Defense Industrial Base
Security for defense manufacturers and their suppliers
If you handle Controlled Unclassified Information on a DoD contract, DFARS 252.204-7012 requires NIST SP 800-171 and CMMC adds assessment and affirmation. We help contractors close the gaps and prepare the evidence before an assessment.
- Contract clause
- DFARS 252.204-7012
- Control set
- NIST SP 800-171 Revision 2 for CMMC Level 2
- Incident reporting
- To DoD within 72 hours of discovery
- Our role
- Readiness and remediation; not a C3PAO
At a glance
Defense manufacturers that handle Controlled Unclassified Information must implement NIST SP 800-171 under DFARS 252.204-7012 and now meet CMMC requirements in new DoD contracts. CyberAccord assesses your gaps, helps write the system security plan, remediates and manages the controls, and prepares your evidence. Certification assessments are performed by an authorized C3PAO, not by us.
DFARS 252.204-7012 and CMMC (32 CFR Part 170)
The obligations you face
Each point below rests on a primary source. Follow the link to read the rule itself.
Adequate security means NIST SP 800-171
DFARS 252.204-7012 requires contractors to provide adequate security for covered defense information, which includes implementing NIST SP 800-171. It also requires reporting cyber incidents to DoD within 72 hours of discovery, preserving images of affected systems for at least 90 days, and flowing the clause down to subcontractors whose work involves that information.
Your score must be current and posted
DFARS 252.204-7019 requires offerors that must implement NIST SP 800-171 to have a current assessment, not more than three years old, with summary scores posted in the Supplier Performance Risk System. A score that does not match reality is a contractual and legal risk, not only a security one.
CMMC turns self-attestation into assessed status
The CMMC Program rule sets three levels. Level 1 covers the basic safeguarding requirements for Federal Contract Information. Level 2 covers the requirements of NIST SP 800-171 Revision 2, assessed either by the contractor itself or by an authorized C3PAO, depending on the contract. A senior affirming official must affirm continuing compliance.
Contracts now require a current CMMC status
DFARS 252.204-7021 makes the required CMMC status a condition of award and requires contractors to maintain it for the duration of the contract, with affirmations of continuous compliance. DoD is phasing the requirement into solicitations over several years, so the level you need depends on each contract.
Sources last reviewed . This page explains obligations in general terms and is not legal advice.
Recommended services
What we recommend
Three services, most relevant first, chosen for the obligations above.
- 1 · Virtual CISOvCISOA part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership.
- 2 · Managed Security ServicesManaged SecurityManaged device, email, cloud app, and AWS security, with a team that monitors alerts and responds to incidents for you.
- 3 · Cloud SecurityCloud SecurityAWS and Azure security assessments and architecture reviews that find misconfigurations and give you a prioritized plan to fix them.
Frameworks that apply
FAQ
Sector questions, answered
Is CyberAccord a C3PAO or a CMMC Registered Practitioner Organization?
No. We do not perform CMMC certification assessments and do not issue a CMMC status. We help you prepare: gap assessment against NIST SP 800-171, the system security plan, remediation, and the evidence an assessor will request. The certification assessment itself must come from an authorized C3PAO.
Which CMMC level do we need?
It depends on the information in your contracts. If you handle only Federal Contract Information, Level 1 applies. If you handle Controlled Unclassified Information, expect Level 2, either self-assessed or C3PAO-assessed as the solicitation specifies. Your contracting officer and prime contractor set the requirement.
NIST released SP 800-171 Revision 3. Which one do we follow?
The CMMC Program rule incorporates Revision 2, published in 2020, and DoD assessments use it. Revision 3, published in May 2024, is the current NIST release. Build to Revision 2 for CMMC, and track Revision 3 so a future change in DoD requirements does not catch you out.
Can we limit the scope to part of our network?
Yes, and it is usually the most practical route. Keeping Controlled Unclassified Information in a defined enclave, such as a separate cloud tenant built for it, reduces the systems, people and cost an assessment has to cover.
What is a plan of action and milestones, and can we use one?
It is a documented plan for requirements not yet met. CMMC allows a limited plan of action for certain requirements to reach a conditional status, which must then be closed out within the rule's deadline. Some requirements cannot be deferred this way.
Talk to a security practitioner
Tell us what is driving the need: an audit, a client questionnaire, a contract clause or an insurance renewal. We'll recommend a scoped next step with a fixed quote.