The first useful response to a CMMC request is to clarify what the customer requires. Starting with a generic checklist can leave a supplier implementing controls across the wrong environment or overlooking a relevant dependency.
Use official programme material alongside the actual contractual requirement to establish the assessment route. US Department of Defense CMMC programme.
Ask for the relevant contract wording, required level or status, timing and the part of your service to which it relates. If the request came through a questionnaire, establish whether it is a preference, a future expectation or a contract condition.
Do not assume that an informal answer from one salesperson overrides contractual terms. Record who has confirmed the interpretation and what still needs specialist clarification.
Draw the path from the customer to your organisation and onward to any approved suppliers. Consider email, file transfer, shared workspaces, engineering tools, support systems and backups.
For each step, identify the information involved and who can access it. This helps reveal where the practical environment differs from the high-level architecture diagram.
A separate environment can sound simple on paper. Ask how people administer it, where logs and backups go and which external services support it. Shared identities or management tools can create dependencies that need assessment.
The objective is not to make the diagram look smaller. It is to establish a defensible scope that reflects the rules and actual operation.
Existing ISO 27001 work may provide useful risk, access and supplier evidence. Reuse it only after checking the requirement, scope and expected evidence. A policy title that resembles a requirement is not enough to establish readiness.
Organise gaps by owner, dependency and completion evidence. Avoid treating an unresolved item as automatically deferrable; any permitted treatment must be checked against the applicable assessment rules.
Readiness support helps you understand and address gaps. The required independent assessment, where applicable, follows its own authorised route. Confirm credentials and role boundaries before contracting with a provider.
ProtectifyAI offers CMMC readiness consultancy for UK and European suppliers. Bring the requirement and a non-sensitive system overview to the initial discussion so the work starts with the right questions.
No. Applicability depends on the contract, information involved and flow of Federal Contract Information or Controlled Unclassified Information.
No. ISO 27001 evidence may support readiness, but it does not replace the CMMC requirements or assessment route.
Scoping and a gap assessment commonly take three to six weeks; remediation often takes three to nine months depending on the enclave, technical debt and customer deadline.
We'll help you clarify the requirement, follow the information and establish a defensible boundary.
Book a working session →