CMMC for small shops

What CMMC is

The Cybersecurity Maturity Model Certification, CMMC, is a Department of Defense program that verifies contractors meet a set of cybersecurity requirements before they can hold contracts that involve sensitive information. It is run by the DoD Chief Information Officer. The current version has three levels, and the level required is written into each contract.

The program exists because earlier rules relied on contractors to say they were compliant. CMMC adds assessment. Depending on the level and the contract, that assessment is a self-assessment you affirm, or an assessment by an authorized third party, or an assessment by the government.

CMMC does not invent new security requirements. It checks whether you meet requirements that already exist in the FAR and DFARS. That is why two other names come up every time someone mentions it.

Why DFARS 252.204-7012 and NIST SP 800-171 come up

DFARS clause 252.204-7012 has been in defense contracts for years. It requires a contractor that handles covered defense information to protect it according to a standard from the National Institute of Standards and Technology, NIST Special Publication 800-171, and to report cyber incidents to the Department of Defense quickly. If a clause on an order says 7012, you have already agreed to meet 800-171.

NIST SP 800-171 is a list of security requirements for protecting controlled unclassified information, CUI, on non-federal systems. It covers things like access control, identification and authentication, audit logs, configuration management, incident response, media protection, physical protection, and system integrity. Each requirement is short. The work is in doing all of them and proving it.

Two more DFARS clauses, 252.204-7019 and 7020, require you to score yourself against 800-171 and post that score in a government system before award. CMMC Level 2 is essentially an assessed version of the same standard. So the chain is: 7012 requires 800-171, 7019 and 7020 require a score, and CMMC checks the score is real.

Which level a shop needs

The question is what information you handle. If your only federal data is purchase orders, invoices, and unclassified commercial drawings, you are likely a Level 1 shop. If you receive export controlled or distribution restricted technical data, which describes most military parts drawings, that data is generally CUI, and Level 2 is the likely requirement.

The solicitation or the prime's purchase order will state the level. Primes are required to flow the requirement down to subcontractors that will handle CUI, so expect supplier surveys to ask about your CMMC status and your 800-171 score.

If you are unsure whether a given drawing is CUI, ask the customer. Do not assume it is not.

A practical path for a small shop

The most useful decision a small shop can make is to shrink the problem. You do not have to bring every computer, phone, and machine controller up to the standard. You have to protect the systems where CUI lives. If CUI lives on two workstations in an office, a file server, and a CNC programming machine, that is your scope.

Getting help without losing control

Most small shops use an outside managed service provider or a consultant for part of this. That is reasonable. Two cautions. First, the requirements are yours, and your executive signs the affirmation. Understand what the provider did and keep the documents in your own hands. Second, a provider that touches your CUI may be inside your assessment scope, so ask how they meet the standard themselves.

Costs vary widely with scope, so we do not quote figures here. Shrinking the scope is the single biggest lever you have. Regional manufacturing extension partnerships and APEX Accelerators, the counseling offices that replaced the old procurement technical assistance centers, offer low cost guidance on getting started.