When small defense contractors first meet CMMC, the System Security Plan and the Plan of Action and Milestones (POA&M) can feel like brand-new paperwork. They aren't. I've been writing them for DoD work for almost 20 years, under four different sets of rules.
Four generations, same core documents
DITSCAP: on the Ground-Based Midcourse Defense program, I wrote System Security Authorization Agreements and SSPs for the Missile Defense Agency.
DIACAP: supporting DISA customers, I prepared system security plans and tracked open findings in POA&M reports.
RMF: on defense training systems, I wrote SSPs under NIST SP 800-53 and backed them with STIG hardening and ACAS scans.
CMMC: today, Level 2 asks contractors to document how they meet the 110 requirements in NIST SP 800-171, in an SSP, with a POA&M for allowed gaps.
The acronyms changed. The core idea didn't: write down how your system is protected, prove it, and track what's still open.
What carried over every time
The SSP has to match reality. Assessors compare the plan against the actual systems. A generic template that doesn't describe your environment fails fast.
Scope decides everything. Every framework started with defining the system boundary. In CMMC terms, that means knowing exactly where CUI lives and keeping that environment small.
A POA&M is a commitment, not a parking lot. Open items need owners and dates. Under CMMC, the rules are tighter: you need at least 88 of 110 points, some requirements can't be deferred, and open items must close within 180 days.
Evidence beats intentions. Scan results, configuration baselines and logs carried more weight than policy language in every assessment I supported.
What this means for small contractors
If you're facing CMMC for the first time, you're not starting from zero. You're joining a process DoD has refined for decades. Start with the contract, scope the CUI tightly, and write an SSP that describes how your team actually works.
I put together a plain-English walkthrough of CMMC Level 2 here:
https://cyberneza.com/blog/cmmc-level-2-plain-english
Larry Downard is a CMMC Registered Practitioner, CISSP and US Air Force veteran, and the founder of Cyberneza, a veteran-owned cybersecurity firm with a 100% US-based team.
Top comments (0)