1.The Contract Clause That Changes Everything
You are reviewing a new contract opportunity. The technical requirements are straightforward. Your company has done this work before. Pricing looks competitive. Then you reach the cybersecurity clauses.
DFARS 252.204-7012. DFARS 252.204-7021. References to NIST SP 800-171 and CMMC Level 2 certification. The contract requires compliance with cybersecurity requirements you have never fully implemented. And the contracting officer needs your System Security Plan within sixty days.
2.Understanding the Landscape
171NIST SP 800-171
The National Institute of Standards and Technology published this standard to establish requirements for protecting Controlled Unclassified Information. DFARS clause 252.204-7012 requires defense contractors to implement its 110 security requirements when handling CUI.
CMMCCybersecurity Maturity Model Certification
CMMC was developed because self-attestation was not working. Too many contractors claimed compliance without implementing required controls. CMMC adds independent assessment and certification to verify contractors actually meet requirements.
2.0CMMC 2.0 Levels
Level 1 addresses basic cyber hygiene with 17 practices. Level 2 aligns with NIST 800-171's 110 requirements. Level 3 adds enhanced requirements for protecting against advanced persistent threats. Most contractors handling CUI need Level 2.
3.What is Controlled Unclassified Information?
CUI is information the government creates or possesses, or that an entity creates for the government, that requires safeguarding or dissemination controls. It is not classified information, but it requires protection beyond ordinary business information.
Examples of CUI
- Technical data and engineering drawings
- Export controlled information
- Proprietary information provided by the government
- Personally identifiable information
- Sensitive but unclassified defense information
4.The 110 Requirements
NIST 800-171 organizes its 110 requirements into fourteen families. Understanding these families helps structure your implementation efforts.
22Access Control
Limiting system access to authorized users, controlling access to CUI, limiting unsuccessful login attempts, providing privacy notices, and controlling remote access.
11Identification and Authentication
Multi-factor authentication for network access and local access to privileged accounts. Password complexity requirements. Authenticator protection.
9Audit and Accountability
Create audit logs, ensure actions can be traced to individuals, review logs, protect logs from unauthorized access, and correlate audit records.
9Configuration Management
Establish baseline configurations, track and control changes, analyze security impacts of changes, and enforce security configuration settings.
16System and Communications Protection
Monitor communications at boundaries, implement cryptographic mechanisms, control network connections, and protect CUI at rest and in transit.
5.Documentation Requirements
System Security Plan (SSP)
- Documents how your organization implements each of the 110 requirements
- Describes implementation approach for each requirement
- Identifies systems and personnel involved
- References relevant policies and procedures
- Must be updated as your environment changes
Plan of Action and Milestones (POA&M)
- Documents requirements not yet fully implemented
- Describes what remains to be done for each gap
- Identifies resources needed
- Sets milestones for completion
- Assigns responsible parties
6.The Assessment Process
CMMC Level 2 certification requires assessment by an authorized C3PAO (CMMC Third Party Assessment Organization). The assessment process examines your implementation of all 110 requirements and verifies that your practices match your documentation.
What Assessors Examine
- Review your SSP and POA&M
- Interview personnel about security practices
- Examine systems and configurations
- Test controls to verify effectiveness
- Look for evidence across your CUI environment
7.Getting Started
The path to CMMC compliance begins with understanding your current state.
Initial Steps
- Conduct gap assessment against NIST 800-171 requirements
- Identify where you comply, have partial implementation, or have no implementation
- Develop remediation plan prioritizing high-risk gaps
- Consider resource constraints in your timeline
- Document implementation in System Security Plan
- Engage with a C3PAO early for pre-assessment services
The Stakes Are High
The investment in compliance is significant but necessary for organizations committed to defense work. Beyond contract eligibility, strong cybersecurity protects your own business and the sensitive information entrusted to you.