Getting a Small Defense Supplier Through CMMC and NIST SP 800-171

How suppliers end up paying for readiness twice

Small suppliers shopping for CMMC help run into the same things. The big consultancies quote big-company prices. Other engagements end with a report of everything that is wrong and nobody to fix it. Timelines are vague enough that no one can be held to them.

So the money goes out twice, once to find the deficiencies and again to have someone correct them. Meanwhile your prime keeps emailing for a status update.

Being ready is a narrower thing than either a gap report or a binder of policies nobody has implemented. It means the controls are running on the systems you use, the paperwork describes those controls as they are, and someone is accountable for keeping the two aligned. That hands-on part is what we do.

A group of engineers going over plans together, representing the defense supply chain.

Is this you?

We built this service for companies that:

Received a CMMC or NIST SP 800-171 flow-down from a prime, sometimes with a deadline attached

Have, or are going after, Department of War (DoW) contracts that include DFARS 252.204-7012 or 252.204-7021

Need to remain eligible for awards without hiring a compliance department

Already paid for a gap assessment and are holding findings nobody owns

The work, in four parts

Draw the scope

First we find out where CUI lives, who touches it, and which systems have to be in bounds as a result. A lot of projects go over budget right here, hardening machines that never needed to be in scope.

Rank the gaps

You do not get 110 requirements in one undifferentiated list. Each gap is ranked by how much it endangers CUI and your eligibility, and the plan shows why it sits where it does.

Implement and document

Every technical control gets configured on your live systems. The documentation is then written from what is in place. An assessor compares the two, so they must agree.

Keep it current

Left alone, readiness decays. As your company changes we update the controls and the records with it, so an assessment is something on the calendar and not an emergency.

Engineers checking machinery on the floor of a modern manufacturing plant.

What the first 30 days look like: we read your contracts and map the path CUI takes through your company. You get a prioritized remediation plan you can hand to your prime. We start putting the first controls in place. By the end of month one you have real progress to report.

Common questions

What counts as CUI?

The official definition: Controlled Unclassified Information (CUI) is a U.S. government category for information that is not classified but still requires safeguarding or dissemination controls. It took the place of an older patchwork of labels such as “For Official Use Only” (FOUO).

What it triggers: any contractor system that stores, processes, or transmits CUI is covered by DFARS 252.204-7012 (safeguarding) and 252.204-7021 (CMMC). Your contract will also contain a clause on NIST SP 800-171 assessments. Older awards use 252.204-7019 and 252.204-7020, and newer ones use 252.240-7997. Together these call for the 110 controls in NIST SP 800-171 Rev. 2 plus the CMMC assessment named in your contract.

What it can look like in practice: engineering schematics, technical drawings, blueprint files, specifications for military components, software code, procurement documents, and more.

Does CMMC apply to us, and which level?

Your contracts decide that, along with whether CUI is flowed down to you. Plenty of contractors hear it first from a prime’s flow-down terms, well before an agency says anything to them. We will read your contracts, trace your data, and tell you plainly where you stand. If the honest answer is that you are out of scope, we will say so.

We have a gap assessment in hand. What comes next?

In short, remediation: close the gaps and build the proof that the controls operate.

Start with the POA&M. Go through your Plan of Action and Milestones and order the missing controls by security risk and by how technically hard they are.

Then implement what is missing. That generally means revising policies, configuring technical safeguards such as MFA, encryption, and log monitoring, and training your staff.

Then collect evidence. Switching software on is not compliance. You have to show it works, which means producing evidence (logs, policies, training records, screenshots) for every NIST 800-171 requirement before you bring in an assessor.

How long until we are ready?

It depends on where you start, and on which of two routes you take. We support both.

The shorter route is to move CUI into a ready-made enclave hosted on a platform that holds FedRAMP Moderate authorization or its equivalent. That can get a company assessment-ready in a few weeks.

The longer route is to bring the whole company network into compliance. For a small or mid-sized supplier that usually takes 6 to 12 months:

Months 0–3: gap analysis, defining the boundary, choosing platforms, and drafting the first policies.
Months 3–6: the technical build, covering MFA, logging, access control, and system configuration.
Months 6–12: operating the controls long enough to generate evidence, then an internal mock assessment.

What happens once we are ready?

You go through the assessment your contract specifies, and then you keep the program going.

Level 1 (FCI only): a self-assessment entered in the Supplier Performance Risk System (SPRS), which a senior company official affirms every year. There is no score at Level 1. It is either met or not met.

Level 2 (CUI): a self-assessment score posted in SPRS, with an annual affirmation. C3PAO third-party assessments are currently suspended under class deviation 2026-O0025, so check the current requirement in your contract and with your prime.

From then on: the controls, the documentation, and vulnerability scanning run all year. An SPRS affirmation is a signed statement to the government, which means the score underneath it has to be right.

Can Defendrs perform our assessment?

No. We get contractors ready. We are not a C3PAO and we never conduct certification assessments. Under Cyber AB conflict-of-interest rules, one organization cannot both prepare a contractor’s environment and certify it. A Level 2 certification assessment is done by an independent C3PAO listed on the Cyber AB Marketplace. Our part is the consulting, implementation, and managed services that prepare you, and that includes helping with your own self-assessment.