Before You Prepare for CMMC, Know What Applies

Start with the contract, not a product list

A contractor can spend weeks comparing cybersecurity tools without answering the first question: what does the contract actually require? Cybersecurity Maturity Model Certification (CMMC) readiness starts with understanding the solicitation or award, the type of federal information the organization handles and the systems involved. A subcontractor’s requirements may also flow from its prime contract relationship. Don’t assume every federal contractor has the same assessment path, or that CMMC applies to every federal contract.

Not a DoD contractor? This still applies to you

CMMC applies to Department of Defense (DoD) contracts. But the 15 basic safeguarding requirements behind CMMC Level 1 come from Federal Acquisition Regulation (FAR) 52.204-21, which covers Federal Contract Information (FCI) in federal contracts across agencies. A proposed FAR rule would also bring a more consistent approach to Controlled Unclassified Information (CUI) governmentwide. Knowing what applies to you is the right first step either way.

Trace the information

FCI and CUI are not interchangeable. Map where the relevant information enters the business, where it’s stored, who uses it and where it leaves. Include cloud services and external providers in the discussion. A boundary drawn on a diagram is only useful when it matches how people actually work.

If the information includes export-controlled technical data, such as information subject to the International Traffic in Arms Regulations (ITAR), additional handling and service-provider considerations may apply and should be evaluated separately.

Test the gap between written and real

Documentation is necessary, but a policy doesn’t prove that a practice is consistently implemented. Consider multifactor authentication (MFA): which accounts and systems require it, how is it enforced, and what configuration records or test results support the claim?

Evidence also needs history. An assessor may ask for records showing a practice has been in place over time, not just a configuration that works on assessment day. That history can’t be built in a week, which is one more reason to start early.

Build a sequence you can manage

After scoping, assess the applicable requirements against current practices, prioritize gaps, assign owners and collect evidence as remediation is completed. For organizations facing an independent assessment, a mock assessment can help expose inconsistencies before assessment day. CMMC requirements and assessment routes depend on the applicable contract and level.

Where DTC fits

We help federal contractors with scoping, gap assessments, remediation, policies and documentation, evidence preparation, mock assessments and ongoing cybersecurity support.

A practical place to start is a short list of technical controls that are quick to check: MFA, audit logging, encryption, endpoint configurations and whether your cloud services fit the information you handle. Each control still has to be evaluated against your actual contract, environment and shared responsibilities. The first conversation should establish what you need, not assume the answer in advance.

Where to start

If your team had to explain its CMMC scope today, could everyone point to the same systems, information flows and responsibilities?

See how DTC helps with CMMC readiness

Sources

• 32 CFR Part 170, CMMC Program
• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems
• Proposed FAR CUI rule, Federal Register, 91 FR 37550 (June 23, 2026)
• NIST SP 800-171, Protecting CUI in Nonfederal Systems
• ITAR, 22 CFR Parts 120–130