Demystifying CMMC: SIX Facts Defense Contractors Should Know

In the ever-evolving landscape of defense cybersecurity, the Cybersecurity Maturity Model Certification (CMMC) looms large. You’ve likely encountered a cacophony of opinions, half-truths, and outright myths surrounding CMMC.

We’re here to cut through the fog. In this article, we debunk five persistent myths about CMMC and provide insights into what this means for DoD contractors.

MYTH 1: CMMC replaces previous cybersecurity contractual requirements (NIST SP 800-171).
REALITY: CMMC does not introduce new cybersecurity requirements, but it does add third-party checks.

Adherence to NIST SP 800-171 has, through DFARS 252.204-7012, been a requirement for DoD contractors and subcontractors since 2017. CMMC just introduces the need for third-party assessments, and will require you to provide documentation that shows how you are meeting the controls in NIST 800-171A.

What this means for you: As a DoD contractor, you should already have these controls in place. You will be expected to prove this compliance once CMMC rolls out or risk being unable to bid on new work and, eventually, to retain your existing contracts.

MYTH 2: If I don’t handle Controlled Unclassified Information (CUI) today, I won’t fall into CMMC Level 2 and need a third-party assessment.
REALITY: You don’t have to currently handle CUI to fall into CMMC Level 2. It depends on what your contracts or Prime specifies.

DoD contractors that handle, or are contractually required to be able to handle, CUI will ultimately be required to achieve and demonstrate Level 2 compliance in order to keep their existing contracts or be awarded new ones.

In addition, Primes are increasingly reaching out to their subcontractors to require them to confirm their CMMC readiness and compliance with NIST 800-171A. Your Prime may flow down the requirement for you to adhere to CMMC Level 2 even if you don’t currently process, transmit, or store CUI.

What this means for you: If you have the relevant clause in your contract, or your Prime requires you to, you will need to meet all 110 controls in NIST 800-171A and have a third-party assessment organization (C3PAO) audit you on them.

Go deeper: Find out more about the three different levels of CMMC 2.0 in our blog.

MYTH 3: I don’t need to worry about CMMC yet because it’ll be a while before it’s effective.
REALITY: CMMC is expected to start to appear in new contracts from May 2025.

CFR 48 CMMC Proposed Rule, which would introduce CMMC requirements to contracts, was submitted for regulatory review in May 2024. The DoD has said that some contracts could contain CMMC requirements as early as March 2025, though our estimates put it closer to May 2025.

Don’t forget that you have been required to be compliant with NIST 800-171 since 2017 if you have held DoD contracts that long, so the overall requirements are not new. CMMC just introduces the need for a third-party assessment of your compliance.

What this means for you: If you plan to bid on new contracts in H1 2025, you will need to be CMMC certified, proving your adherence to NIST 800-171A. As we see in the next reality check, internal assessment and remediation can take six months minimum, and a C3PAO audit three to four months in a best-case scenario, though the expected bottleneck may extend this dramatically.

MYTH 4: I can quickly prepare my business to undertake a CMMC assessment once the Final Rule becomes active, so I don’t need to think about it yet.
REALITY: It takes 6+ months to become compliant with NIST SP 800-171A.

Achieving compliance with NIST 800-171A can take up to a year. This timeline can vary based on your current cybersecurity maturity, the complexity of your organization’s setup, the resources you put into the effort, and the availability of those resources (new hires, a Managed Service Provider (MSP) or consultant).

With so many contractors requiring support to get compliant and so few certified third-party assessment organizations (C3PAOs), wait times are expected to be long. Waiting until CMMC rules are published and effective risks your organization being caught in the sizable expected backlog of contractors seeking CMMC certificates. This could impact your ability to bid on new work from H1 2025 and, eventually, to retain existing contracts.

What this means for you: It is worth understanding your current readiness for CMMC, to determine what the timeline might look like for your organization. An independent assessment from a reliable, experienced MSP like ISI can help you gain a clearer understanding of your cybersecurity maturity level. Arrange a complementary consultation with us to explore your options.

Go deeper: Complete our CMMC Readiness Questionnaire to get an indication of your organization’s current state of readiness in around 10 minutes.

MYTH 5: CMMC is a box-checking exercise I will go through once every three years.
REALITY: Compliance with NIST 800-171A/CMMC is not a one and done, and requires ongoing vigilance and monitoring.

In order to meet the 110 controls in NIST 800-171A, you need to ensure your organization:

• Implements continuous monitoring and regularly scans for vulnerabilities and anomalies.
• Periodically performs self-assessments to catch any new gaps or issues.
• Maintains documentation to reflect current practices.
• Keeps up to date with current requirements. NIST 800-171 has undergone several revisions since its initial release, with the latest iteration being Revision 3. As cyber threats evolve, requirements and guidance will evolve to reflect this. This will require effort to ensure the tools you use remain compliant and fit for purpose.

What this means for you: Compliance with NIST 800-171 requires an organization-wide awareness of your cybersecurity-related policies and procedures. This requires regular training, an understanding of shared responsibility, a commitment to safeguarding data, and ongoing vigilance. It may also impact which suppliers you work with.  

Go deeper: Navigating the ongoing demands of maintaining compliance can be a sizable burden on an organization. ISI can provide assistance and ongoing support that alleviates this burden and ensures you keep on top of evolving requirements. See NIST 800-171 Services for DoD Contractors for more information on how we can help or book a no-obligation conversation with one of our experts below.  

MYTH 6: switching msps or acquisitions will trigger a new cmmc certification process.

CMMC certifications are based on Highest Level (HLO) CAGE Code and are valid for three years (contingent upon your annual self-assessments). 

What this means for you: If your CAGE code remains the same, there should be no reason your organization has to undergo another mandatory CMMC certification process. If major changes do occur at your organization, you are able to undergo a voluntary re-assessment, but it would not be required.