractual floor of specific requirements. For the wider regulatory picture, see Cybersecurity and Privacy Regulations: A Comparative Analysis across Different Jurisdictions; for the discipline underneath it, see Risk Management in Cybersecurity.

The short version

• Find the clause, then the level. DFARS 252.204-7012 sets the safeguarding and incident-reporting obligation, 252.204-7019 requires a current NIST SP 800-171 assessment in SPRS before award, and 252.204-7021 is where CMMC itself enters the contract.
• Scope before you buy. The boundary around CUI decides most of your cost and nearly all of your assessment risk.
• Level 1 shops self-assess 15 requirements and affirm annually.
• Level 2 shops work the 110 NIST SP 800-171 requirements, self-assessing or getting certified by a C3PAO. Certification runs on a three-year cycle with annual affirmations.
• Score and disclose. The assessment lands in SPRS and a senior official signs the annual affirmation that it is still accurate.
• POA&Ms are bounded. Only a limited set of requirements may remain open at assessment, and the certification carries a deadline to close them.
• Flow-down is real. Your subcontractors, your cloud provider, and your MSP sit inside your risk boundary whether or not they appear in your diagram.

If you do one thing this quarter, pull every DoD contract and subcontract you hold, note which of those three clauses each cites, and write down the level and assessment type it implies. Most contractors discover they have been planning for the wrong one.

Key concepts you need first

FCI, CUI, and covered defense information

Federal Contract Information is non-public information the government provides, or that is generated for the government under a contract: a purchase order, a delivery schedule, a statement of work. Controlled Unclassified Information is information the government requires to be protected under law, regulation, or policy. Defense contractors usually meet it as drawings, test data, maintenance manuals, and export-controlled specifications, and in DoD contracts it is often called covered defense information. The working rule: FCI pulls in Level 1, CUI pulls in Level 2, and the contract tells you which applies.

The requirements have IDs, so use them

Level 2 requirements are numbered across the control families of NIST SP 800-171, and those numbers are the working vocabulary of an assessment. 3.5.3 is multifactor authentication for privileged accounts and for network access to non-privileged accounts. 3.13.11 is FIPS-validated cryptography protecting the confidentiality of CUI at rest. 3.12.1 is audit logging. Learn the twenty or so IDs that map to your environment, because they belong in your system security plan, your POA&M, and the answers your staff give an assessor. NIST SP 800-171A supplies the assessment procedures, the specific examine, interview, and test steps behind each requirement.

Scope is a decision you document

32 CFR 170.19 defines assessment scope and sorts your estate into CUI assets, security protection assets, contractor risk managed assets, specialized assets, and out-of-scope assets. The purpose is not to hide systems, it is to write down defensibly which assets handle CUI and which genuinely cannot. An asset you cannot justify belongs inside the boundary.

SPRS, POA&M, annual affirmation

The Supplier Performance Risk System holds your NIST SP 800-171 DoD assessment score. Scoring starts at 110 and deductions apply for requirements you do not meet, weighted by the DoD assessment methodology. The Plan of Action and Milestones records each gap with an owner and a closure date. A senior company official affirms the score each year. Stale scores and unsigned affirmations are the most common administrative failures in the program.

How to apply this

1. Fix the level from the paperwork. Read the contract, the subcontract, and any purchasing-system flow-down language. Record the clause, the level, and whether the assessment is self or C3PAO. If the paperwork is silent, assume the prime flows CMMC down at renewal and plan for it.
2. Draw the boundary. Inventory every asset, then classify it into the five categories: the file server, the cloud tenant holding drawings, the ERP, the engineer laptop, the CNC controller, the backup appliance, the MSP remote-access tooling, and the email path carrying the drawings. Mark what is in.
3. Gap-assess against requirement text, not a product matrix. For each requirement in scope, record met, partially met, or not met, and name the artifact that proves it. A control with no artifact is not met.
4. Close in a deliberate order. Identity and access first (3.1.1, 3.5.1, 3.5.3), then boundary protection and encryption (3.13.1, 3.13.8, 3.13.11), then logging and incident response (3.12.1, 3.6.1, 3.6.2), then flaw remediation (3.14.1, 3.14.4). The first group is cheap and high-signal. The last group decays fastest, so it needs a process rather than a project.
5. Run a dry assessment. Have someone who did not build the environment walk the 800-171A procedures for ten requirements and write down what they could not find. That list is your real POA&M.
6. Choose the path and book it early. Self-assessment if the contract allows it, C3PAO if it does not. Assessment capacity is finite, and scheduling is the long pole.
7. Post the score and start operating. Enter the assessment in SPRS, get the affirmation signed, and put the recurring work on a calendar: affirmation, log review, vulnerability scanning, patch windows, POA&M burn-down.

Worked example: a 60-person machining subcontractor

A Virginia precision machining shop holds a subcontract flowing down Level 2 with a C3PAO certification requirement. Its CUI is customer drawings in PDF and native CAD, first-article inspection data, and the email threads carrying both. Finance, HR, and the marketing site are genuinely separate. First-pass scope worksheet:

ASSET                        CATEGORY                IN SCOPE  NOTE
CAD/file server (on-prem)    CUI asset               yes       drawings, inspection data
Engineering workstations (6) CUI asset               yes       local CAD cache
Microsoft 365 (mail, SP)     CUI asset               yes       CUI in mail and files
Backup appliance             security protection     yes       holds CUI backups
Firewall / VPN concentrator  security protection     yes       3.13.1 boundary
CNC controller (legacy OS)   specialized asset       yes       compensating controls
Shop-floor shared PC         CUI asset               yes       drawing viewer
Finance workstation          contract risk managed   no        documented separation
HR / payroll SaaS            out of scope            no        no CUI flow

The gaps were predictable. A shared operator login on the shop floor broke 3.1.1 (limit system access to authorized users) and made 3.12.1 logging useless, because every event carried the same account name. The VPN offered password-only access, so 3.5.3 had to be closed before anything else could be certified. Drawings sat on an unencrypted volume, failing 3.13.11. USB sticks carried G-code to the controller with no sanitization process, failing 3.8.3 and 3.8.7. The controller could not be patched, so it was documented as a specialized asset with restrict-and-monitor compensating controls in the SSP rather than quietly dropped from scope. Nothing showed that flaw remediation was happening on any defined timeline, which is 3.14.1.

The POA&M entries that survived review were specific, owned, and tied to a requirement ID:

ID     REQ    GAP                          OWNER    DUE        CLOSURE EVIDENCE
P-004  3.5.3  VPN authentication is        IT lead  T+90 days  MFA enforced; IdP config
              password-only                                     export; test log
P-007  3.8.3  No media sanitization        Ops mgr  T+60 days  Signed procedure; three
              procedure                                         sanitization records

None of that required buying a platform. Named accounts, MFA, disk encryption, a USB procedure, a patch calendar, and an SSP that matched reality closed the bulk of it. Tools came later, and only where a control genuinely needed one.

Evidence that survives the assessment

Assessors do not accept intent. For every requirement you claim, hold the policy, the configuration export, and a sample of records showing it works. Screenshots go stale; exports with timestamps and a named owner do not. Where a control depends on a person doing something routinely, such as reviewing logs or testing restores, keep the last few occurrences, because the interview will ask for them.

Where people get this wrong

• Buying the tool and skipping the process. A platform that reports 3.12.1 as covered because logging is enabled does not satisfy the requirement to review and act on logs. Assessors test the review, not the switch.
• Pretending the MSP is out of scope. A provider with administrative access to CUI systems is a security protection asset by definition, and its weaknesses become your findings.
• Assuming a self-assessment satisfies a certification contract. The two paths are not interchangeable. Turning up with a self-assessment score where the contract requires a C3PAO certificate ends the conversation.
• Scope creep in both directions. Pulling the whole company in inflates cost and evidence burden; carving out systems that actually touch CUI voids certification. Document the reasoning either way.
• A POA&M that never closes. The same gap appearing in a second cycle with no progress reads as a finding. Assign dates you can defend and close the cheap items first.
• Forgetting the calendar. Annual affirmation, three-year recertification, and POA&M closure deadlines are dated obligations that nobody chases for you.
• Treating incident response as paperwork. 3.6.1 and 3.6.2 require a tested capability, and 252.204-7012 requires reporting a cyber incident affecting covered defense information within 72 hours. A plan nobody has exercised fails both tests.

Where to go next

Three moves, in order. Get the paperwork straight: the clause, the level, the assessment type, the date. Produce a scope worksheet and a requirement-level gap list you would hand an assessor without hesitation. Then put the recurring controls on a calendar with owners, because after certification the program becomes operations.

Use these guides for the layers underneath:

• Zero Trust Architecture for the identity and boundary controls behind 3.1.x and 3.13.x.
• Zero to Patch: A Practical Patch Management Checklist for 3.14.1 and 3.14.4, the requirements that decay fastest.
• Beyond CVSS: Contextual Vulnerability Prioritization for 3.11.2 and 3.11.3 when you cannot patch everything at once.
• Building a Robust Incident Response Playbook for 3.6.1, 3.6.2, and the reporting clock.
• Data Loss Prevention (DLP) Best Practices for keeping marked CUI inside the boundary you drew.
• Security for SMBs: What It Is and How to Do It Right if you are a small contractor building the baseline from scratch.
• The CISO Blueprint for who owns the affirmation, the POA&M, and the evidence file.
• Secure Software Development Life Cycle (SDLC) if CUI lives in your builds or CI/CD pipeline.

What separates contractors who pass from those who reschedule is rarely budget. It is whether the boundary in the diagram matches the boundary in the network, and whether the evidence matches both.