A US defence customer has asked about CMMC. The first step is to understand the contractual requirement and the information your organisation handles, before committing to a remediation programme.
ProtectifyAI provides readiness consultancy to help identify the relevant environment, evaluate gaps and coordinate practical improvement work. CMMC readiness starts with contract interpretation and information flow, not with buying a compliance platform or copying a control spreadsheet.
This service is for UK and European defence manufacturers, engineering firms, software vendors and specialist subcontractors that sell into the US Department of Defense supply chain. The usual buyer is a managing director, bid lead, security manager or CTO after a US prime contractor asks for CMMC status, NIST SP 800-171 alignment, a Supplier Performance Risk System (SPRS) score or evidence about Controlled Unclassified Information (CUI).
It is particularly useful for a supplier with a mixed corporate and engineering estate, remote staff, outsourced IT or a US customer that has not clearly explained the boundary. We help determine whether the organisation handles Federal Contract Information (FCI), CUI or neither, and whether a proposed enclave, cloud service or subcontractor changes the scope. CMMC is not automatically applicable to every UK company that wants to sell to America.
The urgent moment is often a procurement email: “Confirm your CMMC level and assessment date,” “provide your NIST 800-171 score,” or “tell us how CUI is protected.” A supplier may have ISO 27001, Cyber Essentials Plus or strong engineering security, but still be unable to say which systems store contract information, who can access it, or how evidence maps to the required practices.
We turn the request into a written scope and decision log. That avoids a common and expensive mistake: certifying an entire business when a properly separated CUI enclave could reduce the assessment boundary, or claiming a narrow boundary that does not reflect how people, endpoints and suppliers actually work.
They ask about the applicable contract clauses, FCI and CUI categories, system security boundaries, authentication, access control, audit logging, configuration, vulnerability handling, incident response, media protection, personnel security, physical safeguards and supplier dependencies. A C3PAO or other assessment activity will expect evidence that practices operate in the defined environment, not just policies signed by an executive.
Examples include a current asset and data-flow inventory, account and privileged-access records, multifactor authentication configuration, vulnerability remediation tickets, secure configuration baselines, event-log review, incident reports and exercises, backup or media handling records, security training and a plan of action and milestones. The exact assessment route and requirements must be checked against current programme material and the contract; an acronym in a questionnaire is not enough.
We review the customer request, contract language and proposed assessment route, then interview business, engineering, IT and security owners. We map where FCI or CUI enters, is processed, stored and leaves the organisation, including email, developer tooling, endpoints, cloud services, removable media and subcontractors. We identify the people, systems and facilities that belong in the boundary and document exclusions with reasons.
Next, we assess practices against the applicable CMMC requirements and identify existing evidence from ISO 27001, access reviews, change records, vulnerability management, incident exercises and supplier governance. Where evidence is missing, we create a remediation register with owner, dependency, target date and proof of completion. We can support System Security Plan content, POA&M preparation where permitted, evidence organisation, control-owner workshops and a pre-assessment interview. Technical engineering, legal contract interpretation and the formal assessment are separately scoped.
A typical engagement produces a contract and applicability memo; FCI/CUI information-flow map; system boundary and asset inventory; responsibility matrix; practice-by-practice gap assessment; evidence request and index; System Security Plan support; POA&M or remediation tracker; supplier and cloud-service review; and an assessment-readiness report. We also provide an executive briefing that states what is in scope, what remains open and what a supplier can accurately say to a prime.
For example, an evidence index might link an MFA practice to identity-provider configuration, a quarterly privileged-account review and two removal tickets. A logging practice might link to the scoped cloud account, retention setting, alert review and incident exercise. These links are more credible than a screenshot folder with no owner, date or system context.
Contract and scope confirmation plus a gap assessment commonly takes three to six weeks. The first week confirms the request and data categories; weeks two and three map systems and interview owners; the final weeks test evidence and produce the remediation plan. Remediation often takes three to nine months, depending on enclave design, identity and endpoint debt, cloud architecture, supplier changes and the prime’s deadline.
Assessment scheduling, customer commitments and any C3PAO relationship should be managed early. We can help prepare the team to explain how practices work, but readiness support does not guarantee an assessment outcome.
A manufacturer might discover that CUI is downloaded to engineering laptops and forwarded to a general-purpose collaboration tenant, widening the boundary beyond the server named in its proposal. A software supplier might have strong code review but no documented CUI flow through its issue tracker. A small subcontractor may have MFA enabled but no evidence of quarterly access review or incident reporting. In each case, the answer is a scoped design and operating change, not a new policy alone.
No. The relevant US defence contract, Federal Contract Information or Controlled Unclassified Information flow, and supply-chain obligations are central to determining the requirement.
No. Existing controls may support preparation, but the applicable CMMC practices, assessment method and evidence still need to be addressed.
Scoping and a gap assessment commonly take three to six weeks. Remediation is often three to nine months, depending on the enclave, technical debt and customer deadline.
The customer request or relevant contract clauses, a high-level architecture diagram and an explanation of the information involved. Do not send sensitive contract data through the public enquiry form.
See the official CMMC programme for current programme material.
Book a working session to talk through the request, the scope and where to start.
Book a working session →