CMMC is the US Department of Defense program for verifying that contractors protect federal contract information and controlled unclassified information. For a VP of engineering the decisions are where that data lives, which systems are in scope, and whether to build a separate enclave. Settle those before you buy tools.
What is CMMC built on?
The higher CMMC levels draw on the NIST SP 800-171 requirements for protecting controlled unclassified information in nonfederal systems. NIST publishes that document, now in Revision 3. If you want to know what engineering will be asked, read the NIST text, because the assessment tests your implementation of those practices.
Program rules, level definitions and contract clause timing are set by DoD rulemaking. I could not retrieve the current DoD program page for this post, so check the DoD CIO CMMC site and your contracting officer for the latest effective dates and which level your contracts require. Dates have moved before.
Which decision matters most?
Scope. Anything that stores, processes or transmits controlled unclassified information, plus systems that protect it, is in the assessment boundary. A constructed example: a manufacturer receives drawings by email and keeps them in a shared drive that also holds sales files, and engineers sync that drive to laptops. Every laptop, the mail system, the sync client and the identity provider are now in scope.
Moving the controlled data into a dedicated enclave, with its own identity boundary, managed devices and logging, can shrink the boundary dramatically. It also forces discipline about what leaves the enclave.
Which practices land on engineering?
NIST SP 800-171 groups requirements into families that include access control, audit and accountability, configuration management, identification and authentication, incident response, system and communications protection, and system and information integrity. In engineering terms:
- Enforce MFA and least privilege on every account that can reach the data.
- Baseline and track configuration, and remove unneeded software and ports.
- Log security events, protect the logs and review them.
- Encrypt the data in transit and at rest, with documented key handling.
- Patch and scan on a defined schedule, and prove you did.
- Have an incident response plan that you have exercised.
Software supply chain evidence matters too, since vulnerable components in systems that handle the data are an integrity problem.
What goes wrong in practice?
Scope creep is the usual culprit. Someone forwards a controlled drawing to a personal mailbox, or a build server caches files from the controlled share, and suddenly systems nobody planned for hold regulated data. Preventing it takes technical controls, not memos: data loss rules at the mail gateway, restricted sync clients and clear labels on controlled data.
The second problem is evidence. A practice that is implemented but not documented does not pass an assessment. Write the system security plan as you build, not afterward, and attach the artifacts: configurations, screenshots with dates, logs, training records. Engineers who keep these as they go avoid a painful scramble when the assessor arrives.
How to check or apply this
- Identify every contract with a DFARS or CMMC clause, and read what level and data type it names.
- Map where that data enters, moves and rests. Include email and personal devices.
- Decide between a whole-company boundary and an enclave. Cost both.
- Read NIST SP 800-171 Rev 3 and score yourself against each requirement, with evidence.
- Write the system security plan and plan of action for gaps.
- Choose an assessor path appropriate to your required level, confirmed against current DoD rules.
- Reassess whenever the scope or toolchain changes.
Safeguard's dependency scanning and compliance automation can help organize evidence for patching and inventory items. No tool makes you CMMC certified; the assessment decides that.
Quick check
Is CMMC the same as NIST SP 800-171?
No. NIST SP 800-171 is the set of security requirements. CMMC is the DoD program that verifies implementation of them.
Can an enclave reduce CMMC scope?
It can, if the controlled data genuinely stays inside it and the boundary is documented and enforced. Confirm the approach with your assessor.
Sources
- NIST SP 800-171 Rev. 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- DoD Acquisition, Safeguarding Covered Defense Information and Cyber Incident Reporting
- Current CMMC level and effective-date details need checking on the DoD CIO site, which could not be fetched here.
Last reviewed: 18 October 2026.
