How CMMC lands on different kinds of companies: small businesses, manufacturers and machine shops, managed service providers, cloud and SaaS providers, and COTS suppliers.
What CMMC means for a small defense contractor: DoD's small-entity cost estimates for each level, the assumption that small firms rely on outside providers, NIST's position on size, SBIR concerns raised in rulemaking, and the Government's implementation cost estimates.
CMMC for manufacturers that hold drawings and specifications: why controlled technical information triggers Level 2, how shop-floor OT and test equipment are scoped, enduring exceptions, special circumstances under DFARS 7012, and where NIST MEP centers help.
How CMMC applies to managed service and managed security providers: when an MSP counts as an ESP, staff augmentation, security protection data, being assessed inside each customer's scope, voluntary certification, responsibility matrices and tool choices.
What SaaS and cloud vendors must show defense customers: FedRAMP Moderate or equivalent for CUI, why CMMC does not certify cloud services, the ESP scoping table, how assessors verify authorization or equivalency, and the separate rules for clouds run for DoD.
When suppliers of commercially available off-the-shelf items are exempt from CMMC, DFARS 7012 and FAR 52.204-21, why using COTS products in your own systems is not exempt, how primes decide what to flow down, and the 2028 clause date.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.