When a customer sends a security questionnaire and CMMC 2.0 is in play, answer only what you can evidence, name the standard you align to, and never imply an assessment you have not had. Defense customers read answers closely, and an overclaim can create contract risk, not just a lost deal.
Why do CMMC and questionnaires collide?
Prime contractors have to flow requirements down to subcontractors, so they ask. The questions often borrow wording from NIST SP 800-171, which NIST describes as requirements for protecting controlled unclassified information in nonfederal systems. The program rule is 32 CFR Part 170. Your contract and the current rule text say which level applies, so check them before you answer a single line.
What is the difference between aligned, assessed and certified?
These three words get blurred in questionnaires, and the blur is where trouble starts.
- Aligned: You have mapped your controls to the requirements and can show how each is met. This is a statement about your design.
- Assessed: An assessor evaluated you under the program's process. Say who, when and at what level.
- Certified: A formal outcome of an assessment under the program. If you do not hold it, do not write it.
If you are in progress, write "in progress" and give the plan. A truthful gap with a dated plan is a better answer than a vague yes.
How do we write each answer?
Use one pattern for every row: a direct answer, one sentence on how, and a pointer to evidence. For example: "Yes. Administrative access to production requires multi-factor authentication, reviewed quarterly. Evidence: access review record, Q3." Keep the evidence reference real, with a document name and a date.
When the honest answer is "partly," split it. Say what is covered, what is not and when the rest lands. Reviewers trust a split answer more than a clean yes they cannot verify.
How do we keep answers consistent?
Inconsistent answers get noticed. One customer reads your questionnaire next to your website and the next customer's version. Keep a single source of truth: a library of approved answers, each with an owner, an evidence link and a review date. Retire answers when the underlying control changes. A short claims review before anything goes out catches the usual problems, such as certification language, inflated counts and numbers nobody can source.
Which questions deserve a human expert?
Send these to someone who knows the systems, not to a template: where controlled information is stored and processed, how subcontractors are handled, incident reporting commitments, and anything about encryption or key management. Those answers can bind you in a contract.
What about software supply chain rows?
Expect questions about inventory, vulnerability management and build security. A software bill of materials per system answers the inventory question, and a remediation log answers the vulnerability one. If you use reachability analysis to prioritize, describe the method and keep the record of each decision.
What to do
- Confirm the applicable level from your contract and the current 32 CFR Part 170.
- Build an answer library with owner, evidence link and review date per answer.
- Use the words aligned, assessed and certified exactly, and never claim a status you do not hold.
- Write every answer as direct answer, how, evidence.
- Split partial answers into covered, not covered and timeline.
- Route storage, subcontractor, incident and encryption rows to a named expert.
- Review each outgoing questionnaire against your public pages for consistency.
Quick check
Can we say we are CMMC compliant if we follow NIST SP 800-171?
Say what is true: that you align to the requirements. Do not describe it as certified or assessed unless the program's assessment process has produced that outcome.
What if we only meet half of a requirement?
Answer partly. State what is covered, what is not and the date the gap closes, and attach evidence for the covered part.
Sources
Last reviewed: 18 October 2026.
