Do I need CMMC certification?

You need CMMC Level 2 certification if your DoD contracts contain DFARS clause 252.204-7012 and your work involves handling Controlled Unclassified Information (CUI). This applies to both prime contractors and subcontractors working with defense primes like Lockheed Martin, Raytheon, Boeing, and L3Harris.

What is DFARS clause 252.204-7012?

DFARS 252.204-7012, titled Safeguarding Covered Defense Information, is a Defense Federal Acquisition Regulation Supplement clause that triggers CMMC requirements. If it appears in your contract, you must implement adequate security for covered defense information, report cyber incidents within 72 hours, preserve images of compromised systems, and use FedRAMP Moderate or equivalent cloud services.

What is Controlled Unclassified Information (CUI)?

CUI is government-created or government-owned information requiring protection under Executive Order 13556. It includes technical specifications and drawings, export-controlled data (EAR/ITAR), proprietary business information submitted to the government, and personally identifiable information in federal systems. If you receive technical documents, drawings, or program data from your government customer, you likely handle CUI.

What does a CMMC compliance foundation include?

A CMMC compliance foundation includes a System Security Plan (SSP) documenting how your organization implements each of the 110 NIST 800-171 controls, a gap assessment identifying missing controls, a Supplier Performance Risk System (SPRS) score, written security policies, security awareness training, and multi-factor authentication deployed across the organization.

What is a CUI boundary?

A CUI boundary defines every system, application, and network component that processes, stores, or transmits Controlled Unclassified Information. This includes email servers, file storage, collaboration tools, endpoints, and any connected systems. Defining the CUI boundary is the foundational step in CMMC compliance - everything else flows from knowing exactly where CUI lives and how it flows.

Can I use regular Microsoft 365 or Gmail for CUI?

No. Standard commercial email services including Gmail, Microsoft 365 commercial, and Outlook.com are not authorized to transmit CUI. CMMC requires email that meets FedRAMP Moderate or equivalent security controls. Compliant options include Microsoft 365 GCC High or an enclave-based email solution like StormCloud Gov by Security Centric.

What if my CUI exists in physical form - printed drawings or specs?

Physical CUI requires documented handling procedures under NIST 800-171 control family MP (Media Protection). This includes marking requirements, secure storage, controlled access, transport procedures, and sanitization or destruction processes. Physical CUI controls are separate from your digital enclave and must be addressed in your System Security Plan.

What if I need to share CUI with subcontractors or customers?

CUI shared with external parties must be transmitted through compliant channels - encrypted email via GCC High or an authorized enclave, or secure file transfer. Plain email, consumer file sharing (Dropbox, Google Drive), and USB drives are not compliant. You also have flow-down obligations requiring subcontractors who receive CUI to meet the same CMMC requirements.

How does CMMC apply to OT and manufacturing systems?

Operational Technology (OT) and Industrial Control Systems (ICS) that process or store CUI - including CNC machines, PLCs, and SCADA systems - fall within CMMC scope. Common strategies include air-gapping shop floor systems from the CUI enclave, or designing a controlled interface with documented access controls. Boundary design for OT environments requires careful scoping to avoid disrupting manufacturing operations.

Do remote workers affect CMMC compliance?

Yes. Remote workers who access CUI systems bring their endpoints into scope. CMMC requires endpoint security controls, multi-factor authentication, and session monitoring for all remote access. Each remote device must meet configuration requirements or access must be provided through a compliant virtual desktop environment like StormCloud Gov.

Do my IT vendors or subcontractors need to be CMMC compliant?

Any vendor or subcontractor with access to your CUI systems or data has CMMC implications. Managed service providers with administrative access to your environment may need to meet CMMC requirements themselves, or their access must be strictly controlled and monitored. Subcontractors who receive CUI from you have flow-down obligations requiring their own CMMC compliance.

How long does CMMC Level 2 certification take?

With the CMMC Ninety program, the typical path from engagement to certification is 6 to 12 months. The timeline depends on your existing compliance foundation, CUI boundary complexity, number of users and locations, and whether OT/ICS systems or complex vendor relationships are in scope. Organizations starting from scratch typically need 9-12 months; those with existing NIST 800-171 work may achieve certification in 6 months.

What is the CMMC Ninety program?

CMMC Ninety is a three-partner program combining Simpatico Systems (compliance consulting and program management), Security Centric (StormCloud Gov hosted enclave with 90 inherited controls), and Vaultes (certified C3PAO assessor). The program delivers end-to-end CMMC Level 2 certification covering all 110 NIST SP 800-171 controls without requiring infrastructure investment from the client.

CMMC Readiness Assessment

Are You Ready for CMMC?
Let's Find Out.

Answer a few questions and we'll tell you exactly where you stand. No fluff, no sales pressure. Takes about 5 minutes.

Your Progress 0%

Are You Ready for CMMC?
Let's Find Out.

Copyright 2024 Simpatico.com

Request A Quote

Fill out the following form for a free quote

Are You Ready for CMMC?Let's Find Out.

Are You Ready for CMMC?
Let's Find Out.