CMMC Compliance Guide for Defense Contractors
What MSPs serving defense contractors need to know about CMMC Level 2 — requirements, assessment, and the role of the MSP.
The Cybersecurity Maturity Model Certification (CMMC) is now a reality for defense contractors. Any organization handling Controlled Unclassified Information (CUI) as part of a DoD contract must achieve CMMC Level 2 certification — which maps directly to the 110 controls in NIST SP 800-171. For MSPs serving defense contractors, this creates both a significant opportunity and a significant responsibility.
What CMMC Level 2 Requires
CMMC Level 2 requires implementation of all 110 security controls in NIST SP 800-171, organized across 14 control families:
Access Control (22 controls) · Awareness and Training (3) · Audit and Accountability (9) · Configuration Management (9) · Identification and Authentication (11) · Incident Response (3) · Maintenance (6) · Media Protection (9) · Personnel Security (2) · Physical Protection (6) · Risk Assessment (3) · Security Assessment (4) · System and Communications Protection (16) · System and Information Integrity (7)
The MSP's Role
As the IT provider managing the contractor's environment, you are part of the assessment scope. Your security practices, your platform's security controls, and your operational procedures all factor into the contractor's CMMC assessment. This means:
You need your own security: Your MSP's internal security practices must meet CMMC-level requirements. If you have weak access controls in your own environment, that's a finding for your client.
Your platform matters: The platform you use to manage the client's environment must support CMMC controls: comprehensive audit logging, access controls, encryption, monitoring, and incident response. Multi-tenant separation must be strong enough that other clients' data doesn't intermingle with CUI.
Documentation is critical: The CMMC assessment is evidence-based. For each control, you need documentation showing: what the control is, how it's implemented, and evidence that it's operating effectively. Your platform's compliance module should generate much of this evidence automatically.
Practical Approach
Start with a gap analysis: map your current security posture against all 110 NIST SP 800-171 controls. Identify gaps. Prioritize remediation based on the controls your client's CMMC assessor will examine most closely (access control, audit logging, and incident response are the most scrutinized). Plan for 6-12 months of preparation before the assessment.