# Security for defense manufacturers and their suppliers > Defense manufacturers that handle Controlled Unclassified Information must implement NIST SP 800-171 under DFARS 252.204-7012 and now meet CMMC requirements in new DoD contracts. CyberAccord assesses your gaps, helps write the system security plan, remediates and manages the controls, and prepares your evidence. Certification assessments are performed by an authorized C3PAO, not by us. Source: https://www.cyberaccord.com/industries/defense-manufacturing ยท Last reviewed: 2026-10-22 If you handle Controlled Unclassified Information on a DoD contract, DFARS 252.204-7012 requires NIST SP 800-171 and CMMC adds assessment and affirmation. We help contractors close the gaps and prepare the evidence before an assessment. ## Key facts - **Contract clause:** DFARS 252.204-7012 - **Control set:** NIST SP 800-171 Revision 2 for CMMC Level 2 - **Incident reporting:** To DoD within 72 hours of discovery - **Our role:** Readiness and remediation; not a C3PAO ## The obligations and risks you face ### Adequate security means NIST SP 800-171 DFARS 252.204-7012 requires contractors to provide adequate security for covered defense information, which includes implementing NIST SP 800-171. It also requires reporting cyber incidents to DoD within 72 hours of discovery, preserving images of affected systems for at least 90 days, and flowing the clause down to subcontractors whose work involves that information. Source: [DFARS 252.204-7012 (May 2024)](https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.) ### Your score must be current and posted DFARS 252.204-7019 requires offerors that must implement NIST SP 800-171 to have a current assessment, not more than three years old, with summary scores posted in the Supplier Performance Risk System. A score that does not match reality is a contractual and legal risk, not only a security one. Source: [DFARS 252.204-7019 (Nov 2023)](https://www.acquisition.gov/dfars/252.204-7019-notice-nistsp-800-171-dod-assessment-requirements.) ### CMMC turns self-attestation into assessed status The CMMC Program rule sets three levels. Level 1 covers the basic safeguarding requirements for Federal Contract Information. Level 2 covers the requirements of NIST SP 800-171 Revision 2, assessed either by the contractor itself or by an authorized C3PAO, depending on the contract. A senior affirming official must affirm continuing compliance. Source: [32 CFR Part 170 (CMMC Program)](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170) ### Contracts now require a current CMMC status DFARS 252.204-7021 makes the required CMMC status a condition of award and requires contractors to maintain it for the duration of the contract, with affirmations of continuous compliance. DoD is phasing the requirement into solicitations over several years, so the level you need depends on each contract. Source: [DFARS 252.204-7021 (Nov 2025)](https://www.acquisition.gov/dfars/252.204-7021-contractor-compliance-cybersecurity-maturity-model-certification-level-requirements.) ## What we recommend - [vCISO](https://www.cyberaccord.com/services/advisory/vciso) - [Managed Security](https://www.cyberaccord.com/services/managed-security) - [Cloud Security](https://www.cyberaccord.com/services/cloud-security) ## Applicable frameworks - [NIST](https://www.cyberaccord.com/compliance/nist) ## Frequently asked questions ### Is CyberAccord a C3PAO or a CMMC Registered Practitioner Organization? No. We do not perform CMMC certification assessments and do not issue a CMMC status. We help you prepare: gap assessment against NIST SP 800-171, the system security plan, remediation, and the evidence an assessor will request. The certification assessment itself must come from an authorized C3PAO. ### Which CMMC level do we need? It depends on the information in your contracts. If you handle only Federal Contract Information, Level 1 applies. If you handle Controlled Unclassified Information, expect Level 2, either self-assessed or C3PAO-assessed as the solicitation specifies. Your contracting officer and prime contractor set the requirement. ### NIST released SP 800-171 Revision 3. Which one do we follow? The CMMC Program rule incorporates Revision 2, published in 2020, and DoD assessments use it. Revision 3, published in May 2024, is the current NIST release. Build to Revision 2 for CMMC, and track Revision 3 so a future change in DoD requirements does not catch you out. ### Can we limit the scope to part of our network? Yes, and it is usually the most practical route. Keeping Controlled Unclassified Information in a defined enclave, such as a separate cloud tenant built for it, reduces the systems, people and cost an assessment has to cover. ### What is a plan of action and milestones, and can we use one? It is a documented plan for requirements not yet met. CMMC allows a limited plan of action for certain requirements to reach a conditional status, which must then be closed out within the rule's deadline. Some requirements cannot be deferred this way. ## Contact CyberAccord - Book a free consultation: https://www.cyberaccord.com/contact - Phone: +1 (832) 429-5665 - Email: info@cyberaccord.com