CMMC is the US Defense Department's model for checking that contractors protect federal contract information and controlled unclassified information. For a product manager, the key decisions are which data your product will handle, which CMMC level the contract requires, and where the assessment boundary sits.
Why does a product manager care about a security model?
Because the requirement attaches to data and systems, not to a team. If your product, or the service you sell, stores or processes covered information for a defense customer, product choices become scope choices. A new analytics export, a support tool that receives log files, a third-party hosting region: each can pull a system into the assessment boundary.
The model itself is written into federal regulation. Section 170.14 of 32 CFR describes where the requirements come from: Level 1 uses the basic safeguarding clause at 48 CFR 52.204-21, Level 2 uses NIST SP 800-171 Revision 2, and Level 3 adds selected requirements from NIST SP 800-172.
What do the three levels mean in practice?
Level 1 is the shortest list. The rule says the requirements are the fifteen items in the basic safeguarding clause, and the organization must meet all of them. Section 170.15 states that no plans of action are allowed at Level 1, that the self-assessment is repeated every year, and that results go into the Supplier Performance Risk System with an affirmation.
Level 2 is, in the regulation's words, identical to the requirements in NIST SP 800-171 Revision 2. If your team already maps controls to that publication, you have a head start. Level 3 is selected from NIST SP 800-172 and applies to the most sensitive programs. Treat it as a customer-driven exception, not a product roadmap item.
Which decisions belong on the product roadmap?
Three decisions are product decisions, even if security does the work.
First, whether to build a separate environment for defense customers. A dedicated, smaller boundary is often cheaper to assess than a shared platform where every service might touch covered data.
Second, which subprocessors and open source components sit inside that boundary. Every one needs an owner who can answer an assessor's question about how it is configured and updated.
Third, whether the contract flows requirements down to you or from you. Prime contractors pass obligations to suppliers, so a customer questionnaire may arrive before you think you are in scope. Ask the customer which data types the contract names, in writing.
A constructed example
Suppose your team ships a collaboration tool. A defense prime wants to use it for engineering drawings that are marked as controlled. The cheap path looks like turning on a customer setting. The real question is whether the tool's search index, backups, error reports and support access all keep that data inside systems you can describe and evidence. If error reports go to a general telemetry vendor, that vendor is now in the conversation.
What to do
- Ask the customer which contract clause and data category apply, and which CMMC level the solicitation names.
- Draw the data flow for that data: where it enters, rests, is processed, backed up and deleted.
- Mark every system and vendor on the flow as in scope, and decide whether to isolate them in a dedicated environment.
- Compare current practices with NIST SP 800-171 Revision 2 for Level 2 work, and write down gaps with owners and dates.
- Name one person who owns evidence collection so engineers are not interrupted ad hoc.
- Check the current rollout dates on the Defense Department site before you commit to a timeline, since phases have shifted.
Safeguard can help with the dependency side: scanning your software inventory and mapping findings to framework controls through compliance automation. It does not certify anyone, and an assessment is a separate process.
Quick check
Does CMMC apply to every company that sells to the US government?
No. It applies to contractors that handle federal contract information or controlled unclassified information on the contract, and the level depends on the data and the solicitation.
Can a Level 1 gap be left open with a plan of action?
No. Section 170.15 says no plans of action and milestones are permitted for Level 1.
Sources
- 32 CFR 170.14, CMMC Model (eCFR)
- 32 CFR 170.15, Level 1 self-assessment (eCFR)
- DoD CIO, CMMC program page
Last reviewed: 18 October 2026.
