The Problem: Meeting CMMC Compliance
The September 2025 Final Rule sets a firm deadline for CMMC compliance across the Department of Defense (DoD) supply chain. If you're a Managed Service Provider (MSP) or External Service Provider (ESP) serving DoD contractors, you must understand your obligations now to avoid losing contracts when clients undergo assessment.
Supply chain breaches have highlighted vulnerabilities in third-party providers. The Cyber-AB has clarified that not directly touching DoD systems doesn't exempt you from scrutiny. Your clients must account for every system that processes, stores, or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), including yours.
The compliance burden flows down through contracts. During a CMMC Level 2 assessment, assessors will map information flows. If FCI or CUI touches your infrastructure, you're in scope. If you generate Security Protection Assets (SPAs) for their environment, you're part of their evidence package. Understanding which scenario applies to you is crucial for pricing contracts correctly and building the right controls.
What You Need Before Starting
To determine your CMMC obligations, gather these inputs:
Contract Documentation: Collect all active contracts and statements of work with DoD prime contractors or subcontractors. Look for clauses referencing DFARS 252.204-7012, NIST SP 800-171, or CMMC requirements. These indicate the presence of FCI or CUI.
System Architecture Diagrams: Map every service you provide to each DoD-adjacent client. Document data entry, storage, transmission, and access. Include SaaS platforms, backup repositories, monitoring tools, and ticketing systems.
Data Classification Inventory: Work with clients to classify the information you handle. Don't assume. Confirm in writing whether a firewall log contains metadata about CUI or if a backup includes encrypted CUI.
Access Logs: Document every instance where your staff accesses client systems. Note whether access is persistent (maintaining credentials) or transient (one-time troubleshooting).
Legal and Procurement Support: Engage someone to interpret contract language and negotiate scope boundaries. CMMC obligations are contractual before they're technical.
Step-by-Step Implementation
Step 1: Apply the Exemption Filters
Check if you qualify for an exemption in these categories:
Commercial Off-The-Shelf Products: If you sell the same product to DoD contractors and the general public without customization, you're exempt. This includes software licenses, hardware, and standardized services, but not managed services where you operate infrastructure for clients.
Staffing Services: If you provide temporary personnel working under client supervision on client systems, the client owns the training and compliance obligation. This exemption doesn't apply if your staff use your tools or systems.
Temporary Access for Specific Services: Services like vulnerability scanning and penetration testing qualify if access is time-limited and data isn't retained. Document the scope and duration of each engagement. If you store scan results or generate reports containing SPAs, you may fall into a different category.
If none of these exemptions apply, proceed to Step 2.
Step 2: Map Information Flows
Create a table with columns: Service Provided | Data Received | Data Stored | Data Transmitted | Classification.
For each service, document what information enters your environment. Examples:
- Help Desk Ticketing: Client submits tickets describing technical issues. Do descriptions reference CUI? Are screenshots attached? Where are tickets stored?
- Backup Services: You store encrypted copies of client data. Even encrypted CUI requires CMMC controls. Where are backups stored? Who can access them?
- Network Monitoring: You collect firewall logs, SIEM data, or NetFlow records. These are SPAs if they relate to systems processing CUI.
- Cloud Management: You operate a GCC High tenant or manage Azure Government resources for clients. CUI definitely exists in this scenario.
Classify each information type as FCI, CUI, SPA, or none of the above.
Step 3: Determine Your Scoping Outcome
Based on your information flow map, you'll land in one of three scenarios:
Scenario A: No Sensitive Information: You provide services that don't involve FCI, CUI, or SPAs. Your technicians troubleshoot hardware on-site but don't access systems containing sensitive data. You're out of scope for CMMC. Document this determination and provide it to clients who ask.
Scenario B: SPAs Only: You generate or access SPAs but not FCI or CUI directly. You provide firewall logs to clients or operate a SIEM monitoring their environment. You're part of your client's assessment scope, not your own. Prepare to provide:
- Service descriptions documenting SPAs you generate
- Access control matrices showing who on your team can access client environments
- Configuration documentation for tools generating SPAs
- Change management records for those tools
Create a standard evidence package for any client undergoing assessment.
Scenario C: FCI or CUI in Your Systems: You store, process, or transmit FCI or CUI. You need your own CMMC certification, typically Level 2. Move to Step 4.
Step 4: Implement CMMC Controls (If Required)
If you're in Scenario C, you're facing a full CMMC implementation. Start with NIST SP 800-171 as your baseline, since CMMC Level 2 maps to those 110 controls.
Define your assessment scope boundary, including:
- Systems storing, processing, or transmitting CUI
- Systems protecting CUI (firewalls, authentication servers, monitoring tools)
- Personnel accessing those systems
- Physical locations where those systems reside
Everything outside this boundary must be demonstrably separated. If you serve both DoD and commercial clients, segment your infrastructure so CUI never touches commercial systems.
Implement the 14 NIST SP 800-171 control families. Prioritize access control, incident response, and system and communications protection. These are often deficient in assessments.
Document everything. CMMC assessments are evidence-based. For every control, you need policies, procedures, configurations, and proof of operation. Store this in a centralized repository your assessor can access.
Engage a Registered Practitioner for a gap assessment before your formal assessment. This identifies deficiencies while you can still fix them.
Validation: How to Verify It Works
Once you've determined your scoping outcome and implemented any required controls, validate your work:
For Scenario A (Out of Scope): Review contracts with clients. Confirm none contain CMMC flow-down clauses. If a client asks for CMMC certification, point to your documented scoping determination. If they disagree, revisit your information flow analysis with them.
For Scenario B (Client Scope): Request a meeting with your largest DoD client's compliance team. Walk them through the SPAs you provide and the evidence package you've prepared. Ask if they need additional documentation. Use this as a template for other clients.
For Scenario C (Full CMMC Required): Schedule a readiness assessment with a C3PAO. They'll review your System Security Plan, test a sample of controls, and identify gaps. Expect to iterate. First assessments rarely find zero deficiencies. Budget three to six months between readiness assessment and formal assessment to address findings.
Test your evidence collection process. Can you produce the last 90 days of access logs within one business day? Can you demonstrate that multi-factor authentication is enforced for all privileged accounts? Assessors will request evidence with short turnaround times.
Maintenance: Ongoing Tasks
CMMC isn't a one-time checkpoint. If you achieved certification, you'll face reassessment every three years. Between assessments:
Quarterly Control Testing: Sample a subset of controls each quarter. Rotate through all 110 controls over the three-year period. Document test results. This catches drift before it becomes a finding.
Contract Review Process: Every time you sign a new DoD-adjacent contract, run it through your scoping framework. Information flows change. A new service might introduce CUI into your environment for the first time.
Change Management Discipline: Every infrastructure change must be evaluated for CMMC impact. Adding a new backup system? It's in scope. Migrating to a new ticketing platform? Confirm it can enforce access controls and audit logging.
Client Communication: If you're in Scenario B, notify clients when you make changes to systems generating their SPAs. They need to update their own System Security Plans to reflect current architecture.
Training Updates: CMMC requirements evolve. The Cyber-AB publishes clarifications and guidance updates. Subscribe to their announcements. Assign someone to monitor changes and assess impact on your scope determination.
For organizations in Scenario C, maintain your Plan of Action and Milestones. If you accepted risk on any controls during assessment, those POA&Ms have deadlines. Miss them and you're non-compliant.
Build a calendar with these recurring tasks. CMMC compliance is operational discipline, not a project with an end date.
