CMMC Readiness: What Defense Contractors Actually Do
CMMC Level 2 is not a checklist. It is a documentation and control-operating discipline that takes 12 to 18 months to build correctly.
Published September 15, 2025 by Megan Fulton.
Category: Compliance
CMMC readiness is not a documentation exercise. Defense contractors who approach the Cybersecurity Maturity Model Certification by assembling policies and completing a gap checklist consistently find that what they have built does not survive contact with a Certified Third-Party Assessment Organization. C3PAOs assess whether controls are actually operating, not whether organizations have documented their intention to operate them.
What defense contractors actually do — the organizations that achieve and maintain CMMC certification — looks different from what compliance consultants often describe. This is an account of the operational realities.
Starting with the Right Scope
CMMC applies to the environments that handle Controlled Unclassified Information. The first and most important decision in any CMMC program is defining that environment precisely — the systems, personnel, and locations that are in scope. A scope that is too broad creates unnecessary compliance burden. A scope that is too narrow creates assessment risk.
Most defense contractors should begin by identifying every system that touches CUI — storage, transmission, and processing — and drawing a clear boundary around those systems. Everything outside the boundary should be physically and logically separated from everything inside it. Reducing the CUI environment is always less expensive than expanding it.
Access Control in Practice
Access control is the most commonly assessed domain and the most commonly finding-generating domain in CMMC assessments. C3PAOs look specifically for:
- Documented least privilege — every user account should have only the access required to perform their job function, and that access should be reviewed regularly
- Privileged account management — elevated access should be time-limited, logged, and reviewed
- Remote access controls — multi-factor authentication required for all remote access to CUI systems
- Session termination — automatic session timeout configured and enforced
- Access review evidence — documented reviews of who has access to what, conducted on a defined schedule
Configuration Management Done Right
Configuration management failures are the second-most common source of CMMC findings. The requirement is not to have a configuration management policy — it is to have a defined baseline, a change control process, and evidence that changes to the environment were authorized, tested, and documented. Organizations frequently have the first element and lack the second and third.
Incident Response: The Gap No One Prepares For
CMMC requires incident response plans that are tested, not just documented. C3PAOs verify that the organization has conducted tabletop exercises or simulations that validate the plan's effectiveness. An organization that has a polished incident response document but has never exercised the plan will receive a finding.
System and Communications Protection
Encryption requirements under CMMC apply to CUI at rest and in transit. FIPS 140-2 validated encryption is required, not optional. Organizations that have implemented encryption using non-FIPS-validated algorithms — a common configuration in environments that predated the CMMC requirement — will need to migrate.
What Ongoing Compliance Looks Like
CMMC is not a one-time certification. Level 2 certifications require reassessment every three years, and organizations must maintain continuous compliance between assessments. C3PAOs conducting reassessments look at the period since the last assessment, not just the current state. An organization that was compliant at assessment and then drifted will receive findings on reassessment.
VioletX works with defense contractors to build CMMC programs that are operationally sustainable — not just assessment-ready at a single point in time.