Where to start with CMMC: simple answers for defense contractors
The Phase 2 pause slowed assessments but left contract requirements unchanged, and small contractors are still asking the same questions about what to do next. This guide collects the five we hear most, with answers from assessors, attorneys and advisors at PreVeil’s 2026 CMMC Summit. Each one includes a short video, specific next steps and the common mistakes that cost time and money.
“How do I know if I have CUI?”
Check your contracts. If one includes DFARS clause 252.204-7012, you have to protect CUI, and the Phase 2 pause doesn’t change that.
A lot of small companies assume their MSP handles this. Assessor Dan Ciarlette explains why that’s a risky assumption.
What to do
- Search your contracts for “252.204-7012” and “252.204-7021.”
- Not sure if a file from your prime is CUI? Ask their contracting officer in writing, and handle it as CUI until you hear back. Don’t add CUI markings yourself. That’s the job of whoever created the file.
- If a whole package is marked CUI, protect all of it.
What to check for
- CUI markings on drawings, specs and emails, including older ones.
- Distribution statements B through F on technical data, which usually mean it’s CUI.
- ITAR or EAR export warnings. Export-controlled data is often CUI too.
- Anything you make from CUI, like derived drawings, travelers or CAM files. Treat it as CUI unless your prime tells you it isn’t.
“We have CUI. Where do we start?”
Plenty of companies start by opening the list of 110 controls and working down it. Andy Paul of Teramis says that’s a mistake, and explains what to do first.
The first step is scoping, which means figuring out where CUI lives in your business. The fewer people and systems that touch CUI, the less you have to protect. As Jay Hill of TD SYNNEX said at the Summit, “Avoid over-scoping at all costs.”
What to do
- Write down how CUI comes in, who handles it and where it’s stored.
- List the people who actually need access to CUI to do their jobs.
- Keep CUI in one place, and off any system or device that doesn’t need it.
What’s in scope
- Printers, scanners and copiers that handle CUI.
- Cloud apps like ERP, file sharing or email, if they store, process or send CUI.
- Laptops, phones and USB drives people use to open or move CUI.
- Firewalls and security tools that protect any of the above.
“What do I actually have to buy to achieve CMMC?”
Two out of three Summit attendees told us their compliance budget is under $50,000. The advisors said a lot of the overspending they see comes from buying more than the company needs. Adam Glover of Insight Assurance covers the most common case.
What to do
- Scope first. Buy only for the people and systems that actually handle CUI.
- Check what your current licenses already cover, like MFA, logging and endpoint protection.
- For any cloud service that will store or process CUI, confirm it meets FedRAMP Moderate or equivalent.
- Use the free help: your state’s Manufacturing Extension Partnership (MEP), APEX Accelerators and the DoW’s CMMC Assessment and Scoping Guides.
What to watch out for
- Quotes that move your whole company to a new platform when only a few people handle CUI.
- Add-on tools that do what your current software already does.
- Anyone promising a fast fix. As Dr. Michael Barker of the Georgia MEP said, “If somebody tells you they can do it in a week… run. They can’t.”
“Our prime is asking for proof of our SPRS score.”
The Phase 2 pause slowed down third-party assessments. It didn’t change what your contract requires. Your SPRS score is often the main thing your prime has to go on, and it’s an official statement to the government. Michael Gruden, a partner at Steptoe LLP and a former Pentagon contracting officer, explains what that means for you.
In one False Claims Act case Michael described, a company reported a perfect 110. When the government reviewed it later, the real score was negative 170.
What to do
- Only count a control as met if you can show evidence for it today.
- Post your real score, even if it’s below 110.
- Give every open POA&M item an owner and a due date.
- Keep copies of what you send your prime, including any supplier questionnaires.
What to watch out for
- Controls marked “met” with no evidence behind them.
- An SSP that describes what you plan to do instead of what you do today.
- New systems or apps added after you post your score. They change your boundary.
“How much detail does our SSP need, and what evidence passes?”
Assessors don’t grade your SSP on the 110 controls. They grade it on the 320 assessment objectives under those controls. Miss one objective and the whole control fails.
A C3PAO assessment is one of the few ways to prove your score is accurate, and it can help when you bid on your next contract. Manas Das, a lead certified assessor at StrategicIT Solutions, says it’s worth preparing now.
What to do
- Use the CMMC Assessment Guide to match each control in your SSP to its assessment objectives.
- For each objective, write a short, clear answer about what you do today.
- Decide on your own timelines, like how quickly you patch critical vulnerabilities, and write them into your SSP.
- As a test, pick one control and pull the evidence you’d show an assessor today.
What to watch out for
- Evidence that proves you have a tool but not that you used it, like a dashboard with no scan results or tickets.
- Monitoring that only happens when an alert goes off. It needs to run on a set schedule.
- Vulnerabilities you can’t fix. With a signed risk acceptance, those go on an operational plan of action, not your POA&M.
Need help with your next step?
Our compliance team works with small defense contractors at every stage of CMMC. Book a call and we’ll talk through where you are and what to do next.
PROUDLY MADE IN THE USA
PreVeil is 100% Designed & Developed in the USA