CMMC Compliance for Defense Contractors: What You Need to Know in 2025
Published: February 9, 2025 | Reading Time: 8 minutes
If you're a defense contractor handling Controlled Unclassified Information (CUI), CMMC compliance isn't optional—it's a contract requirement. The Department of Defense (DoD) has made it clear: no CMMC certification means no contract awards.
But many small and mid-sized defense contractors are confused about what CMMC actually requires, how much it costs, and where to start. This guide breaks down everything you need to know.
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is a unified cybersecurity standard created by the DoD to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) in the defense industrial base supply chain.
Unlike previous self-certification approaches, CMMC requires third-party assessment and certification for certain contract levels. You can't just attest compliance—you must prove it to an authorized assessor.
The Three CMMC Levels
CMMC Level 1: Foundational
- Requirements: 17 practices from NIST 800-171
- Assessment: Annual self-assessment (no third-party required)
- Applies to: Contractors handling only Federal Contract Information (FCI)
- Think: Basic cybersecurity hygiene
CMMC Level 2: Advanced
- Requirements: All 110 practices from NIST 800-171
- Assessment: Third-party certification required for certain contracts
- Applies to: Most contractors handling CUI
- Think: Comprehensive security controls
CMMC Level 3: Expert
- Requirements: 110 NIST 800-171 practices + additional NIST 800-172 controls
- Assessment: Government-led assessment
- Applies to: Contractors working on critical national security programs
- Think: Nation-state threat protection
Most defense contractors will need CMMC Level 2.
How CMMC Differs from NIST 800-171 Self-Assessment
If you've been self-certifying compliance with NIST 800-171 through the Supplier Performance Risk System (SPRS), CMMC changes everything:
| Old Way (NIST 800-171 Self-Cert) | New Way (CMMC) |
|---|---|
| Self-assessment | Third-party certification (Level 2+) |
| Honor system | Proof required |
| Submit score to SPRS | Certificate required for contract award |
| No documentation verification | Assessor reviews all evidence |
| Spotty enforcement | Contract requirement—no cert, no award |
The stakes are higher. Contractors who previously submitted inflated SPRS scores without actually implementing controls will fail CMMC assessments.
The 17 Domains of CMMC Level 2 (NIST 800-171)
CMMC Level 2 requires implementation of controls across 17 security domains. Here's what you're actually implementing:
1. Access Control (AC) - 22 practices
Who can access what data, when, and from where? This includes:
- User accounts and password policies
- Multi-factor authentication (MFA)
- Session locks and timeouts
- Privileged access management
- Remote access controls
Common gaps: No MFA, shared accounts, unchanged default passwords, no session timeouts
2. Awareness and Training (AT) - 3 practices
Security training for your workforce:
- Annual security awareness training
- Insider threat awareness
- Role-based training for IT staff
Common gaps: No documented training program, no records of completion
3. Audit and Accountability (AU) - 9 practices
Logging who did what, when:
- Event logging on all systems handling CUI
- Log review and analysis
- Audit record retention
- Protection of audit logs from tampering
Common gaps: No centralized logging, logs not reviewed, insufficient retention
4. Configuration Management (CM) - 9 practices
Establishing secure baseline configurations:
- Security configuration baselines for all systems
- Change control process
- Least functionality principle
- Monitoring for unauthorized changes
Common gaps: Default configurations still in use, no change management process
5. Identification and Authentication (IA) - 11 practices
Verifying users are who they claim to be:
- Unique user identifiers (no shared accounts)
- Multi-factor authentication for network and remote access
- Password complexity and rotation requirements
- Authenticator management
Common gaps: Shared admin accounts, weak passwords, no MFA
6. Incident Response (IR) - 3 practices
Detecting and responding to security incidents:
- Incident response plan
- Incident tracking and documentation
- Incident response testing
Common gaps: No documented IR plan, no testing/tabletops conducted
7. Maintenance (MA) - 6 practices
Maintaining systems securely:
- Scheduled and documented maintenance
- Remote maintenance security
- Maintenance tool controls
Common gaps: No maintenance logs, unsecured remote maintenance tools
8. Media Protection (MP) - 9 practices
Protecting data on physical media and during disposal:
- Media marking and labeling (CUI identification)
- Media storage and transport controls
- Sanitization before disposal or reuse
Common gaps: CUI not marked, USB drives not encrypted, old hard drives not wiped
9. Personnel Security (PS) - 2 practices
Screening and termination procedures:
- Personnel screening for positions with CUI access
- Termination procedures (access revocation)
Common gaps: No background checks, delayed access termination
10. Physical Protection (PE) - 6 practices
Controlling physical access to facilities and systems:
- Physical access authorizations and controls
- Visitor management and escort procedures
- Alternate work site controls (remote work)
Common gaps: No visitor logs, unsecured server rooms, no controls for remote workers
11. Risk Assessment (RA) - 3 practices
Identifying and assessing risks:
- Documented risk assessment process
- Regular vulnerability scanning
- Risk assessment updates
Common gaps: No documented risk assessment, scans not conducted
12. Security Assessment (CA) - 8 practices
Testing security controls:
- Security control assessments
- Plan of Action and Milestones (POA&M) for gaps
- Continuous monitoring
Common gaps: Controls never tested, no POA&M, no ongoing monitoring
13. System and Communications Protection (SC) - 15 practices
Protecting data in transit and at rest:
- Encryption of CUI at rest and in transit
- Network segmentation (CUI boundary)
- Boundary protection (firewalls)
- Secure communications (VPN for remote access)
Common gaps: CUI not encrypted, flat networks, no network segmentation
14. System and Information Integrity (SI) - 7 practices
Protecting against malware and vulnerabilities:
- Malware protection on all systems
- Vulnerability remediation
- Security alerts and monitoring
- Spam and malicious code protection
Common gaps: No endpoint protection, patches not applied, no vulnerability scanning
15. System Development and Maintenance (SD) - Not in base 110
(Only applies to organizations developing software for DoD)
16. Situational Awareness (SA) - Not in base 110
(Only applies to Level 3)
17. Recovery (RE) - Not in base 110
(Covered under other domains in NIST 800-171)
The CMMC Assessment Process
Here's what actually happens during a CMMC Level 2 assessment:
Phase 1: Pre-Assessment Preparation (2-6 months before)
Your responsibility:
- Define your CUI boundary (which systems touch CUI)
- Implement all 110 NIST 800-171 practices
- Document everything (policies, procedures, configurations)
- Develop your System Security Plan (SSP)
- Conduct gap analysis and remediate deficiencies
- Create evidence collection (screenshots, logs, configs)
Cost: $20K-$100K+ depending on current state
Phase 2: Assessment Scheduling (1-2 months before)
- Engage a CMMC Third-Party Assessment Organization (C3PAO)
- Define scope of assessment
- Schedule assessment dates
- Submit documentation package to assessor
Cost: $15K-$40K+ for C3PAO assessment fees
Phase 3: Assessment Execution (3-5 days)
The C3PAO assessor will:
- Review your System Security Plan (SSP)
- Interview personnel (IT staff, management, end users)
- Examine technical configurations
- Review evidence for all 110 practices
- Test controls (e.g., verify MFA actually works)
- Document findings
You must demonstrate: Every single practice is implemented and functioning
Phase 4: Results and Certification (2-4 weeks after)
- Pass: Receive CMMC certification valid for 3 years
- Conditional Pass: Minor gaps, 180 days to remediate
- Fail: Significant gaps, no certification until remediated and re-assessed
Certification is uploaded to the CMMC Marketplace and required for contract awards.
Common CMMC Failures: Why Contractors Don't Pass
Based on assessments we've supported, here are the most common reasons contractors fail:
1. Inadequate Documentation
You implemented controls but can't prove it. No policies, no procedures, no evidence.
Fix: Document everything. If it's not written down, it doesn't exist to an assessor.
2. Scope Creep (CUI Everywhere)
CUI is scattered across your entire network, making the entire company in-scope.
Fix: Segment your network. Create a CUI enclave with strict boundary controls.
3. Missing Multi-Factor Authentication
Single biggest failure point. CMMC requires MFA for network access and remote access.
Fix: Implement MFA organization-wide. Microsoft 365 MFA is included in most licenses.
4. Unencrypted CUI
CUI stored on laptops, file shares, or cloud storage without encryption.
Fix: Encrypt all CUI at rest. Use BitLocker, Azure Information Protection, or similar.
5. No Logging or Monitoring
No audit logs, no one reviewing them, or logs not retained long enough.
Fix: Enable logging on all systems. Centralize logs. Review them quarterly minimum.
6. Outdated System Security Plan (SSP)
SSP doesn't match actual environment, or is clearly a template someone filled out generically.
Fix: Your SSP must accurately describe YOUR environment, not a generic template.
7. Verbal-Only Policies
"We do security awareness training" but no documentation, no sign-off sheets, no curriculum.
Fix: Formalize everything. Create documented policies and track completion.
8. Delayed Patch Management
Critical vulnerabilities not patched within required timeframes.
Fix: Implement patch management process. Document exceptions with POA&M.
9. Shared Accounts
Generic "admin" accounts, shared service accounts, or former employee accounts still active.
Fix: Every person gets unique credentials. Disable accounts same day as termination.
10. No Incident Response Plan
No documented IR plan, or a plan that's never been tested.
Fix: Create IR plan. Conduct annual tabletop exercise. Document the results.
How Much Does CMMC Compliance Cost?
Here's the realistic cost breakdown for a typical small defense contractor (20-50 employees):
Initial Implementation: $30K-$150K
- Gap assessment: $5K-$15K
Technical implementation: $15K-$80K
- Network segmentation
- MFA deployment
- Encryption implementation
- Logging and monitoring tools
- Endpoint protection
- Documentation and SSP: $5K-$20K
- Policy development: $3K-$10K
- Security awareness training: $2K-$5K
- Remediation and testing: $5K-$20K
C3PAO Assessment: $15K-$40K
- Assessment fees vary by organization size and complexity
- More systems in scope = higher cost
- Complex environments = longer assessments
Ongoing Compliance: $24K-$96K/year
- Continuous monitoring: $1K-$4K/month
- Annual risk assessments: $5K-$15K/year
- Quarterly compliance reviews: $2K-$5K/quarter
- Tool subscriptions: $3K-$12K/year (logging, EDR, SIEM)
- Annual security training: $2K-$5K/year
- Re-certification (every 3 years): $15K-$40K
Ways to Reduce Costs:
- Reduce scope: Isolate CUI to fewer systems
- Leverage existing tools: Microsoft 365 E5 includes many required security features
- Phased approach: Implement high-priority controls first, POA&M the rest
- Fractional vCISO: Get expert guidance without hiring full-time ($3K-$8K/month vs. $150K-$250K salary)
CMMC Timeline: How Long Does It Take?
For a typical small contractor starting from scratch:
Month 1-2: Discovery and Planning
- Gap assessment
- Scope definition
- Budgeting and resource allocation
- Tool selection
Month 3-5: Implementation
- Network segmentation
- Technical controls deployment
- Policy and procedure documentation
- System Security Plan development
Month 6: Testing and Remediation
- Internal assessment
- Gap remediation
- Evidence collection
- Pre-assessment review
Month 7: C3PAO Assessment
- Schedule assessment
- Assessor review
- Assessment execution
- Remediation of findings (if needed)
Month 8: Certification
- Receive certification
- Upload to CMMC Marketplace
- Eligible for contract awards
Total: 6-8 months for most organizations
Larger or more complex organizations may need 9-12 months.
CMMC and Your Existing Contracts
Important: CMMC won't be retroactively applied to existing contracts, but it WILL be required for:
- New contract awards
- Contract renewals
- Contract modifications (in some cases)
Check your solicitation: The RFP will specify required CMMC level. If you don't have certification when the contract is awarded, you won't be eligible.
Do I Really Need CMMC Level 2?
You need CMMC Level 2 if:
- You handle Controlled Unclassified Information (CUI) from DoD
- Your contracts include DFARS clause 252.204-7012
- You process, store, or transmit CUI on your systems or networks
You might only need CMMC Level 1 if:
- You only handle Federal Contract Information (FCI), not CUI
- Your contracts don't specify CUI handling
How to know: Check your contracts. If you see "CUI" or DFARS 252.204-7012, you need Level 2.
When in doubt, assume Level 2. Most defense contractors handling technical data, specifications, or sensitive procurement information are dealing with CUI.
Getting Started with CMMC: Your Action Plan
Step 1: Determine Your Level (Week 1)
- Review current and planned contracts
- Identify CUI vs. FCI handling
- Confirm required CMMC level
Step 2: Conduct Gap Assessment (Weeks 2-4)
- Hire a CMMC consultant or C3PAO for assessment
- Identify current compliance level
- Prioritize gaps by risk and cost
Step 3: Define Your Scope (Weeks 3-5)
- Map all systems that touch CUI
- Decide: segment network or make everything compliant?
- Define your CUI boundary
Step 4: Develop Remediation Plan (Weeks 5-6)
- Create implementation roadmap
- Budget for tools, services, and assessment
- Get executive buy-in and resource allocation
Step 5: Implement Controls (Months 2-5)
- Deploy technical controls systematically
- Document policies and procedures
- Train your workforce
- Develop System Security Plan (SSP)
Step 6: Internal Testing (Month 6)
- Conduct internal assessment
- Collect evidence for all 110 practices
- Remediate identified gaps
- Update documentation
Step 7: Schedule C3PAO Assessment (Month 7)
- Engage certified C3PAO
- Submit documentation package
- Undergo formal assessment
- Address any findings
Step 8: Achieve Certification (Month 8)
- Receive CMMC certificate
- Upload to CMMC Marketplace
- Maintain ongoing compliance
Common CMMC Myths Debunked
Myth #1: "We're too small to need CMMC" Reality: Size doesn't matter. If you handle CUI, you need CMMC. Period.
Myth #2: "We can self-certify like before" Reality: Level 2 requires third-party certification. Self-assessment doesn't count.
Myth #3: "Cloud providers make us compliant" Reality: You're still responsible for access controls, policies, and configurations even in the cloud.
Myth #4: "CMMC is just like NIST 800-171" Reality: CMMC includes NIST 800-171 but adds assessment rigor and proof requirements.
Myth #5: "We'll just lose CUI contracts" Reality: Losing DoD contracts means losing your business. CMMC isn't optional.
Myth #6: "We can rush certification in 30 days" Reality: Realistic timeline is 6-8 months minimum. Rushing leads to failure.
Myth #7: "Our IT guy can handle this" Reality: CMMC requires specialized expertise in compliance frameworks and security controls.
Why Work with a CMMC Consultant?
You can attempt CMMC on your own, but here's what you're up against:
- 110 technical controls to implement
- 1000+ pages of NIST guidance to interpret
- Complex System Security Plan to develop
- Evidence collection for every practice
- Risk of failing expensive C3PAO assessment
A CMMC consultant provides:
- Gap assessment: Know exactly where you stand today
- Roadmap: Prioritized plan with timeline and budget
- Implementation guidance: How to actually configure the controls
- Documentation: Policies, procedures, SSP developed for your environment
- Pre-assessment: Internal testing before expensive C3PAO assessment
- Assessment support: Guide you through the C3PAO process
ROI of using a consultant:
- Avoid failed assessments ($15K-$40K re-assessment fee)
- Faster time to compliance (6 months vs. 12+ months)
- Correct implementation the first time
- Maintained eligibility for contract awards
- Reduced compliance costs through proper scoping
Next Steps: Get Your CMMC Roadmap
CMMC compliance is complex, but it's achievable with the right approach.
At SekuirTek, we specialize in helping small and mid-sized defense contractors achieve CMMC Level 2 certification. Our governance-first approach ensures you don't just pass the assessment—you build a sustainable security program that protects your business and satisfies ongoing compliance requirements.
Our CMMC services include:
- Comprehensive gap assessments with prioritized roadmaps
- NIST 800-171 implementation and technical configuration
- System Security Plan (SSP) development
- Policy and procedure documentation
- Microsoft 365 security hardening for CMMC
- Evidence collection and pre-assessment testing
- C3PAO coordination and assessment support
- Ongoing compliance monitoring and annual reviews
Ready to start your CMMC journey?
Schedule Your Free CMMC Consultation →
We'll assess your current state, clarify your requirements, and provide a realistic roadmap with timeline and budget.
Additional Resources
Official CMMC Resources:
Related SekuirTek Resources:
Have questions about CMMC compliance? Contact our team for expert guidance tailored to your organization.
About the Author
SekuirTek LLC provides enterprise-grade cybersecurity, compliance, and IT risk management solutions for defense contractors, healthcare providers, and professional services firms. Our security professionals help organizations achieve and maintain CMMC compliance while building defensible security programs that satisfy auditors and protect sensitive data.
Keywords: CMMC compliance, CMMC Level 2, NIST 800-171, defense contractor cybersecurity, CMMC assessment, CMMC cost, CMMC certification, defense industrial base, controlled unclassified information, CUI protection, DFARS compliance, C3PAO assessment, System Security Plan, CMMC requirements 2025Start writing here...