A hundred and ten requirements from NIST SP 800-171, a scope decision that determines most of your cost, and an evidence problem that takes longer than the technology.
If you supply the US Department of Defense and controlled unclassified information passes through your business, CMMC is going to apply to you. The programme has moved slowly enough that a lot of suppliers have developed a reasonable scepticism about whether it will really happen, and that scepticism is now expensive, because the requirement arrives through contract clauses rather than through an announcement.
This is an orientation, not legal advice, and the specifics of your obligation come from your contract and from the current official guidance, both of which you should read. What follows is the shape of the thing.
The three levels
Most of the mid-market supply base lands at Level 2. The requirement set is the 110 security requirements of NIST SP 800-171, which is a document you can download for free and which is, by the standards of these things, readable.
Level 2 is assessed by an accredited third party for most contracts, with a minority permitted to self-assess. Which one applies to you is specified in the contract, and the difference in cost and effort is substantial, so establish it early rather than assuming.
Scope is the decision that determines your cost
This is where to spend the first month, and it is the single highest-leverage decision in the programme.
The requirements apply to the systems that store, process or transmit controlled unclassified information, plus the systems that provide security protection to those. If that is your entire company network, you are bringing 110 requirements to every laptop, every server and every user. If you can constrain CUI to a defined enclave, the assessed boundary shrinks dramatically.
The trade is real. An enclave is more work to design and imposes friction on the people who have to work inside it. A whole-company scope is simpler to operate and substantially more expensive to assess and maintain.
What makes this hard is that CUI does not stay where you put it. It arrives by email, it gets forwarded, somebody copies a drawing into a quote, an engineer puts it on a USB stick to take to a machine. Scoping is only meaningful if the boundary is enforced, and enforcing it is as much a process problem as a technical one.
Start by finding out where CUI actually is today. That exercise alone usually reframes the project.
The 110, grouped
The requirements fall into fourteen families. Rather than list them, here is where the work usually concentrates for a company starting from a normal commercial baseline.
Mostly already done. Access control basics, identification and authentication, and much of system and communications protection are satisfied by a well-configured Microsoft 365 or equivalent environment with multi-factor authentication and sensible conditional access.
Partly done, needs formalising. Configuration management, maintenance, and media protection usually exist as practice and not as documented, evidenced policy. The gap is paperwork rather than capability, which does not make it quick.
Usually a real gap. Audit and accountability, meaning log collection and retention with someone actually reviewing them. Incident response, with a tested plan. Security assessment, meaning a continuous process rather than an annual event. Awareness and training with records. And the personnel and physical requirements, which are often nobody's job.
The expensive one. If you handle CUI in the cloud, the cloud service generally needs to meet FedRAMP Moderate or equivalent, which for Microsoft means the government community cloud rather than the commercial one. Migrating tenants is a project in its own right and it needs to be identified in month one, not month nine.
Evidence is the long pole
The thing that surprises people: you do not pass by having good controls. You pass by demonstrating that the controls operated, over time, with evidence.
An assessor asks how you know only authorised people have access. The answer is not the conditional access policy. It is the policy, plus the access review you performed in March, plus the record of what changed as a result, plus the same for June and September.
This is why twelve to eighteen months is the realistic timeline from a standing start, and why starting with the technology is the wrong order. The technical remediation can be done in a quarter. The evidence that it has been operating cannot be compressed.
Three documents you will need
A system security plan. Describes your environment, the boundary, and how each of the 110 requirements is met. This is the central artefact and the assessment is largely conducted against it.
A plan of action and milestones for anything not yet met, with dates and owners. Note that the rules on what may remain open at assessment are specific and limited, so this is not a place to park difficult items indefinitely.
Your supplier flow-down. The requirements pass down your own supply chain. If a subcontractor handles CUI on your behalf, that is now in your scope and in your contracts.
What to do first
Establish from the contract which level and which assessment route applies. Find out where CUI actually is in your business today, by asking people rather than by reading the process documentation. Make the scope decision, enclave or whole company, with the cost of each written down. Then run a gap assessment against the 110 and build the plan from what it finds.
Do that in the first quarter and the rest is a project with a known shape. Skip the scoping work and you will spend the same money on a much larger estate than you needed to.
