CMMC
How the Department of Defense verifies that a supplier handling FCI or CUI has done what NIST SP 800-171 asks, and what status, affirmation, and flow-down mean in practice.
CMMC is the Department of Defense programme that verifies a contractor has implemented the security requirements for handling Federal Contract Information and Controlled Unclassified Information. The programme is defined in 32 CFR part 170 and reaches a contract through DFARS clause 252.204-7021, which names the level required.
A tiered certification that verifies a contractor has implemented the security practices required to handle Federal Contract Information and Controlled Unclassified Information.
US Department of Defense
Defense contractors and subcontractors handling Federal Contract Information or Controlled Unclassified Information, per 32 CFR part 170.
Assessment status is recorded against your organization in SPRS. Levels and assessment type are set by the clause in your award.
Contractors and subcontractors in the defense industrial base whose contracts include the relevant DFARS clauses.
| Requirement | Module | What It Does |
|---|---|---|
| Access to controlled records is a setting, not a habit | Engineering | Prints, routings, bills of material, and job records sit behind role-based permissions with tenant isolation enforced at the data layer and single sign-on in front of it, so an assessor looking at access control is looking at configuration rather than at a story about folder conventions. An assessor can be shown the role, the permission set behind it, and the users holding it, which is a different conversation from describing an intention. Once you have identified which drawings and records are CUI, WorkCell is where that decision becomes enforceable: the permission set is the marking that matters to an assessor, because it governs who can open the record rather than describing who should. |
| An audit trail on the transactions that matter | Analytics | Changes to bills of material, routings, jobs, inventory, and postings are attributable to a user and a timestamp, which is a concrete answer when an assessment interview turns to accountability for changes in the system holding your controlled data. The trail is queryable and exportable through the REST API and webhooks, so it feeds whatever monitoring stack sits inside your boundary rather than becoming a second island of evidence. |
| A smaller scope to assess | Production | Scheduling, operator entries, inspection results, and costing on one database means fewer systems, shares, and spreadsheets inside the boundary you have to define, document, and have assessed. Deployment can be cloud or on premises, and on premises keeps controlled data inside your own perimeter rather than introducing an external service provider. Drawing the boundary and deciding what is in it is work only you can do. |
| One list of users, roles, and leavers | Workforce | Employees are records, roles attach to them, and single sign-on means authentication lives where your identity provider lives. That makes an access review something you can run from the system instead of reconstructing from three tools, and offboarding one change instead of four. The policies, training, and the authorizations behind each role are yours, and the assessment itself is performed on you, not on us. |
| Subcontractor records in one place before you award | Purchasing | The supplier catalog, purchase orders, and receipts give you a single list of who you buy from and what you sent them, which is where the flow-down question starts. DFARS 252.204-7021 requires a prime to ensure a subcontractor has the appropriate CMMC status before award where the subcontract involves FCI or CUI. The supplier catalog is where that status is recorded and where approval is granted per part and per process, so the flow-down check happens in your supplier approval process before the part number ever reaches a purchase order. |
| Quality records treated as controlled data too | Quality | CUI is rarely confined to the drawing. Inspection results, first article data, nonconformance reports, and supplier documents frequently carry controlled technical information, and in WorkCell they sit under the same permission model as everything else rather than in a separate quality share with its own rules. Which of those records is actually CUI remains a determination you make and document. |
DFARS 252.204-7021 has the contracting officer insert one of CMMC Level 1 (Self), CMMC Level 2 (Self), CMMC Level 2 (C3PAO), or CMMC Level 3 (DIBCAC). The contractor must have and maintain that status, or higher, for the duration of the contract, and must process, store, or transmit FCI or CUI only on information systems that carry it. The level is not something you choose; it arrives in the solicitation.
The clause requires the contractor to provide the contracting officer the CMMC UIDs issued by SPRS for the information systems that will process, store, or transmit FCI or CUI, and to report changes during performance. That makes the system inventory a contractual artifact rather than an internal document, and it means adding a new system to the boundary is a reportable event.
Status alone is not enough. The clause requires an affirmation of continuous compliance to be completed on an annual basis and maintained as current. An affirming official signs it, which is why the underlying evidence has to be kept live rather than assembled once for an assessment and allowed to drift until the next one.
CMMC assesses implementation of NIST SP 800-171, and those two documents are where implementation is described and where gaps are tracked. DFARS subpart 204.75 distinguishes conditional status, valid for a limited period, from final status that can run up to three years, which is the mechanism by which open items in a plan of action get closed on a clock rather than carried indefinitely. Both documents describe your estate, not your vendor's: the ERP instance, the file share, the email tenant, the machine tool controllers on the network, and every laptop that opens a drawing at home. A plan that names none of those specifically will not survive the walkthrough, because the assessor works from what is actually in front of them and asks why it is not in the document. The same applies in reverse, since a system listed in the plan but long since retired reads as a programme nobody maintains.
The prime inserts the substance of 252.204-7021 in subcontracts and other contractual instruments where the subcontract will involve processing, storing, or transmitting FCI or CUI, and ensures the subcontractor has the appropriate CMMC status before award. For a tier-two shop, that is the route by which CMMC arrives without any direct contract with the Government.
What are the CMMC levels?
DFARS 252.204-7021 names four requirements a contracting officer can insert: CMMC Level 1 (Self), CMMC Level 2 (Self), CMMC Level 2 (C3PAO), and CMMC Level 3 (DIBCAC). The parenthetical is the assessment type, so the same level can be self-assessed or assessed by a third party.
What is the difference between conditional and final CMMC status?
Duration and completeness. DFARS subpart 204.75 treats conditional status as valid for a limited period, up to 180 days, while a final status can run up to three years depending on assessment type. Conditional status is what you hold with open items still tracked in a plan of action and milestones.
Is WorkCell CMMC certified?
No. CMMC status attaches to a contractor's information systems and is recorded against that contractor in SPRS; CMMC status belongs to a contractor, not to a product. What WorkCell brings to your assessment is the access control, the audit trail, the smaller boundary, and the single user list an assessor tests, plus a SOC 2 programme we will walk your security reviewer through under NDA.
When does CMMC actually apply to our contracts?
When the clause is in the solicitation. The programme's phase-in has been revised more than once, so read 252.204-7021 and the DFARS prescription in the award in front of you rather than trusting any vendor page, including this one, about the current schedule.
Do we need a third-party assessment or can we self-assess?
It depends on what the contracting officer inserted. Level 1 is self-assessed. Level 2 appears in the clause both as a self-assessment and as a C3PAO assessment, and Level 3 is assessed by DIBCAC. The contract decides, not your preference or your assessor's availability.
Can a system get us through a CMMC assessment?
No, and a vendor who says otherwise is selling something. An assessor examines your boundary, your practices, your plan, and your evidence. Software can keep access tight, hold an audit trail, and reduce the number of systems in scope. It cannot hold a status or sign an affirmation for you.
Keep the records as the work happens.
The assessment is performed on your organisation, not on your vendor. What WorkCell can do is keep the controlled records in one system with permissions and an audit trail, so there is less sprawl in the boundary you have to defend.