For organizations working in the U.S. defense supply chain, CMMC 2.0 raises a practical technical question: which systems, users, and services are subject to the applicable cybersecurity requirements?
The answer begins with the contract and the information being handled.
Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) have different protection requirements. CMMC 2.0 uses three levels to align cybersecurity expectations with the sensitivity of that information.
The CMMC certification framework outlines the model that defense contractors need to understand when determining their applicable obligations.
Level 1: Fundamental Safeguards for FCI
Level 1 focuses on basic safeguarding practices associated with FAR 52.204-21. The requirements cover areas such as authorized access, authentication, physical security, system maintenance, and information protection.
From a technical perspective, organizations need to understand which users can access relevant information, how access is controlled, and whether systems are maintained in a way that reflects the required safeguards.
Applicable Level 1 organizations generally perform annual self-assessments and provide the required compliance affirmations.
Level 2: CUI and the NIST SP 800-171 Requirements
Level 2 aligns with NIST SP 800-171 and addresses organizations handling CUI when their contracts require this level.
The technical implications extend across several connected areas:
Identity and access management: Organizations need appropriate restrictions on who can access systems and information, including administrative privileges.
Configuration management: System configurations and changes need appropriate control to reduce the risk of unauthorized or insecure changes.
Audit and accountability: Relevant system activity must be addressed through the applicable logging, monitoring, and accountability requirements.
Incident response: Organizations need defined arrangements for handling and reporting security incidents in accordance with applicable obligations.
System integrity: Security measures must address threats such as malicious code, vulnerabilities, and unauthorized changes.
Depending on the contractual requirements, Level 2 may require assessment by a Certified Third-Party Assessment Organization (C3PAO).
Level 3: Additional Protection Against Sophisticated Threats
Level 3 is intended for selected contractors supporting the DoD's most sensitive programs. It introduces additional security requirements derived from NIST SP 800-172.
The focus includes enhanced threat detection, monitoring, security architecture, incident response, and resilience against advanced adversaries.
The exact obligations depend on the applicable Level 3 requirements and assessment arrangements.
Why the System Boundary Matters
A security control cannot be evaluated accurately without understanding the systems and information to which it applies.
Consider a contractor that stores technical data in a cloud environment, accesses it through employee endpoints, and relies on external services for administration. The relevant security boundary may need to account for the data, users, endpoints, cloud services, and supporting infrastructure, depending on the applicable scoping rules.
Organizations should map information flows, identify relevant assets, and determine how connected services affect the assessment boundary.
This also helps stakeholders distinguish systems that process CUI from other business environments, while ensuring that required connections and dependencies are not overlooked.
Evidence and Ongoing Control Operation
CMMC assessments examine more than whether a policy exists. The applicable assessment process evaluates whether required practices are in place and supported by appropriate evidence.
Depending on the requirement, evidence may include system configurations, access records, security logs, training records, incident response procedures, and other relevant records.
Maintaining this evidence over time depends on clear ownership, consistent processes, and changes being reflected in the organization's security arrangements.
The Technical Takeaway
CMMC 2.0 is not simply a checklist of cybersecurity products. It connects information classification, system boundaries, security controls, evidence, and contractual requirements.
For technical teams, understanding these relationships is essential to determining which obligations apply and maintaining effective protection for government information across the defense supply chain.
Top comments (0)