CMMC and NIST 800-171 for small businesses. What's required and where to start (2026)

The CMMC clause is showing up in contracts, and prime contractors are asking their subs for SPRS scores. "We'll deal with it later" has run out.

Here's where the rollout stands. The DFARS rule that puts CMMC into contracts took effect November 10, 2025, starting Phase 1. The Department of Defense suspended Phase 2 on July 13, 2026, and as of mid-October no new start date had been announced. Self-assessments, the DFARS 7012 contract clause, and SPRS reporting are all still in effect.

A pause isn't a repeal. Your contracts, your prime's flow-down clauses, and your annual affirmations still bind you. This guide covers who needs CMMC, what's required, what assessors look for, and a realistic first 90 days.

Who needs CMMC compliance?

CMMC applies to DoD prime contractors and subcontractors at every tier that handle FCI or CUI. That includes small manufacturers, machine shops, and engineering firms. If the requirement is in your contract, or in your prime's flow-down clause, it applies to you. Company size doesn't change that. Neither does being three tiers down the supply chain.

You likely need CMMC if

• Your contracts or purchase orders include DFARS 252.204-7012 (the Defense Federal Acquisition Regulation Supplement clause on safeguarding defense information) or DFARS 252.204-7021 (the CMMC clause).
• You receive drawings, specs, or technical data marked "CUI" or "Controlled."
• You handle export-controlled data under ITAR (International Traffic in Arms Regulations).
• A prime contractor has asked for your SPRS score or CMMC status.
• You're bidding on DoD work, directly or as a sub.
• Your contracts include FAR 52.204-21, the basic safeguarding clause for FCI.

FCI vs. CUI in plain English

FCI is non-public information the government gives you, or that you create, under a contract. For example, a purchase order showing part numbers, quantities, and delivery dates.

CUI is more sensitive information the government says must be protected, even though it isn't classified. For example, a technical drawing for a military aircraft bracket, marked CUI.

Why "we're just a sub" doesn't work

Primes are responsible for their supply chain, so they push requirements down through flow-down clauses. If your customer has the clause, they'll pass it to you.

The Defense Industrial Base (DIB) is only as secure as its weakest supplier. Primes know that, and they're asking.

What are the CMMC levels?

CMMC has three levels. Level 1 protects FCI with basic safeguards and an annual self-assessment. Level 2 protects CUI with all 110 NIST SP 800-171 controls, assessed by you or by a certified third-party assessor depending on the contract. Level 3 covers critical programs, adds selected NIST SP 800-172 controls, and requires a government-led assessment.

A C3PAO (CMMC Third-Party Assessment Organization) is an accredited company that performs certification assessments. DIBCAC (the Defense Industrial Base Cybersecurity Assessment Center) is the government team that performs Level 3 assessments. The levels are set out in the 32 CFR Part 170 program rule.

With Phase 2 suspended, new third-party (C3PAO) and Level 3 requirements are on hold. That doesn't change what Level 2 asks you to implement.

Most small and mid-sized suppliers land at Level 2

If you touch CUI, plan for Level 2. That's where most small and mid-sized defense suppliers end up, and it's where the real work is.

What's an SPRS score?

Your SPRS score is your NIST 800-171 self-assessment score, posted in the Supplier Performance Risk System. The maximum is 110, and every unmet control subtracts points.

How POA&Ms work now

A POA&M (Plan of Action and Milestones) lists the controls you haven't met yet and when you'll fix them. The rules are tight. To get conditional status, you generally need at least 80% of the Level 2 score (88 of 110), only certain low-point controls can be deferred, and everything must be closed within 180 days, under 32 CFR 170.21.

After any assessment, a senior official at your company must sign an affirmation, a formal statement that you meet the requirements. Treat that signature seriously. A false affirmation is a legal problem, not an IT problem.

What are the 14 NIST 800-171 control families?

NIST SP 800-171 groups its 110 requirements into 14 families. Together they cover who can access data, how activity is logged, how systems are configured, how people are trained, and how incidents are handled. Assessors check that every requirement is actually implemented and backed by evidence, not just described in a policy.

NIST SP 800-171 (from the National Institute of Standards and Technology) is the rulebook. CMMC Level 2 currently assesses against Revision 2, even though NIST has published Revision 3.

Where small companies struggle most

Four families cause most of the pain.

• Audit & Accountability (AU). Logs exist, but nobody keeps them or reviews them. At Headway, we retain security logs in a SIEM (security information and event management system) for 365 days, which maps directly to this family.
• Identification & Authentication (IA). MFA (multi-factor authentication) is on for email but not for VPN, admin accounts, or the shop-floor PC.
• Configuration Management (CM). Every laptop was set up a little differently, and no one wrote down the standard.
• System & Communications Protection (SC). CUI travels over a flat network with no segmentation, and encryption isn't FIPS-validated.

Personnel Security and Access Control also trip up companies during offboarding. If a former employee still has a working login, that's a finding.

What evidence do CMMC assessors expect?

Assessors use three methods. They examine documents, interview people, and test systems. They want a System Security Plan, policies and procedures, and proof that controls actually run, such as logs, screenshots, configuration exports, and training records. A policy without evidence counts as not implemented. Paperwork alone fails.

The core artifacts assessors ask for

1. System Security Plan (SSP), how each of the 110 controls is implemented in your environment.
2. Network and CUI boundary diagram.
3. Asset inventory (every device, server, and cloud service in scope).
4. Policies and procedures.
5. POA&M for any open items.
6. Audit logs.
7. MFA enforcement reports.
8. Security training records.
9. Incident response test record.

Examine, interview, test

Examine means reading your documents and checking they match reality. Interview means asking your people how things actually work, and their answers need to match your SSP. Test means watching a control run, such as trying to log in without MFA.

The objectives they check against come from NIST SP 800-171A, which breaks each control into specific assessment objectives. If one objective isn't met, the control isn't met.

Why automated evidence matters

The most common mistake I see is treating CMMC as a writing project. Companies spend months on well-written policies, then can't show a single log proving any of it happens.

Policies on paper fail assessments. Enforced controls pass them. When controls are enforced by configuration, evidence can be collected automatically, and the assessment becomes a report you pull instead of a scramble. That was a core piece of our work in case HS-1108, covered below.

What are the most common CMMC gaps for small companies?

The gaps assessors see most are CUI scattered across commercial email and file shares, MFA missing on some systems, shared accounts, logs not kept, unmanaged personal devices, policies written but not enforced, and no tested incident response plan. Most of these are fixable. All of them are expensive to discover during the assessment itself.

• CUI everywhere. Drawings live in commercial email, personal OneDrive, and a shared drive. Fix. Move CUI into one controlled environment.
• Partial MFA. MFA on email only. Fix. Enforce MFA through conditional access on every account and remote connection.
• Shared accounts. "Shop1" and "admin" logins used by several people. Fix. Unique, named accounts for everyone.
• No log retention. Logs roll over after a few days. Fix. Centralize logs and keep them.
• Personal devices. Employees open CUI on home laptops and phones. Fix. Block unmanaged devices from CUI.
• Written, not enforced. The policy says "encrypt laptops," but nothing checks. Fix. Enforce settings through device management.
• Untested incident response. The plan exists but has never been run. Fix. Run a tabletop exercise and keep the record.
• No asset inventory. Nobody knows what's in scope. Fix. Build and maintain a living inventory.

Almost every gap on this list is the distance between what a document says and what a device actually does.

Do you need GCC High for CMMC?

Often, though not always. Microsoft 365 GCC High is a separate government cloud with U.S. data residency, access limited to screened U.S. personnel, and support for DFARS 7012 and ITAR requirements.

DFARS 7012 requires any cloud provider storing CUI to meet security equal to the FedRAMP Moderate baseline (the federal cloud security standard). Standard commercial Microsoft 365 generally doesn't meet that bar for CUI. Some companies with non-export-controlled CUI may be able to use Microsoft 365 GCC, but if you handle ITAR or export-controlled data, GCC High is usually the answer.

Buying GCC High licenses doesn't make you compliant. It gives you a compliant platform. You still have to configure it, enforce it, and keep CUI inside it.

Where should a small company start with CMMC?

Start in this order. Confirm your required level, find where CUI lives, shrink the CUI boundary, run a gap assessment against the 110 controls, write the SSP and POA&M, fix the gaps, collect evidence, then book the assessment. Expect months, not weeks. Steps one through five usually fit inside your first 90 days.

Eight-step CMMC readiness roadmap

*Timeframes are typical ranges, not promises. Your starting point and scope drive the actual timeline.

Enclave vs. whole-company scope

An enclave is a separate, locked-down environment where only the people and systems that need CUI can reach it. Everything else in the business stays out of scope.

Whole-company scope means every system is in scope. That's simpler to explain but often more expensive to secure. For many small companies, a tight enclave is the faster, cheaper path.

RPO vs. C3PAO

A Registered Practitioner Organization (RPO) is a company authorized by the Cyber AB (the CMMC accreditation body) to help you prepare. A C3PAO is the company that assesses you. An RPO can't certify you. You can look up both on the Cyber AB marketplace.

Headway runs GCC High migrations for defense suppliers, and case HS-1108 shows what that work looks like in practice.

Case HS-1108. Defense manufacturing, 9 months

How much does CMMC compliance cost?

Cost depends on your scope, your current maturity, and your assessment type. The big buckets are remediation (tools, GCC High licensing, configuration), documentation, ongoing monitoring, and the C3PAO assessment. DoD's own rule estimates a small business Level 2 certification assessment at about $101,752. Ongoing compliance costs more than the one-time assessment.

DoD's published estimates in the 32 CFR Part 170 rule cover the assessment, not the work to get ready for it. Your remediation and ongoing operations will usually be the larger number.

Where the recurring cost hides

Recurring cost often grows when security is sold as an add-on, when each new control brings a separate project quote, and when the monthly bill rises every time the assessor asks for something new. Ask any provider how those costs are handled before remediation starts.

An all-in managed price that already includes the security stack (MFA, device management, logging, patching) takes one of the biggest recurring buckets off the table. See what that covers on our cybersecurity page.

Frequently asked questions

Start now

Know your level. Your contracts and flow-downs decide it, not your company size.

Shrink the boundary, then enforce it and prove it. The smaller your CUI footprint, the less you have to secure and prove. Policies on paper fail. Enforced controls with evidence pass.

The assessor won't grade on effort.