CMMC Compliance: Cutting Through the Confusion for Defense Contractors

Watch the Session

Cheri and Paula discuss common CMMC misconceptions, NIST SP 800-171, CMMC levels, scoping, Controlled Unclassified Information (CUI), System Security Plans, evidence, remediation, assessment readiness, cost and ROI, shared responsibility, GRC technology, continuous monitoring, and how CMMC should fit into a broader cybersecurity and compliance program.

A Note on Current CMMC Requirements

This session was recorded in March 2025. CMMC implementation details have continued to evolve since the recording. Organizations should verify current assessment, contractual, and implementation requirements against their solicitation or contract and current official CMMC guidance rather than relying on an older rollout schedule.

The Short Answer

CMMC is not simply paperwork and it is not a certification an organization should pursue by buying a tool, downloading a policy package, or rushing through a checklist.

CMMC is designed to provide assurance that organizations handling certain federal information have implemented the cybersecurity practices required for that environment.

Successful CMMC readiness therefore requires understanding contractual requirements, defining the correct scope, identifying where sensitive information lives and flows, assessing existing controls, remediating gaps, documenting how processes actually operate, collecting appropriate evidence, preparing the people involved in those processes, and continuing to operate the program after the assessment is complete.

Key Takeaways

• CMMC is not just another checkbox exercise. Its requirements are intended to protect sensitive federal information and establish meaningful cybersecurity practices.
• CMMC is not only an issue for large defense contractors. Requirements can affect smaller organizations and subcontractors throughout the defense supply chain.
• There is no CMMC easy button. Technology can help, but tools cannot replace physical security, policies, risk management, change management, training, documentation, ownership, and other required processes.
• Existing frameworks do not automatically satisfy CMMC. SOC 2, ISO 27001, and other programs may provide useful overlap, but CMMC has its own requirements and assessment expectations.
• Scoping is critical. Organizations need to understand exactly where CUI is handled, stored, processed, transmitted, and protected.
• Documentation must match reality. Writing a policy or procedure does not prove the organization actually performs it.
• Evidence matters. Assessors need more than statements that a control exists; organizations need evidence demonstrating that the practice is implemented.
• CMMC should make business sense. Organizations should understand the revenue opportunity, implementation cost, ongoing operating cost, staffing needs, and opportunity cost associated with maintaining the program.
• Certification is not the end. Cybersecurity controls, documentation, monitoring, training, risk management, and remediation need to continue operating over time.

What Is CMMC?

The Cybersecurity Maturity Model Certification, or CMMC, is designed to provide greater assurance that organizations in the defense industrial base are implementing required cybersecurity practices for protecting federal information.

The program addresses two important information types:

• Federal Contract Information (FCI)
• Controlled Unclassified Information (CUI)

The required CMMC level and assessment approach depend on the information involved and the requirements associated with the applicable defense contract or solicitation.

Is CMMC Just Another Compliance Checkbox?

No — and treating it that way undermines much of the value of the program.

As Paula explains in the session, CMMC requirements represent baseline security practices organizations should be considering to protect networks, information, and business operations — not merely government data.

Cheri makes the same distinction she frequently makes across compliance frameworks: cybersecurity and compliance are different disciplines, but the intent behind security compliance is still to create better protection.

That is the same reason passing a cybersecurity audit does not automatically mean the organization is secure.

Is CMMC Only for Large Defense Contractors?

No.

Small and midsize organizations can also become part of the defense supply chain and may receive CMMC-related requirements through contracts and subcontract relationships.

That is one reason CMMC can be particularly challenging for smaller businesses. The cybersecurity expectations can be substantial even when the organization itself is relatively small.

The program therefore needs to be approached strategically: understand the contractual requirement, determine what information the organization will handle, define the appropriate scope, and understand what maintaining that environment will require.

Can You Buy a Tool That Makes You CMMC Compliant?

No.

Tools can make CMMC work more efficient, but no single platform can perform every responsibility required to operate the program.

CMMC involves areas such as:

• Technical security controls
• Physical security
• Policies and procedures
• Human resources processes
• Risk management
• Change management
• Security awareness training
• Incident response
• Asset management
• Documentation
• Evidence and ongoing monitoring

A tool may support many of those activities, but someone still has to design, implement, operate, document, monitor, and improve the processes around it.

If You Already Have SOC 2 or ISO 27001, Do You Still Need to Prepare for CMMC?

If CMMC is required for the applicable work, another framework does not automatically replace it.

The good news is that existing cybersecurity and compliance programs can provide a significant foundation.

Many frameworks address similar domains such as access control, risk, incident response, asset management, security awareness, configuration, vulnerability management, and governance.

The better approach is not to run CMMC in a separate silo. Organizations should identify where existing controls satisfy overlapping requirements, determine where CMMC requires additional specificity, and integrate those requirements into one broader Cyber GRC operating model.

Is CMMC the Same Thing as NIST SP 800-171?

They are closely connected, but they should not be treated as identical concepts.

CMMC Level 2 is built around the 110 security requirements in NIST SP 800-171 Revision 2.

Where organizations often become surprised is the level of evidence and assessment detail needed to demonstrate that those requirements are actually implemented.

A high-level statement that “we do access control,” “we manage configurations,” or “we perform risk assessments” is not enough. The organization needs to understand the detailed practices underneath the requirement and be able to demonstrate how they operate.

How Do the CMMC Levels Work?

CMMC Level 1

Level 1 focuses on basic safeguarding of Federal Contract Information and uses an annual self-assessment and affirmation model.

CMMC Level 2

Level 2 focuses on broader protection of Controlled Unclassified Information and aligns with the 110 security requirements in NIST SP 800-171 Revision 2. Depending on the applicable requirement, the assessment may be a self-assessment or an independent C3PAO assessment.

CMMC Level 3

Level 3 addresses higher-level protection of CUI against more advanced threats and involves government assessment. Organizations should pursue the level required for their business and contractual environment rather than assuming a higher level is automatically better.

Should Every Contractor Try to Reach CMMC Level 3?

Not simply for the sake of being an overachiever.

The appropriate level should connect to the organization's contractual requirements and business strategy.

Moving into a more demanding maturity level can require additional investment, controls, technical capabilities, documentation, people, and ongoing operating effort.

A certification level by itself does not create revenue. The organization still needs a realistic market and contracting strategy that justifies the investment.

Does CMMC Make Financial Sense for Every Business?

Not necessarily.

One of the strongest points in the session is that organizations should evaluate the business case before committing significant resources to a CMMC environment.

The calculation should consider more than the assessment itself.

Potential costs include:

• Readiness and gap assessments
• Technical remediation
• New security technology
• Policies and documentation
• Internal staff time
• External expertise
• Training
• Assessment preparation
• Ongoing program administration
• Continuous monitoring and remediation
• Opportunity cost from employees being pulled away from other responsibilities

If the revenue opportunity connected to defense work does not justify that investment, leadership should understand that before committing to the program.

How Long Does CMMC Readiness Take?

There is no universal timeline.

An organization with a mature security program, strong documentation, clear CUI boundaries, established policies, and well-operated controls will have a very different readiness effort from an organization beginning with little cybersecurity structure.

Readiness can require months of work and, for organizations beginning with significant technical and process gaps, potentially much longer.

The important lesson is to avoid waiting until a contract opportunity creates an emergency. Scoping, remediation, documentation, process implementation, training, evidence collection, and assessment preparation all require time.

What Should the CMMC Readiness Process Look Like?

At a high level, Cheri and Paula outline a practical progression:

1. Confirm the business and contractual requirement.
2. Define the CMMC scope.
3. Identify where CUI is stored, processed, and transmitted.
4. Perform a detailed gap assessment.
5. Identify technical and process remediation.
6. Develop or improve the SSP, policies, and procedures.
7. Implement what the documentation says.
8. Gather and organize evidence.
9. Train employees and control owners.
10. Prepare for assessment interviews and demonstrations.
11. Continue operating and monitoring the program afterward.

Skipping the implementation step is particularly dangerous. Documentation that describes a process the organization does not actually perform can create a major problem during assessment.

Why Is CMMC Scoping So Important?

Scoping determines which people, systems, devices, facilities, services, and other assets are part of the environment subject to the CMMC assessment.

That makes scoping one of the most important early decisions in the readiness process.

Organizations first need to understand:

• Who receives or uses CUI?
• Where is CUI stored?
• Which systems process it?
• How is it transmitted?
• Which security systems protect it?
• Which facilities are involved?
• Which third parties interact with the environment?
• Where does the information move throughout its lifecycle?

An unnecessarily broad scope can substantially increase the number of systems, users, processes, and assets that need to meet the applicable CMMC requirements.

Should You Put Your Entire Company in CMMC Scope?

Not automatically.

Good cybersecurity practices may deserve to be applied broadly across the organization, but that is different from declaring every employee, device, application, and location part of the formal CMMC assessment boundary.

The organization should understand its CUI environment and design the assessment boundary intentionally rather than defaulting to “everything is in scope.”

Why Does Asset Management Matter for CMMC?

You cannot accurately define or protect an environment if you do not know what exists inside it.

Asset management means more than relying on a discovery tool to identify whatever happens to be connected to the network today.

A meaningful lifecycle may include:

• Acquisition
• Inventory
• Ownership
• Deployment
• Configuration
• Maintenance
• Repair
• Storage
• Decommissioning
• Disposal

That full lifecycle perspective is important because CMMC readiness depends on understanding what assets actually interact with or protect the scoped environment.

What Is a CUI Data Flow Diagram?

A CUI data flow diagram helps show where Controlled Unclassified Information enters the environment, where it travels, where it is processed, where it is stored, which systems interact with it, and where it leaves.

The purpose is not simply to create an impressive technical diagram.

The organization needs to demonstrate that it understands the information it is protecting and how that information moves through internal and external systems.

What Is a System Security Plan?

The System Security Plan, or SSP, is one of the central documents in a CMMC environment.

It describes the system environment and how the organization implements relevant security requirements.

But the SSP should not be treated as a document written once for an assessment and forgotten afterward.

It is a living representation of the environment. When systems, processes, responsibilities, boundaries, or security practices change, the documentation needs to remain aligned with reality.

Why Must CMMC Documentation Match What You Actually Do?

Because an assessor can validate the implementation.

Organizations sometimes begin with generic policy packages, templates, or automated documentation and assume the written process is enough.

It is not.

Cheri describes the approach as “trust but verify.” The written control, procedure, or policy should tie to evidence showing what actually happens in the environment.

What Evidence Is Needed for CMMC?

Evidence depends on the requirement being evaluated.

Examples may include:

• Policies
• Procedures
• System configurations
• Screenshots
• Logs and reports
• Training records
• Access records
• Asset inventories
• Risk assessments
• Data flow diagrams
• Demonstrations
• Interviews with employees responsible for the process

Paula describes assessment evidence in terms of both adequacy and sufficiency: the evidence needs to demonstrate that the practice exists and that it is implemented to the extent required across the applicable environment.

Why Do Employee Interviews Matter During a CMMC Assessment?

Because cybersecurity processes are operated by people.

An organization may have strong documentation, but if the people responsible for a process do not understand their responsibilities or describe a completely different workflow, that can expose a gap between written policy and actual practice.

Assessment readiness therefore includes preparing control owners and relevant employees to understand the process they actually perform — not coaching them to memorize an answer that is disconnected from reality.

What Are Common CMMC Readiness Gaps?

Cheri and Paula identify several recurring weaknesses:

• Poorly defined scope
• Incomplete or weak SSPs
• Policies that do not match actual practice
• Incomplete procedures
• Weak asset management
• Insufficient risk-management processes
• Weak change-management practices
• Inconsistent configuration management
• Incomplete security-awareness programs
• Insufficient incident-response planning
• Missing evidence
• Controls that exist in documentation but are not consistently implemented

The exact gaps vary by organization, but the recurring theme is the same: CMMC evaluates an operating security program, not simply a collection of documents.

How Mature Does a CMMC Program Need to Be?

Organizations do not need to turn every required security process into the most sophisticated program imaginable on day one.

A process needs to meet the applicable requirement and operate effectively for the organization.

From there, the organization can improve maturity over time.

For example, an incident-response process might begin with a clear and tested plan. Over time, the organization may add more detailed playbooks, automation, exercises, monitoring, metrics, and other capabilities as risk, budget, and business needs justify them.

What Should Organizations Expect From a CMMC Assessment?

Where an independent assessment is required, organizations should expect much more than submitting a few policies and receiving a certificate.

The assessment process can involve:

• Review of the assessment scope
• CUI data flows
• Asset inventories
• The SSP
• Responsibility matrices
• Policies and procedures
• Detailed evidence supporting applicable requirements
• Interviews
• Demonstration or examination of how practices operate

The readiness process should therefore prepare the organization to demonstrate its security program — not simply explain what it intends to do.

How Should You Choose a CMMC Assessor?

Where a C3PAO assessment applies, the assessment organization matters.

Paula recommends asking meaningful questions about how the assessor approaches cybersecurity and assessments rather than simply looking for whoever appears most likely to provide an easy result.

An assessment should provide credible assurance that the required practices are actually operating. Choosing an assessor solely because the process appears unusually lax defeats much of the purpose of independent validation.

What Is a Shared Responsibility Matrix?

Many organizations rely on managed service providers, cloud providers, security vendors, consultants, and other third parties to operate portions of the environment.

A shared responsibility matrix helps define who is responsible for what.

For example:

• What does the MSP operate?
• What does the contractor operate?
• Who monitors the control?
• Who retains evidence?
• Who responds when something fails?
• Where does responsibility remain shared?

Outsourcing an activity does not automatically outsource accountability. Organizations need to understand what the third party does and what remains their responsibility.

Can a GRC Tool Help Manage CMMC?

Yes — when the tool supports the program rather than pretending to replace it.

An appropriate GRC platform may help organizations:

• Manage requirements
• Map controls across frameworks
• Assign ownership
• Store evidence
• Track findings and remediation
• Monitor recurring activities
• Maintain a system of record
• Support reporting
• Reduce duplicated work across multiple frameworks

The same principle applies when organizations choose a GRC platform: the operating model and desired outcomes should drive the technology decision, not the other way around.

Why Should CMMC Be Integrated With the Rest of the GRC Program?

Running CMMC as a completely separate compliance program creates unnecessary duplication.

The organization may already have controls supporting SOC 2, ISO 27001, customer requirements, risk management, or other cybersecurity obligations.

Instead of creating a second version of access control, security awareness, incident response, risk management, asset management, and other processes solely for CMMC, organizations should identify the common control environment and layer framework-specific requirements onto it.

Is CMMC a One-Time Certification Project?

No.

The underlying cybersecurity practices need to remain in place after the readiness effort or assessment is complete.

That includes activities such as:

• Maintaining the SSP
• Updating policies and procedures
• Monitoring security controls
• Maintaining asset inventories
• Conducting security awareness training
• Managing vulnerabilities
• Maintaining configurations
• Evaluating risk
• Managing incidents
• Tracking remediation
• Responding to changes in systems, people, vendors, and the business

As Cheri puts it in the session, cybersecurity compliance is a program that has to be run. It is not something the organization completes once and puts back on the shelf.

Why Does Continuous Monitoring Matter?

Controls eventually fail, environments change, and documented processes can drift away from reality.

Continuous or recurring monitoring helps organizations discover those changes before the next assessment does.

That may include confirming:

• Assets remain configured as expected
• Required training is completed
• Access remains appropriate
• Policies still match the environment
• Security practices continue operating
• Known gaps are being remediated
• Changes have been reflected in the SSP and other documentation

The organization should expect the CMMC environment to change and build processes for keeping the program aligned with those changes.

What Should Organizations Do Now?

1. Confirm the requirement. Understand what your contracts, solicitations, customers, or prime contractors actually require.
2. Evaluate the business case. Understand the revenue opportunity and the true cost of building and operating the required environment.
3. Understand your CUI. Know what information you receive, where it resides, how it moves, and who needs access.
4. Define scope intentionally. Do not automatically put the entire organization into the assessment boundary.
5. Assess your current state. Compare existing technical and process controls with the applicable requirements.
6. Remediate the real gaps. Implement missing technology, processes, governance, and documentation rather than simply writing around the problem.
7. Make documentation match reality. Policies, procedures, diagrams, inventories, and the SSP should accurately describe the environment.
8. Organize evidence early. Know how you will demonstrate each applicable practice before assessment preparation becomes an emergency.
9. Prepare your people. Employees and control owners should understand the security processes they actually perform.
10. Integrate CMMC into the broader program. Reuse controls and evidence across frameworks where appropriate.
11. Plan to operate it continuously. Certification or assessment readiness should be one milestone in a long-term cybersecurity program.

Frequently Asked Questions

What Is CMMC?

CMMC is the Cybersecurity Maturity Model Certification program used to provide assurance that defense contractors and subcontractors implement required cybersecurity practices for protecting Federal Contract Information and Controlled Unclassified Information.

Who Needs CMMC?

CMMC requirements depend on the applicable defense contract or solicitation and the information involved. Contractors and subcontractors should evaluate their specific contractual requirements rather than assuming CMMC applies only to large prime contractors.

Is CMMC Only for Large Companies?

No. Small and midsize organizations can also be part of the defense industrial base and may receive cybersecurity requirements through direct contracts or subcontract relationships.

Can Software Make a Company CMMC Compliant?

Software can support CMMC activities such as evidence management, monitoring, control mapping, workflow, and reporting, but it cannot replace the people, processes, physical safeguards, policies, risk management, training, governance, and operating practices required by the program.

Is CMMC the Same as NIST SP 800-171?

CMMC Level 2 incorporates the 110 security requirements from NIST SP 800-171 Revision 2, but CMMC adds an assessment and affirmation structure for demonstrating implementation.

What Is CMMC Scoping?

CMMC scoping identifies the people, systems, assets, facilities, services, and security resources that handle, process, store, transmit, or protect the federal information included in the applicable environment.

What Is an SSP in CMMC?

A System Security Plan describes the system environment and how applicable security requirements are implemented. It should remain aligned with the actual environment and be updated as the system and processes change.

Does ISO 27001 or SOC 2 Automatically Satisfy CMMC?

No. Existing frameworks may provide substantial overlap and reusable controls, but CMMC has specific requirements and assessment expectations that still need to be evaluated.

How Long Does CMMC Readiness Take?

It depends heavily on the organization's starting maturity, technical environment, CUI scope, documentation, existing controls, staffing, budget, and remediation needs. Organizations with significant gaps should expect readiness to require substantial planning and implementation rather than treating it as a last-minute exercise.

Is CMMC a One-Time Certification?

No. The security practices underlying CMMC must continue operating over time. Organizations need ongoing monitoring, documentation maintenance, training, remediation, risk management, and compliance activities after the initial readiness or assessment effort.

About This Session

This article is based on the Hotman Group session CMMC Compliance: Cutting Through the Confusion, featuring Cheri Hotman and Paula.

The session addresses common misconceptions about CMMC and provides practical guidance on contractual requirements, CUI, NIST SP 800-171, scoping, readiness assessments, remediation, documentation, evidence, System Security Plans, assessment preparation, cost, ROI, GRC technology, and continuous monitoring.

Because CMMC implementation requirements continue to evolve, organizations should verify current contractual and assessment requirements before relying on historical rollout dates discussed in older CMMC resources.

When to Bring in Hotman Group

Organizations often bring in Hotman Group when CMMC requirements are becoming real but the path from current-state cybersecurity to an assessment-ready, sustainable program is unclear. HG can help when:

• The organization needs to understand what CMMC will require from its current environment.
• CUI scope has not been clearly defined.
• The team needs an evidence-based gap assessment against applicable requirements.
• An SSP, policies, procedures, data-flow diagrams, or other documentation needs to be created or corrected.
• Existing documentation does not match how controls actually operate.
• Technical and process remediation needs to be prioritized and coordinated.
• The organization needs help preparing evidence and control owners for assessment.
• CMMC is being managed separately from SOC 2, ISO 27001, or other cybersecurity frameworks and the organization wants a more efficient multi-framework approach.
• Leadership needs to understand the cost, staffing, timeline, and business implications of pursuing or maintaining a CMMC environment.
• The organization wants experienced Cyber GRC support to help turn CMMC from an assessment project into a sustainable operating program.

Hotman Group helps organizations scope, assess, design, remediate, document, implement, prepare, and operate cybersecurity and GRC programs while connecting compliance requirements to actual security practices and business objectives.

Talk With Hotman Group About CMMC

About Hotman Group

Hotman Group is a cybersecurity and Cyber GRC professional-services firm that helps organizations diagnose, design, build, remediate, implement, operate and mature cybersecurity programs. HG provides hands-on vCISO and vGRC leadership, supports multi-framework environments, and helps organizations select and implement GRC technology while connecting cybersecurity decisions to business risk and strategy.

Hotman Group helps defense contractors approach CMMC as an operating cybersecurity and GRC program — including scoping, gap assessment, remediation, documentation, controls, evidence, ownership, monitoring, assessment preparation, and integration with other frameworks.

The objective is not simply to reach the assessment. It is to build a security program capable of demonstrating that required practices are operating because those practices are actually part of how the organization works.

Talk With Hotman Group