CMMC Compliance for Defense Contractors: A Working Guide

What this covers and who it is for

CMMC compliance for defense contractors is the work of proving — with evidence a third party can inspect — that your company meets the cybersecurity requirements your DoD contract names. Level 1 is 17 practices for protecting Federal Contract Information, self-assessed annually. Level 2 is 110 practices drawn from NIST SP 800-171 Rev 2; it applies once Controlled Unclassified Information touches your systems, and a Certified Third-Party Assessment Organization assesses it for most contracts. Level 3 adds NIST SP 800-172 requirements and is government-assessed. The binding clause is DFARS 252.204-7021.

This hub is for the person who has to deliver that, not the person who signs the certificate: the IT manager at a 45-person machine shop, the controller who also owns “compliance,” the MSP carrying eight defense clients, the security lead at a prime pushing requirements down to twenty subcontractors. If you bid on DoD work or subcontract to someone who does, the requirement arrives through flow-down and lands on a named individual.

Virginia contractors feel this earlier than most: the defense supply chain runs from Northern Virginia integrators through the Richmond corridor to Hampton Roads ship repair, and primes screen subcontractors on cyber posture long before a CMMC clause appears. Below: scoping, the three artifacts, the evidence an assessor asks for, and the mistakes that sink a manageable remediation.

The short version

• Level is set by data, not headcount. Federal Contract Information only means Level 1. The moment you receive, store, or process CUI — drawings, controlled specifications, inspection reports — you are Level 2.
• The contract clause is the trigger. DFARS 252.204-7021 requires CMMC certification at the level specified. 252.204-7012 already requires NIST SP 800-171 implementation and 72-hour incident reporting. 252.204-7019 requires a current SPRS score; 252.204-7020 gives DoD assessment access.
• Three artifacts carry the program: the System Security Plan required by 3.12.4, the POA&M required by 3.12.2, and the SPRS score computed with the DoD Assessment Methodology.
• Scope is the biggest cost lever. A well-built enclave can cut the boundary from 200 endpoints to 20 — if the separation is real and documented.

Key concepts you need first

FCI, CUI, and why the distinction decides everything

Federal Contract Information is non-public information a contractor generates or receives under a federal contract — pricing spreadsheets, delivery schedules, statement-of-work details. CUI is a step up: information the government or a prime designates as requiring safeguarding, frequently technical data, drawings, test results, or controlled specifications. Level 1 protects FCI with the 17 practices mapping to FAR 52.204-21. Level 2 protects CUI with the 110 requirements of NIST SP 800-171 Rev 2, across 14 families from access control (3.1) to system and information integrity (3.14).

Most internal disputes start here, because nobody wrote down which documents count. If your engineers receive a PDF drawing carrying a distribution statement, that file’s location defines your scope. Build the inventory before you buy a single tool.

The three levels and who signs off

Level 1 is an annual self-assessment entered into the Supplier Performance Risk System, plus an annual affirmation by a senior official. Level 2 is a triennial assessment by a Certified Third-Party Assessment Organization for most contracts; a subset of Level 2 contracts permits self-assessment instead, and the clause tells you which. Level 3 is a government-led assessment against NIST SP 800-172 requirements. In every case a senior official affirms, and a false affirmation is a personal exposure, not just a corporate one.

SSP, POA&M, and SPRS

The System Security Plan required by 3.12.4 describes the boundary, the environment of operation, how each requirement is implemented, and connections to other systems. Requirements 3.12.1 through 3.12.4 — periodic assessments, a POA&M, ongoing monitoring, the SSP itself — are the program-management spine.

The POA&M records each gap, the remediation, an owner, and a date. At Level 2 the highest-weighted requirements cannot be deferred: they must be implemented on assessment day, and everything else must close inside the remediation window the rule sets. The SPRS score follows the DoD Assessment Methodology — start at 110 and subtract for each unmet requirement by its weight of 5, 3, or 1 point. That score is what a prime sees when it screens you.

Scoping: enterprise or enclave

Scoping means deciding which assets sit inside the boundary. Assessing the whole business is simplest to describe and most expensive to fix. An enclave is a defined set of users, endpoints, servers, and cloud services that handle CUI, separated by controls that enforce data flow (3.1.3). Enclaves are cheaper, but only if the separation is genuine and the SSP admits every path by which CUI escapes — email, shared drives, printing, removable media (3.8.1), the engineer copying a drawing to a personal laptop. The zero trust architecture guide covers the identity and segmentation primitives that make an enclave defensible.

How to apply this

1. Read the clause, then draw the boundary. Confirm the level, whether assessment is by a C3PAO or self-assessment, and which data the contract scopes in. Then walk the document flow — folders, mailboxes, apps, people touching drawings and inspection data — and have the data owner, engineering or quality rather than IT, sign the list.
2. Build the SSP skeleton first. Map all 110 requirements to an implementation statement and an evidence pointer before remediating anything. The exercise exposes gaps tools cannot fix.
3. Score the gap honestly. Compute SPRS, tag every unmet requirement with weight, cost, and owner, then sort by weight. A low score you can explain beats a high one you cannot defend.
4. Fix identity first. Named accounts instead of shared ones (3.1.1, 3.5.1), non-privileged accounts for daily work (3.5.2), MFA on every path to CUI (3.5.3): email, VPN, remote admin, jump hosts.
5. Turn on logging you can use. Centralize audit records (3.3.1), make individual actions traceable (3.3.2), review what you collect (3.3.9). If you cannot say who touched a file last Tuesday, you are not implemented.
6. Lock configuration and patching with evidence. Baseline configurations (3.4.1), enforced settings (3.4.2), authenticated vulnerability scanning (3.11.2). The patch management checklist gives you the repeatable procedure assessors expect.
7. Resolve the cloud and email boundary. DFARS 252.204-7012 requires cloud providers handling CUI to meet requirements equivalent to FedRAMP Moderate. Verify the authorization level of each service, including email and file sync, and write it into the SSP.
8. Train by role, then rehearse. Awareness training (3.2.1) is table stakes; role-based training (3.2.2) with named completion records is what gets asked for. Tabletop the incident process (3.6.1) before anyone walks into an assessment.

Worked example: a 45-person machining subcontractor

A Virginia machining shop with 45 employees, 60 Windows laptops, an on-premises file server holding customer drawings, and Microsoft 365 Business Premium for email is quoted on a Navy subcontract carrying DFARS 252.204-7012 and 252.204-7021 at Level 2.

Step one was the data map, and it changed the project. Only four locations held CUI: drawings from the prime, first-article inspection reports, the controlled specification library, and the quality manager’s email archive. Payroll, ERP scheduling, and machine telemetry were out of scope. That produced an enclave: 12 engineering and quality workstations, one hardened file server, a segmented switch, CUI-only mail routing, and a single locked printer.

Step two was the gap score. The first pass found 22 unmet requirements: the file server accepted shared local accounts (3.1.1, 3.5.1), MFA covered email but not VPN or the server (3.5.3), audit logging sat on defaults with no central collection (3.3.1, 3.3.2), two engineering workstations lacked FIPS-validated disk encryption (3.13.11), and no SSP existed (3.12.4). Illustrative scoring: six 5-point gaps (−30), ten 3-point gaps (−30), six 1-point gaps (−6) leaves 44 out of 110 — a number every prime can see. Because five-point gaps cannot be parked in a POA&M, all six had to close before a C3PAO was scheduled, not after.

Step three was sequencing. Identity first: conditional access for the tenant, MFA on the VPN, named accounts in place of shared local ones with a separate privileged tier (3.5.2). Then logging into a central store with retention long enough to investigate an incident surfacing weeks later, plus alerts on account creation and privilege changes. Then cryptography: disk encryption through the FIPS-validated module, verified device by device rather than assumed from a policy flag. Lower-weight items followed — media control (3.8.1), role-based training with completion records (3.2.2), monthly authenticated scans (3.11.2). Twelve weeks later the worksheet scored 105, with the remainder in a POA&M closing inside the remediation window. That is the shape of a passing Level 2 program: a narrow honest boundary, a scored gap, a fix order driven by weight, evidence behind every claim.

Evidence an assessor will ask for

Requirement  | Evidenced by                        | Source system
3.1.1        | Named accounts, no shared IDs       | IdP user export
3.5.3        | MFA on every path to CUI            | CA policy + sign-in log
3.3.1, 3.3.2 | Central logs, per-user traceability | Log store query
3.12.4       | Current SSP and boundary diagram    | SSP revision history
3.12.2       | POA&M with owners and dates         | Tracker export

Readiness checklist

• Contract clause identified; level and assessment type written down.
• CUI inventory signed by the data owner, and the boundary diagram matches the asset list and the SSP.
• All 110 requirements mapped to an implementation statement and an evidence pointer.
• MFA on every path to CUI (3.5.3), including VPN, jump hosts, and any account with interactive logon.
• Audit logs centralized, retained, and reviewed (3.3.1, 3.3.2, 3.3.9); FIPS-validated cryptography verified per device and connection (3.13.11).
• Cloud and email providers checked against the 7012 equivalence requirement.
• Incident process tested with the 72-hour reporting path rehearsed (3.6.1), and the annual affirmation owner named.

Where people get this wrong

• Getting scope wrong in both directions. Leaving CUI in the general file share pulls the whole estate into the boundary. Personal OneDrive sync, a shop-floor laptop with a local copy of the spec library, and a vendor portal that caches documents all break an enclave. Map the leak paths before claiming they are closed.
• Treating the SSP as write-once and the POA&M as a parking lot. 3.12.4 requires periodic updates, and the highest-weighted requirements cannot be deferred at Level 2 at all. An assessor compares document to diagram to console, in that order.
• Confusing “FIPS mode” with FIPS-validated cryptography (3.13.11). Flipping a policy flag does not validate a module. Check the implementation, not the checkbox.
• MFA that stops at email (3.5.3). VPN, remote support tools, and admin consoles are the obvious gaps; service accounts with interactive logon are the ones people miss.
• Forgetting the 72-hour clock under DFARS 252.204-7012, or assuming the prime’s certification covers you. Incident handling (3.6.1) exists partly to serve the reporting obligation, and flow-down means your certification is your own. The prime will ask for your SPRS score long before DoD does.

Test your own claim the way an assessor will: pick a requirement at random and ask the person who operates it to show you the setting, the log, and the record of change. If any is missing, that requirement is aspirational, not implemented.

Where to go next

Work outward through the functions CMMC leans on hardest — identity, logging, configuration, incident response.

• Risk management in cybersecurity — turning a gap score into a funded, prioritized remediation plan.
• Patch management best practices — cadence and evidence for the assessor conversation.
• Building a robust incident response playbook — 3.6.1 plus the DFARS reporting path.
• Mastering cloud security audits — evaluating the providers that hold your CUI.
• The CISO blueprint — who owns the affirmation, the POA&M, and the budget line.
• Security for SMBs — the baseline a small contractor needs whether or not a contract demands it.
• Cybersecurity and privacy regulations compared — where CMMC overlaps other obligations, and where it does not.

Start this week: pull the contract clause, confirm the level, and list every location holding a customer drawing. That inventory sets your boundary, budget, and timeline — and no consultant can do it for you.