Current: Phase II suspended July 13, 2026. Phase I self-assessment requirements remain.Read the update →

Read the rule. Map the system. Keep the proof.

CMMC field guides

Practical articles for defense contractors, organized around the questions that cause real scope, evidence, proposal, and assessment problems. Updated for the July 2026 CMMC program change.

Current StatusCMMC LevelsSPRS & AwardsNIST 800-171DFARSCloud & ScopeContract TriageScopingService ProvidersAssessment PrepTemplatesSupply ChainCUI HandlingCost & Process

CMMC Phase II suspension update showing Phase II paused on July 13, 2026 while Phase I self-assessment requirements remain in place

Current Status

CMMC Phase II Suspension: What Changed on July 13, 2026?

A plain-English guide to the July 2026 suspension of CMMC Phase II, what Phase I still requires, and what defense contractors should keep doing now.

Illustration comparing CMMC Level 1 and Level 2 Self requirements as two stacked blocks, framed as self-assessment not certification.

Current Status

CMMC Phase I in 2026: Self-Assessment Requirements

What Phase I means after the 2026 policy change, with a practical checklist for self-assessment, affirmation, SPRS, and award readiness.

Illustration of a pinned checklist notepad with five checked safeguarding items for CMMC Level 1.

CMMC Levels

CMMC Level 1 Checklist for Small Defense Contractors

A focused Level 1 checklist for contractors handling FCI, based on the 15 FAR 52.204-21 safeguarding requirements and current CMMC self-assessment logic.

Illustration of a circular badge showing 110 controls with a three-year tag, representing CMMC Level 2 self-assessment.

CMMC Levels

CMMC Level 2 Self-Assessment: A Practical 2026 Guide

How Level 2 self-assessment works, what to scope, how to build evidence, and why current contract language matters in 2026.

Illustration comparing a self-assessment card and a C3PAO assessment card side by side.

CMMC Levels

CMMC Level 2 C3PAO vs Self-Assessment: The 2026 Difference

Compare Level 2 Self and Level 2 C3PAO without relying on outdated rollout assumptions after the 2026 Phase II suspension.

Illustration of a nested folder showing CUI data inside a larger FCI folder, representing the data-first CMMC level decision.

CMMC Levels

CMMC Levels Explained: FCI vs CUI Decision Guide

A data-first way to understand CMMC Level 1 and Level 2 by separating FCI from CUI before choosing controls, tools, or assessors.

Illustration of an ID badge with a barcode and system icon representing a CMMC Unique Identifier.

SPRS & Awards

CMMC UID Explained: Where It Comes From and When You Need It

A CMMC UID is the unique identifier tied to your assessed system's status record. Here's where it comes from, how to find yours, and when a solicitation requires one.

Illustration of a torn desk calendar with a clock and award rosette, representing CMMC status currency before contract award.

SPRS & Awards

SPRS CMMC Status: What Must Be Current Before Award

How current CMMC status, affirmations, and SPRS records connect to award eligibility when a solicitation includes CMMC requirements.

Illustration of two overlapping document pages labeled Rev. 2 and Rev. 3, fanned out like a hand of cards.

NIST 800-171

NIST SP 800-171 Rev. 2 vs Rev. 3 for CMMC in 2026

Why NIST Rev. 3 is final while CMMC work can still depend on Rev. 2, and how to avoid mixing assessment baselines.

Illustration of a clock face with three tick marks representing the three-year Basic Assessment currency rule.

NIST 800-171

NIST 800-171 DoD Basic Assessment: What the Three-Year Rule Means

A practical explanation of the current NIST SP 800-171 DoD Basic Assessment requirement, SPRS record, and three-year currency rule.

Illustration of a vertical gauge with top, middle, and bottom segments representing SPRS score currency status.

SPRS & Awards

SPRS Score Expiration: Is Your NIST 800-171 Assessment Current?

A bid-readiness workflow for checking NIST SP 800-171 assessment currency in SPRS before proposals, options, and extensions.

An open wooden toolbox with four labeled trays — Safeguard, Report, Cloud, and Flow Down — illustrating the four duties bundled inside DFARS 252.204-7012.

DFARS

DFARS 252.204-7012 Explained for Small Defense Contractors

A small-business guide to safeguarding covered defense information, NIST requirements, cloud use, incident reporting, evidence preservation, and flowdown.

An hourglass marked 72 with red sand pouring through, beside a half-filled paper incident report form, illustrating the DFARS 252.204-7012 72-hour reporting clock.

DFARS

72-Hour Cyber Incident Reporting Under DFARS 252.204-7012

What the 72-hour reporting clock means, what to prepare before an incident, and how evidence preservation affects the response process.

A balance scale weighing a cloud-server icon against a FedRAMP Moderate seal badge, illustrating FedRAMP Moderate equivalency for CUI cloud services.

Cloud & Scope

FedRAMP Moderate Equivalency for CUI Cloud Services

A source-first explanation of the DFARS cloud requirement when an external provider stores, processes, or transmits covered defense information.

A signed certificate beside a dial gauge with a needle pointing between Level 1, Level 2, and Level 3, illustrating the CMMC level requirement in DFARS 252.204-7021.

DFARS

DFARS 252.204-7021: CMMC Status, Affirmation & Flowdown

Read the CMMC contract clause as an operational checklist: current status, affirmation, system boundaries, POA&M closeout, and subcontractor handling.

An opened envelope with a notice card and a UID barcode tag, illustrating the DFARS 252.204-7025 solicitation notice of CMMC level requirements.

DFARS

DFARS 252.204-7025: Reading CMMC Requirements in a Solicitation

How to read 252.204-7025 for the required level, SPRS status, affirmations, conditional status, and CMMC UIDs before bidding.

A cardboard shipping box stamped COTS and Exempt sitting outside a dashed boundary line labeled DFARS Clauses, illustrating the COTS-only exception.

Contract Triage

COTS Exception: When CMMC and DFARS Cyber Clauses May Not Apply

How the COTS-only exception works, why 'commercial' is not automatically 'COTS,' and what to verify before excluding cybersecurity clauses.

A corkboard with pinned system icons circled by a red lasso string, with one printer icon left outside the loop and tagged OUT, illustrating CUI scoping boundaries.

Scoping

CUI Scoping: What Belongs in the CMMC Assessment Boundary?

A practical method to scope systems that process, store, transmit, or protect CUI without turning the entire company network into the assessment boundary.

A hand-drawn office floor plan with one small inner room shaded teal and labeled Enclave, showing a narrowed assessment boundary inside a larger office.

Scoping

CMMC Enclave for Small Business: When Narrowing Scope Helps

How a CUI enclave can reduce assessment complexity, what it does not solve, and which hidden dependencies often pull systems back into scope.

A home office inside a small house icon connected by a locked dashed tunnel to a company office building, illustrating remote access obligations for CUI.

Scoping

Remote Workers and CMMC: Laptops, Home Offices, and CUI

What remote work changes in a CMMC environment: endpoints, local storage, printing, networking, support, physical exposure, and evidence.

A smartphone screen split diagonally between personal photos and a locked work folder, illustrating the BYOD line between personal use and CUI access.

Scoping

BYOD and CMMC: Why Personal Devices Complicate Scope

Why bring-your-own-device access creates CUI scope and evidence problems, plus safer patterns for small contractors that need flexibility.

A multifunction printer with a cutaway panel revealing a hidden internal hard-drive chip, illustrating overlooked CUI storage inside printers and scanners.

Scoping

Printers, Scanners, and MFDs in a CMMC Environment

How printers and multifunction devices can process or store CUI, plus the configuration and evidence questions teams often miss.

An open bank-vault door with backup drives and a tape cartridge stacked on shelves inside, illustrating that CUI backups stay in the assessment boundary.

Scoping

Backups and CMMC: CUI Copies, Restoration, and Assessment Scope

Why backups can silently expand CUI scope and how to document storage, encryption, access, retention, restoration, and provider responsibilities.

A service-counter window labeled External Service Provider, with a key being handed through between two hands, illustrating MSP and MSSP obligations in CMMC scope.

Service Providers

MSPs, MSSPs, and External Service Providers in CMMC Scope

How to analyze managed service providers that administer, monitor, back up, or secure a CUI environment without assuming outsourcing transfers responsibility.

Papercraft illustration of two boxes inside one shared boundary line, one holding CUI document assets and the other holding shield, firewall, and padlock icons representing security protection assets.

Scoping

Security Protection Assets vs CUI Assets in CMMC Scoping

Separate the systems that hold CUI from the systems that protect them, with practical examples for identity, logging, EDR, firewalls, and management tools.

An open ledger book with an Open column of red circles and a Closed column of green checkmarks, illustrating CMMC POA&M rules for what can be deferred.

Assessment Prep

CMMC POA&M Rules: What Can and Cannot Be Deferred

How to think about CMMC plans of action and milestones, conditional status, non-deferrable gaps, and the evidence needed for closeout.

Papercraft hourglass marked 180 with small POA&M checklist tags falling through it like sand, illustrating the 180-day Conditional CMMC status closeout window.

Assessment Prep

CMMC Conditional Status: Planning the 180-Day Closeout

A project plan for organizations that receive Conditional CMMC status and need to close eligible POA&M items within the program window.

An unrolled paper scroll marked with numbered flags pointing to labeled requirement families, illustrating an SSP built as an evidence map rather than a novel.

Assessment Prep

NIST 800-171 SSP: Build an Evidence Map, Not a Novel

How to turn an SSP into a usable system description that connects scope, requirements, implementation owners, and evidence.

A leaning stack of file folders each stamped with a checkmark, topped by a checklist clipboard, illustrating an evidence system for NIST SP 800-171 assessment prep.

Assessment Prep

NIST 800-171 Evidence Checklist for Assessment Prep

A practical evidence system for policies, configuration, logs, tickets, interviews, and observations—organized by requirement and owner.

An open wooden card-catalog drawer with an index card pulled out showing Name, Type, and Location fields, illustrating a CUI asset inventory template.

Templates

CUI Asset Inventory Template: Fields That Actually Matter

The columns a small contractor needs to understand CUI scope, ownership, location, security role, data flow, and assessment status.

A ring binder viewed from the spine with a fan of colorful lettered tab dividers, illustrating an organized CMMC evidence index.

Templates

CMMC Evidence Index: Organize Policies, Logs, Tickets & Proof

A lightweight evidence-index design that lets a small team answer assessment questions without digging through scattered folders.

Three luggage tags stamped 7012 and linked in a chain labeled Prime, Sub, and Sub-Sub, illustrating DFARS 252.204-7012 flowdown through the supply chain.

Supply Chain

Subcontractor Flowdown Under DFARS 252.204-7012

A practical workflow for deciding when safeguarding and incident-reporting obligations need to reach subcontractors that handle covered defense information.

A clipboard checklist examined through a magnifying glass beside a government ID badge, illustrating a government-led Medium or High NIST SP 800-171 assessment.

DFARS

DFARS 252.204-7020 Medium and High Assessments: What Contractors Must Be Ready to Show

A practical guide to DFARS 252.204-7020 Medium and High NIST SP 800-171 DoD Assessments, contractor access duties, rebuttal timing, SPRS records, and subcontract implications.

A stamp reading Affirming Official hovering over a signed document beside an ID badge, illustrating who can sign the CMMC annual affirmation.

SPRS & Awards

CMMC Affirming Official: Who Can Sign and What the Annual Affirmation Actually Means

Who qualifies as a CMMC Affirming Official, when affirmations are required, what is being attested to, and how to build a defensible internal sign-off process before SPRS submission.

A fenced enclosure holding a laptop, router, and sensor tagged CRMA with a checklist clipboard beside it, illustrating Contractor Risk Managed Assets.

Scoping

CMMC Contractor Risk Managed Assets (CRMA): Scope, Documentation, and Limited Checks

A focused Level 2 guide to Contractor Risk Managed Assets: what qualifies, why CRMAs stay in scope, what belongs in the SSP and network diagram, and when assessors can perform limited checks.

Four labeled objects on a shelf — a valve for OT, a sensor for IoT, a crate marked GFE, and a multimeter for test gear — illustrating CMMC specialized assets.

Scoping

CMMC Specialized Assets: How to Handle OT, IoT, GFE, and Test Equipment at Level 2

How CMMC Level 2 treats Specialized Assets such as OT, IoT/IIoT, Government Furnished Equipment, restricted systems, and test equipment that can handle CUI but cannot be fully secured.

CMMC Out-of-Scope Assets: Separation, VDI, and the Keyboard/Video/Mouse Boundary

Scoping

CMMC Out-of-Scope Assets: Separation, VDI, and the Keyboard/Video/Mouse Boundary

How Level 2 out-of-scope treatment works, what separation must accomplish, why 'no CUI intended' is not enough, and how the VDI keyboard/video/mouse condition affects endpoint scoping.

CUI Marking for Defense Contractors: Files, Email, Media, and Common Mistakes

CUI Handling

CUI Marking for Defense Contractors: Files, Email, Media, and Common Mistakes

A contractor-focused CUI marking guide covering banner markings, Basic vs Specified CUI, email and media handling, source authority, and what to do when markings are missing or unclear.

An email envelope with an attachment forwarding through a locked boundary to a second envelope, illustrating CUI risk in mailbox forwarding under CMMC.

CUI Handling

CUI in Email Under CMMC: Mailboxes, Attachments, Forwarding, and Evidence

A practical guide to handling CUI in email: when the mailbox enters scope, message bodies vs attachments, forwarding and mobile access, encryption, external recipients, and assessment evidence.

An arched door with two side-by-side locks — a physical key and a one-time-code phone — illustrating MFA requirements for privileged and network access.

NIST 800-171

CMMC MFA Requirements: Privileged, Network, and Local Access Without Guesswork

A precise guide to NIST SP 800-171 Rev. 2 requirement 3.5.3 for CMMC Level 2, including privileged vs non-privileged access, local vs network access, common bypasses, and assessor-ready evidence.

A large keyring with many plain keys and only two gold keys labeled Admin, illustrating least-privilege limits on CMMC privileged accounts.

NIST 800-171

CMMC Privileged Accounts and Least Privilege: Admin Rights, Daily Accounts, and Evidence

How CMMC Level 2 applies NIST SP 800-171 Rev. 2 least-privilege requirements to administrators, separate daily accounts, privileged functions, logging, approvals, and access reviews.

Three overlapping silhouettes behind one login screen with a magnifying glass and question mark, illustrating traceability lost to shared accounts.

NIST 800-171

CMMC Shared Accounts and Service Accounts: How to Preserve User Traceability

How shared logins and service identities interact with CMMC requirements for identification, unique user traceability, least privilege, authentication, and assessor evidence.

A spooling roll of log tape piling up unreviewed beside an untouched checklist clipboard, illustrating retained but unreviewed CMMC audit logs.

NIST 800-171

CMMC Audit Logs: What to Record, Retain, Protect, and Review for Level 2

A practical guide to NIST SP 800-171 Rev. 2 audit requirements 3.3.1 through 3.3.9, including event selection, retention, user traceability, clock synchronization, log protection, failure alerts, and assessor evidence.

A wall calendar with recurring scan icons on repeated dates and a magnifying glass over a bug on a circled date, illustrating a vulnerability scanning cadence for 3.11.2.

NIST 800-171

CMMC Vulnerability Scanning: Scope, Cadence, Triggers, and Evidence for 3.11.2

How to implement NIST SP 800-171 Rev. 2 requirement 3.11.2 without inventing a quarterly rule: systems and applications, periodic scans, new-vulnerability triggers, missed devices, exclusions, and evidence.

A stitched paper patch covering a torn hole with a tag reading 3.14.1 and a clock beside it, illustrating tracked flaw remediation through to closure.

NIST 800-171

CMMC Patch Management and Flaw Remediation: How to Define “Timely” Without a Fake 30/60/90 Rule

A focused guide to NIST SP 800-171 Rev. 2 requirement 3.14.1 and its relationship to vulnerability scanning and risk remediation, including patch SLAs, exceptions, emergency fixes, verification, and evidence.

Papercraft vault drawer with a padlock and a FIPS badge, slightly open to reveal CUI documents inside, illustrating encryption-at-rest requirements for stored controlled unclassified information.

NIST 800-171

CMMC Encryption at Rest: When CUI Needs Cryptography, Physical Protection, and FIPS Validation

A precise guide to NIST SP 800-171 Rev. 2 requirements 3.13.16 and 3.13.11 for CUI at rest, covering endpoints, servers, backups, cloud storage, removable media, key handling, physical safeguards, and evidence.

Papercraft pipeline with a document passing through a padlock-shaped checkpoint, tagged TLS, VPN and SFTP, illustrating encryption-in-transit paths for CUI transfers.

NIST 800-171

CMMC Encryption in Transit: Map CUI Transfers Across TLS, VPN, SFTP, Email, and APIs

How to implement NIST SP 800-171 Rev. 2 requirements 3.13.8 and 3.13.11 for CUI in transit, including transfer-path inventory, alternative physical safeguards, FIPS-validated cryptography, TLS/VPN/SFTP configuration, and evidence.

Papercraft tray of USB drives each with an owner tag and one padlocked, beside a single unassigned drive marked with a red X, illustrating controlled versus uncontrolled removable media.

NIST 800-171

CMMC Removable Media and USB: Control Use, Ownership, Transport, and CUI Without a Blanket Myth

A focused guide to NIST SP 800-171 Rev. 2 media requirements for USB drives and portable storage, including 3.8.7, 3.8.8, transport accountability, encryption, approved-device models, technical enforcement, and evidence.

CMMC Media Sanitization: Reuse, Disposal, Off-Site Maintenance, and CUI Evidence

NIST 800-171

CMMC Media Sanitization: Reuse, Disposal, Off-Site Maintenance, and CUI Evidence

How to implement NIST SP 800-171 Rev. 2 media sanitization requirements for drives, SSDs, paper, printers, equipment sent for maintenance, reused devices, and destruction records without confusing decontrol with public release.

Papercraft illustration of a locked corporate Wi-Fi router beside an open-lock guest Wi-Fi router, each with its own colored radio-wave arcs, illustrating separated wireless network rules.

NIST 800-171

CMMC Wireless Networks: Authorization, Encryption, Guest Wi-Fi, and Evidence for 3.1.16–3.1.17

How CMMC Level 2 applies NIST SP 800-171 Rev. 2 wireless requirements 3.1.16 and 3.1.17 to corporate Wi-Fi, guest networks, access points, rogue devices, remote sites, authentication, encryption, and assessment evidence.

Papercraft smartphone with a shield badge on its screen beside a tablet, with a signal arc from a cloud above, illustrating MDM, encryption, and remote-wipe controls for mobile devices.

NIST 800-171

CMMC Mobile Devices: Phones, Tablets, MDM, CUI Storage, and Lost-Device Evidence

A practical guide to NIST SP 800-171 Rev. 2 requirements 3.1.18 and 3.1.19 for mobile devices, including connection control, CUI encryption, MDM, apps, screenshots, local downloads, cloud backup, loss, remote wipe, and assessor evidence.

Overhead papercraft view of a round table with role cards around the edge and a clock reading 72 in the center, illustrating an incident-response tabletop exercise tied to the 72-hour reporting clock.

NIST 800-171

CMMC Incident Response Tabletop: How to Test 3.6.3 and Connect It to DFARS 72-Hour Reporting

A detailed Level 2 tabletop guide for NIST SP 800-171 Rev. 2 incident response requirements 3.6.1–3.6.3, with scenarios, injects, roles, evidence, action tracking, DFARS 252.204-7012 reporting, and 90-day image preservation.

Papercraft classroom easel with an insider-threat warning icon beside a stack of signed attendance sheets, illustrating role-aware CMMC security awareness training with proof of attendance.

NIST 800-171

CMMC Security Awareness & Training Requirements: What 3.2.1–3.2.3 Actually Require

CMMC training under NIST 800-171 3.2.1–3.2.3 means role-aware and insider-threat-aware training with records proving people actually received it.

Papercraft baseline clipboard stamped approved next to a locked-off toggle switch, illustrating configuration baselines, change control, and least functionality.

NIST 800-171

CMMC Configuration Management: Baselines, Change Control, and Least Functionality (3.4.x)

CMMC configuration management connects secure baselines, inventories, controlled changes, least functionality, and software restrictions across the CUI environment.

Papercraft toolbox beside a laptop tagged sanitized and packed for shipping, illustrating maintenance tool control and sanitization before off-site repair.

NIST 800-171

CMMC Maintenance Requirements: Tools, Remote Maintenance, and Sanitization Before Off-Site Repair (3.7.x)

CMMC maintenance controls govern who services CUI systems, which tools are used, how remote maintenance is protected, and what happens before equipment leaves.

Papercraft ID badge with screened, transferred, and revoked stamps and a cut lanyard, illustrating personnel screening, transfer, and termination actions.

NIST 800-171

CMMC Personnel Security: Screening, Termination, and Transfer Actions (3.9.x)

CMMC personnel security under 3.9.1–3.9.2 covers screening before access plus timely system and facility actions for termination and transfer events.

Papercraft front door with a badge reader and visitor sign-in clipboard beside a small house shape, illustrating facility access control, visitor logs, and alternate work sites.

NIST 800-171

CMMC Physical Protection: Facility Access, Visitor Logs, and Alternate Work Sites (3.10.x)

CMMC physical protection covers authorized facility access, visitor control, access logs, physical devices, and safeguards at alternate work sites.

Papercraft keyring with keys being added and removed beside an access-review checklist, illustrating account provisioning, deprovisioning, and periodic access review.

NIST 800-171

CMMC Account Management: Provisioning, Deprovisioning, and Periodic Access Review (3.1.1–3.1.2)

CMMC account management should prove only authorized users and devices receive permitted access, with controlled provisioning, removal, and review.

Papercraft laptop with a padlock covering its screen beside a counting-down hourglass, illustrating automatic session lock and termination after inactivity.

NIST 800-171

CMMC Session Lock and Session Termination: What Counts as Evidence (3.1.10–3.1.11)

CMMC session controls require inactivity locking with pattern-hiding displays and automatic termination after defined conditions, backed by real settings.

Papercraft managed access point doorway with a padlock and monitoring eye icon as a laptop passes through, illustrating remote access controls beyond multi-factor authentication.

NIST 800-171

CMMC Remote Access Beyond MFA: Monitoring, Encryption, and Managed Access Points (3.1.12–3.1.14)

CMMC remote access requires controlled and monitored sessions, cryptographic protection, and routing through managed access-control points—not MFA alone.

Papercraft monitor and envelope scanned by a magnifying glass with a bug caught in a net, illustrating active endpoint and email malicious-code protection.

NIST 800-171

CMMC Malicious Code Protection: Endpoint and Email Scanning Evidence (3.14.2)

CMMC 3.14.2 requires malicious-code protection at appropriate locations, with current configuration and operating evidence—not just an antivirus license.

Papercraft radar monitor with an alert bell connected to a magnifying glass investigating a flagged event, illustrating system monitoring and security alert investigation.

NIST 800-171

CMMC System Monitoring and Security Alerts: What 3.14.6–3.14.7 Actually Require

CMMC 3.14.6–3.14.7 require monitoring for attacks and indicators of attack, plus a working process to identify and investigate unauthorized system use.

Papercraft vulnerability scan report marked not enough beside a three-zone risk map covering operations, assets, and people, illustrating risk assessment beyond a scanner report.

NIST 800-171

CMMC Risk Assessment Requirements Beyond the Vulnerability Scan (3.11.1)

CMMC 3.11.1 requires periodic risk assessment to organizational operations, assets, and individuals—not merely a vulnerability scanner report.

Papercraft SSP binder beside a monitoring dial and a recurring loop icon, illustrating continuous assessment and monitoring beyond a static POA&M list.

Assessment Prep

CMMC Security Assessment and Continuous Monitoring: Beyond the POA&M (3.12.x)

CMMC 3.12.x requires recurring assessment, POA&M management, ongoing control monitoring, and an accurate SSP—not just a remediation list.

Papercraft brick firewall wall with a gate separating an internal zone from a public globe through a tagged DMZ buffer zone, illustrating boundary protection and network segmentation.

NIST 800-171

CMMC Boundary Protection: Firewalls, Segmentation, and DMZ Evidence (3.13.1–3.13.5)

CMMC boundary protection under 3.13.1–3.13.5 requires controlled communications, architecture safeguards, separation, and public-system isolation.

Papercraft filing cabinet drawer labeled NFO with a Rev. 2 tailoring tag and a magnifying glass, illustrating Non-Federal Organization controls as a tailoring category, not a hidden control set.

NIST 800-171

CMMC Non-Federal Organization (NFO) Controls Explained: What Rev. 2 Tailored Out and Why It Matters

NFO is a Rev. 2 tailoring category, not a hidden CMMC control set; learn what NIST expected nonfederal organizations to satisfy routinely.

Papercraft speech bubble holding a video camera and microphone icon with a CUI document sliding out marked with a question mark, illustrating collaboration-tool CUI scoping.

NIST 800-171

CMMC and Collaboration Tools: Voice, Video, and Chat Platforms Carrying CUI

CMMC scoping for voice, video, chat, meetings, and collaboration tools depends on whether the service processes, stores, or transmits CUI and how it is configured.

Papercraft flow diagram of connected boxes with a document traveling through a dashed trust-boundary fence, illustrating why assessors ask for a CMMC data flow diagram.

Assessment Prep

CMMC Data Flow Diagrams: Why Assessors Ask for Them and How to Build One

A useful CMMC data flow diagram shows where CUI enters, moves, is processed, is stored, exits, and which trust boundaries and providers protect each path.

Three papercraft coin jars of increasing height labeled Level 1, Level 2, and Level 3 with price tags, illustrating rising CMMC certification cost ranges by level.

Cost & Process

How Much Does CMMC Certification Cost in 2026? Level 1, 2, and 3 Compared

2026 CMMC costs range from about $4k–$15k for Level 1 work to $75k–$300k+ for many Level 2 programs; these are market estimates, not official prices.

Papercraft magnifying glass over a fanned stack of assessor cards, one stamped authorized, illustrating the vetting questions to ask before choosing a C3PAO.

Cost & Process

How to Choose a C3PAO: Questions to Ask Before You Sign an Engagement

Choose a C3PAO by verifying authorization, independence, assessor roles, scope assumptions, evidence process, fees, scheduling, conflicts, and appeals.

Papercraft laptop showing an organized compliance dashboard beside a crossed-out person-and-shield icon, illustrating what compliance software organizes versus what it cannot replace.

Cost & Process

What Does CMMC Compliance Software Actually Do (and Not Replace)?

CMMC software can organize evidence, mappings, tasks, and findings, but it cannot replace implemented controls, accountable owners, or authorized assessments.

Papercraft checklist clipboard covered in question marks beside a telephone still on the hook, illustrating a readiness self-check to complete before calling a consultant or C3PAO.

Cost & Process

CMMC Readiness Self-Check: The Questions to Answer Before You Call Anyone

A CMMC readiness self-check should confirm contract obligations, FCI/CUI, scope, assets, SSP accuracy, SPRS status, control ownership, and evidence gaps.

Illustrated staircase labeled Scope, Implement, Evidence, Assess, Affirm, SPRS showing the full CMMC certification process step by step

Cost & Process

The CMMC Certification Process, Step by Step: From Scoping to SPRS Posting

The CMMC process runs from contract and scope analysis through implementation, evidence, assessment, findings, affirmation, and required SPRS status updates.

Comparison illustration contrasting CMMC and SOC 2 scope and purpose for defense contractors

Cost & Process

CMMC vs. SOC 2: What's the Difference and Do You Need Both?

CMMC is a DoD contracting cybersecurity program tied to FCI/CUI; SOC 2 is an AICPA attestation framework. One does not automatically satisfy the other.

Comparison illustration contrasting CMMC and FedRAMP requirements for a defense contractor

Cost & Process

CMMC vs. FedRAMP: When Each Framework Applies to a Defense Contractor

CMMC evaluates a contractor's protected environment; FedRAMP authorizes cloud offerings. Defense contractors may rely on both for different compliance purposes.

Illustration distinguishing a CMMC consultant, a C3PAO, and a Registered Practitioner and their separate roles

Cost & Process

CMMC Consultant vs. C3PAO vs. Registered Practitioner: Who Does What

A consultant or Registered Practitioner can help prepare; a C3PAO conducts authorized certification assessments. Keep advisory and assessment roles distinct.

Illustrated timeline labeled Scope, Remediate, Assess leading to a Certified flag showing the realistic length of CMMC certification in 2026

Cost & Process

How Long Does CMMC Certification Actually Take? A Realistic Timeline

CMMC readiness may take months or longer depending on scope and remediation; the formal assessment is only one stage, and Phase II timing remains suspended.

Illustration of budget line items beyond the CMMC assessment fee that a small business should plan for

Cost & Process

CMMC Budgeting for a Small Business: What to Plan for Beyond the Assessment Fee

A small-business CMMC budget should include scoping, remediation, tools, internal labor, provider changes, documentation, assessment, and recurring operations.

Illustration of an MSP supporting a defense contractor client through CMMC expectations

Service Providers

CMMC for MSPs: What Your Defense-Contractor Clients Will Expect From You

MSPs serving defense contractors should expect scrutiny of privileged access, tools, personnel, logs, incidents, cloud services, evidence, and client-specific scope.

Illustration of a shared responsibility split between an MSP and its client under CMMC

Service Providers

The CMMC Shared Responsibility Split: What's the MSP's Job vs. the Client's Job

Map CMMC shared responsibility control by control and service by service so the MSP and client know who implements each task and who retains the evidence.

Illustration showing how an MSP can support a CUI boundary without pulling its own systems into CMMC scope

Service Providers

How MSPs Can Support a Client's CUI Boundary Without Pulling Their Own Systems Into Scope

MSPs can limit avoidable CMMC scope by minimizing CUI copies, separating privileged management paths, and using client-specific access and evidence workflows.

Illustrated server rack labeled Identity, Endpoints, Logging, Backup, Remote Access showing a CMMC-ready managed tool stack for MSPs

Service Providers

Building a CMMC-Ready Managed Stack: Tools MSPs Commonly Deploy for NIST 800-171

A CMMC-ready MSP stack should cover identity, endpoints, logging, vulnerability management, backup, secure remote access, change records, and usable evidence.

Illustration of a pending inbox labeled Task Force Report stamped Pending, showing the CMMC Reform Task Force report still awaited

Current Status

The CMMC Reform Task Force: What Its Report Could Change

The CMMC Reform Task Force began July 13, 2026; as of September 4, no final report was posted on the official CMMC pages reviewed for this guide.

Illustration of a calendar and document labeled Final but Not Current showing NIST SP 800-171 Revision 3 adoption timing for CMMC

Current Status

NIST SP 800-171 Rev. 3 and CMMC: What Changes When (and If) the Program Adopts It

NIST SP 800-171 Rev. 3 is final, but current CMMC implementation remains anchored to Rev. 2; prepare for transition without claiming Rev. 3 is today's baseline.

Illustration showing why DoD Class Deviation 2024-O0013 Revision 2 still governs CMMC contract requirements

Current Status

DoD Class Deviation 2024-O0013 Explained: Why Rev. 2 Still Governs CMMC Today

Class Deviation 2024-O0013 Rev.1 directs contracting officers to use a DFARS 252.204-7012 deviation that requires NIST SP 800-171 Rev. 2 until rescinded.

Illustration exploring whether a restructured CMMC Phase II would look different for small contractors if it returns

Current Status

If CMMC Phase II Comes Back Restructured Instead of Restored, What Changes for Small Contractors?

If Phase II returns in a new form, contract triggers, scope, timing, or burden could change; as of September 4, 2026 no specific redesign has been adopted.

Illustrated funnel labeled Prime showing CMMC requirements flowing down to new subcontractors

Supply Chain

A Prime Contractor's CMMC Flowdown Checklist for Onboarding New Subcontractors

A prime's CMMC onboarding should identify protected data, applicable clauses, required status, approved systems and transfer paths, incident contacts, and flowdown.

Illustration of a subcontractor with a pen and question marks, reviewing questions to ask a prime about CMMC before signing

Supply Chain

What a Small Subcontractor Should Ask a Prime About CMMC Requirements Before Signing

Before signing, a subcontractor should clarify the protected data, clauses, CMMC status, approved systems, evidence expectations, incident duties, and cost impact.

Illustration of overlapping circles representing teaming partners in a joint venture, showing whose systems fall inside CMMC scope

Supply Chain

CMMC for Teaming Agreements and Joint Ventures: Whose Scope Is It?

CMMC scope in a teaming agreement or joint venture follows the entities, contracts, systems, and information flows actually used—not the relationship label alone.

Illustration of a manufacturing shop floor with PLCs and OT equipment showing how CMMC scope applies

Scoping

CMMC for Manufacturers: Shop-Floor Systems, PLCs, and OT in Scope

Manufacturers should include shop-floor PCs, HMIs, PLC engineering stations, transfer paths, quality systems, and specialized assets when they touch or protect CUI.

Illustration of QuickBooks and ERP financial software systems showing where the CMMC assessment boundary falls

Scoping

CMMC and QuickBooks/ERP Systems: Where Financial Software Fits in the Assessment Boundary

QuickBooks or an ERP is not automatically in or out of CMMC scope; inspect its data, attachments, integrations, backups, users, and security role before deciding.

Illustrated comparison of three cloud environments labeled Commercial, GCC, and GCC High showing their different CMMC boundaries

Cloud & Scope

Microsoft 365 GCC High vs. Commercial: What Actually Changes for CMMC

Microsoft 365 Commercial, GCC, and GCC High have different government compliance boundaries; choose by data and contract needs, then configure customer controls.

Illustration of a document folder labeled FedRAMP High next to a printer rejecting a page marked Not Enough, showing what Google Workspace can and cannot do for CMMC and NIST 800-171 CUI

Cloud & Scope

Can Google Workspace Meet CMMC/NIST 800-171 Requirements for CUI?

Google Workspace can support CMMC when in-scope FedRAMP High services and required controls are used, but customer configuration and operations remain essential.

Illustration of a CAD file tracing between a workstation and a cloud icon, showing how technical data export brings CUI into CMMC scope for engineering firms

Scoping

CMMC for Engineering Firms: CAD Files, Technical Data Packages, and Export-Adjacent CUI

Engineering firms should trace CAD, technical data, PDM/PLM, collaboration, rendering, and export-controlled information across every storage and transfer path.

Illustration of packing boxes labeled Self-Assessed and Third-Party Verified, showing a split contract mix under CMMC

Assessment Prep

Self-Assessment vs. Third-Party: Choosing the Right Path When Your Contract Mix Is Split

With mixed contracts, map each solicitation's CMMC level and assessment status to the information system performing the work instead of assuming one result fits all.

Illustration of an open shipping package with document contents, showing what a C3PAO actually reviews in a CMMC assessment evidence package

Assessment Prep

What's in a CMMC Assessment Evidence Package: What a C3PAO Actually Reviews

A Level 2 evidence package should map each assessment objective to scoped assets, current implementation records, knowledgeable personnel, and testable controls.

Illustrated badge showing Conditional and Final status stamps, explaining what an interim CMMC assessment result means next

Assessment Prep

Interim Assessment Results Explained: What They Mean and What Happens Next

CMMC results should use formal status terms such as Conditional and Final CMMC Status instead of informal 'interim pass' language that can obscure POA&M conditions.

Illustration of a high-jump bar knocked down with stepping stones leading back up, showing remediation and reassessment after failing a CMMC assessment

Assessment Prep

What Happens If You Fail a CMMC Assessment? Findings, Remediation, and Re-Assessment

If a CMMC assessment misses the required status, classify findings, check POA&M eligibility, fix root causes, validate evidence, and use the proper closeout path.

Illustrated badge stamped Non-Current, showing what happens when a CMMC affirmation deadline is missed

Assessment Prep

CMMC Affirmation Deadlines: What Happens If You Miss One

CMMC final statuses need recurring affirmations; a missed or stale affirmation can make an otherwise valid status non-current for contracting purposes.

Illustration of an open glossary book with tabbed bookmarks, explaining CMMC acronyms including SSP, POAM, SPRS, C3PAO, and DIBCAC

Assessment Prep

CMMC Acronyms Glossary: SSP, POA&M, SPRS, C3PAO, DIBCAC, and More Explained

A practical CMMC glossary covering SSP, POA&M, SPRS, C3PAO, DIBCAC, OSA/OSC, CMMC UID, FCI, CUI, CDI, ESP, MSP, MSSP, RP, and related terms.

Illustrated staircase labeled Level 1, Level 2, and Level 3 comparing the three CMMC certification levels

CMMC Levels

CMMC Level 1 vs. Level 2 vs. Level 3: Full Comparison Table

CMMC Level 1 protects FCI, Level 2 protects CUI using the current Rev. 2 baseline, and Level 3 adds enhanced requirements for selected high-sensitivity programs.

Illustration of three labeled folders for FCI, CUI, and CDI, showing the difference between these data types and their CMMC levels

CMMC Levels

CUI vs. FCI vs. CDI: What's the Actual Difference and Why It Determines Your CMMC Level

FCI is nonpublic federal contract information, CUI requires government safeguarding controls, and CDI is a DFARS term tied to covered defense information.