CMMC 2.0 does not have a chapter called software supply chain. Its requirements come from NIST SP 800-171, and the supply chain practices that support them are inventory of what you run, controlled change, flaw remediation, access control on build systems and logs you can show an assessor.
What is CMMC 2.0, in one paragraph?
CMMC is the Defense Department's program for verifying that contractors protect the information they handle. The program rule is 32 CFR Part 170, published in October 2024 and effective 16 December 2024 according to law firm summaries, which also describe a four phase rollout. Your contract names the level you must meet. Check the contract and the current rule text rather than relying on a summary, including this one.
The practical requirements for protecting controlled unclassified information come from NIST SP 800-171. NIST states that these requirements apply to all components of nonfederal systems that handle that information, plus components that protect them. Note that NIST has withdrawn Revision 2 in favor of Revision 3, so confirm which revision your contract and assessor use.
Where does supply chain work show up?
NIST organizes SP 800-171 by control families such as Access Control, Audit and Accountability, Configuration Management, and System and Information Integrity. Four supply chain activities map to those families in a way an assessor will recognize. Treat the mapping as a starting point and confirm exact requirement numbers in the publication.
Know what you run (Configuration Management). A software bill of materials for each system that handles controlled information is the cleanest answer to "what is installed and what is it made of." It is also the input to every other activity here.
Control how it changes (Configuration Management). Show that production changes come through a reviewed pipeline, that build definitions are version controlled, and that third-party build steps are pinned to specific versions. The tj-actions incident in March 2025 showed what happens when pipeline dependencies are floating references.
Fix known flaws on a schedule (System and Information Integrity). Evidence is a record of flaws found, the decision made on each and the date closed. Reachability analysis helps you document why a flaw in an unused code path is lower priority, but record the reasoning and a review date.
Limit and log access (Access Control, Audit and Accountability). Build systems, registries and secrets stores are privileged. Show who has access, that it is reviewed, and that actions are logged and retained.
Open the framework mapping demo
What about suppliers and subcontractors?
Your own dependencies and vendors are part of your system. NIST's supply chain risk guidance, SP 800-161 Revision 1, addresses risks from products and services that may contain malicious functionality or be vulnerable through poor development practices. Use it to shape how you vet vendors, but do not assume it replaces the 800-171 requirements your contract names.
Where a vendor handles controlled information for you, expect the assessor to ask how you know their environment meets the same bar. Keep their attestations and your review notes together.
Evidence an assessor can follow
Aim for one folder per requirement area, each with a short narrative, the artifact and a date. Compliance automation can gather artifacts such as scan results and access lists, but an assessor will still want a person who can explain the control. No software certifies you for CMMC; assessments are done under the program's own process.
What to do
- Read your contract and the current 32 CFR Part 170 text to confirm your level.
- Confirm which revision of NIST SP 800-171 your assessor uses.
- Generate an SBOM for each system in scope.
- Pin and review build pipeline dependencies, and put build definitions under version control.
- Keep a remediation log with decision, owner and closure date.
- Review access to build, registry and secrets systems on a schedule.
- Store each artifact with a short narrative and a date.
Quick check
Is there a separate CMMC rule for software supply chain?
No. The requirements come from NIST SP 800-171. Supply chain practices are how you produce evidence for several of its control families.
Can a scanner make us CMMC compliant?
No. A scanner produces evidence for some controls. Compliance is determined through the CMMC assessment process, not by a tool.
Sources
- NIST SP 800-171 Revision 2
- NIST SP 800-161 Revision 1
- Greenberg Traurig: DoD publishes final CMMC program rule
- CISA alert on the tj-actions compromise
Last reviewed: 18 October 2026.
