CMMC or ISO 27001: which one your contracts actually require
If a defense solicitation names CMMC, the contract requires it whenever your work involves Federal contract information (FCI) or Controlled Unclassified Information (CUI). ISO/IEC 27001 is voluntary unless a commercial customer writes it into their terms. The CMMC level is not yours to choose. Under 32 CFR 170.5(b), the DoD program manager or requiring activity sets the status for each procurement, based on factors such as mission criticality, the threat of losing FCI or CUI, and the impact of exploited weaknesses. Level 3 is generally reserved for the most critical programs and technologies.
Pursue CMMC first when your defense work touches CUI, because the Level 2 requirements are the ones a contract will test. The current picture is unsettled. On 13 July 2026 the Department of War suspended CMMC Phase II, which would have required Level 2 C3PAO certification for applicable contracts, and opened a 60-day review. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations still apply. Read the solicitation to see whether it calls for a self-assessment or a certification assessment, and ask the contracting officer if the clause is unclear.
ISO 27001 becomes the commercial driver when most of your revenue comes from customers who ask for an accredited ISMS certificate and defense work is limited or absent. Many suppliers need both. An ISO certificate does not satisfy a CMMC requirement, because Level 2 assesses the NIST SP 800-171 Rev. 2 requirements under 32 CFR Part 170, so plan the two scopes separately. Before you start, ask each commercial customer in writing whether a certificate is required, and check the current CMMC status in each solicitation you bid on.
How CMMC and ISO 27001 differ on scope, proof and status
This table compares what each program requires, what it verifies, who sets the level and what document or certificate results. Read it as a map of obligation versus choice: CMMC is a condition in defense contracts that handle FCI or CUI, while ISO/IEC 27001 is a voluntary management system certificate that a company can pursue for any reason.
| Dimension | CMMC (32 CFR Part 170) | ISO/IEC 27001:2022 |
|---|---|---|
| Legal basis | Federal rule at 32 CFR Part 170, put into contracts through DFARS clause 252.204-7021 and provision 252.204-7025 | Voluntary international standard; no government rule requires it |
| Who requires it | DoD contracts and subcontracts that involve FCI or CUI, as set by the program or requiring activity | Customers, partners or the company itself, as a commercial or internal choice |
| What is verified | Level 2: the 110 NIST SP 800-171 Rev. 2 requirements, assessed against NIST SP 800-171A objectives | An information security management system (ISMS) against the clauses of the standard and the 93 Annex A controls, within a defined scope |
| Who chooses the level | The DoD program manager or requiring activity, based on factors such as mission criticality and threat (32 CFR 170.5(b)) | The organization chooses its scope, risk criteria and which Annex A controls apply, but cannot drop clauses 4 to 10 from a conformity claim |
| Scope basis | CUI assets, security protection assets and other categories defined in 32 CFR 170.19(c) | The organization, location or service, as set in the ISMS scope statement |
| Who assesses | Self-assessment at Level 2 for applicable contracts, or a C3PAO for certification assessments; DCMA DIBCAC at Level 3 | Accredited certification bodies operating to ISO/IEC 17021-1 and ISO/IEC 27006-1 |
| What is issued | A self-assessment result posted to SPRS and an affirmation, or a certification assessment result under the CMMC program | A third-party ISMS certificate with a three-year cycle and annual audits |
| Voluntary or mandatory | Mandatory for the contracts that include the clause; status depends on the phase in effect, so confirm the current requirement with the contracting office | Voluntary; a company may hold it without any defense contract |
What CMMC verifies that ISO 27001 does not
CMMC Level 2 verifies a fixed set of technical and procedural requirements, not an organization-wide management system. Under 32 CFR 170.14(c)(3), the Level 2 requirements are identical to NIST SP 800-171 Revision 2, counted as 110 requirements in 32 CFR 170.4, and organized into 14 CMMC domains. Each requirement is judged against the assessment objectives in NIST SP 800-171A, and a requirement is MET only when every applicable objective is satisfied with evidence in final form, not drafts. ISO/IEC 27001:2022 works differently. It requires an information security management system across clauses 4 to 10, plus the Annex A controls that clause 6.1.3 asks you to select and justify. A supplier can hold an ISO 27001 certificate and still fail a CMMC assessment, because the ISO certificate does not test each CUI requirement against final evidence.
The scope rules are where the two diverge most for a manufacturer. ISO/IEC 27001:2022 scope can be narrowed by organization, location or service, but excluding any requirement in clauses 4 to 10 is not acceptable for a conformity claim. CMMC scope is set by asset category under 32 CFR 170.19(c): CUI assets face all requirements, while assets physically or logically separated from CUI assets are out of scope. Before you commit to either, map which systems actually store, process or transmit CUI and which only connect to them. An ISO scope drawn around a business unit may cover systems that CMMC never touches, and a CMMC boundary may cut through systems your ISMS treats as one unit.
Confirm three things with your DoD customer and your certification body before you plan. First, ask the requiring activity which CMMC level it has assigned to each procurement, since the program manager chooses the status under 32 CFR 170.5(b). Second, confirm the current status of Level 2 certification timing, because the Department of War suspended Phase II on 13 July 2026, and check the DoW CIO About CMMC page for the latest position. Third, ask your ISO certification body how it will treat CUI-scoped systems inside the ISMS, so that one set of evidence can answer both audits without duplicated effort.
How scoping differs: CUI asset categories versus ISMS scope
CMMC Level 2 draws its boundary by asset category around where CUI is stored, processed and transmitted. An ISO/IEC 27001 certificate draws its boundary around the organization, locations or services the ISMS covers. The cards below show the CMMC categories and the ISO scoping rule they should be checked against.
CUI assets in full assessment
Under 32 CFR 170.19(c), CUI assets are assessed against all Level 2 requirements. These are the systems that store, process or transmit CUI, and they set the core of a CMMC boundary. For ISO 27001, the equivalent question is whether these systems fall inside the ISMS scope statement, since clause 4.3 requires the scope to be documented. Ask the assessor which systems they consider CUI assets before you build the diagram.
Security protection assets
Security protection assets, such as directory, logging, and security tooling that protects CUI assets, are assessed against the requirements relevant to them rather than the full set. Teams often under-scope these because they are not where CUI sits. Under an ISMS, the same tooling usually sits inside scope as a supporting service, so one inventory can serve both programs. Confirm with the assessor which requirements apply to each protection asset.
Contractor risk managed assets
Contractor risk managed assets are not assessed against individual requirements. Instead, the system security plan records how the contractor manages the risk they carry. This is the category where CMMC documentation does most of its work. In an ISO 27001 audit, a comparable asset is handled through the risk assessment and the statement of applicability, so the two documents should use matching asset names.
Specialized assets documented only
Specialized assets, including IoT, OT and test equipment, are documented but not assessed under 32 CFR 170.19(c). Manufacturers with production lines often hold these in the most places. For ISO 27001, the same devices fall inside scope if the ISMS covers that site or service, and Annex A controls on physical and technological protection then apply. Confirm in writing how each device type is classified before you exclude it from either boundary.
Separated assets outside scope
Assets physically or logically separated from CUI assets are out of scope for CMMC Level 2. Separation has to be real and demonstrable, such as an isolated network segment with enforced access controls and evidence of that isolation. ISO 27001 does not offer this shortcut. Clause 4.3 requires the organization to set scope by organization, location or service, and clause 1 does not allow dropping requirements from clauses 4 to 10. Ask your certification body how it will test any boundary you draw around a separated network.
Who assesses each framework and what the cycle looks like
This table compares who performs the assessment, what kind of proof results and how often it recurs for CMMC Level 2, CMMC Level 3 and ISO/IEC 27001. Read it to see which assessment a defense contract may require and which one a commercial customer or internal governance decision may need.
| Assessment | Who performs it and what proof results | Cycle and recurring obligations |
|---|---|---|
| CMMC Level 2 self-assessment | The contractor assesses itself against NIST SP 800-171A objectives and affirms results. No external certificate is issued, but results are posted to SPRS when required by the contract. | Initial self-assessment plus annual affirmation by a senior official. Confirm current applicability, since the 2026 Phase II suspension changed when certification is required. |
| CMMC Level 2 C3PAO certification | A certification assessment by a C3PAO authorized or accredited by The Cyber AB, the CMMC Accreditation Body. The result is a CMMC certificate that a contract may require. | Certification is tied to the contract requirement. Annual affirmation still applies. Confirm with the requiring activity whether certification is needed for your contract. |
| CMMC Level 3 certification | Assessed by DCMA DIBCAC, not by a C3PAO. Reserved for the most critical programs and technologies, as chosen by the DoD program manager or requiring activity. | Applies only when the requiring activity selects Level 3 under 32 CFR 170.5(b). Confirm selection in the solicitation. |
| ISO/IEC 27001 certification | Performed by an accredited certification body under ISO/IEC 17021-1 and ISO/IEC 27006-1. ISO does not certify organizations; certification bodies do. The output is a certificate, not a DoD-style affirmation. | Initial certification has a stage 1 audit and a stage 2 audit, with time between them for resolving concerns. Check accredited certificates in the IAF CertSearch database. |
| ISO/IEC 27001 surveillance and recertification | The certification body audits the management system against the standard over a three-year certification cycle, with at least one audit in every calendar year. | Recurring audits are part of the cycle, so budget for each annual audit. Ask the certification body for its audit plan and fee schedule in writing. |
| Transition from ISO/IEC 27001:2013 | Certificates to the 2013 edition had to expire or be withdrawn by 31 October 2025, the end of the 36-month transition period under IAF MD 26:2023. | If you hold an older certificate, confirm that it now reflects the 2022 edition. Ask your certification body how it applied the transition. |
What drives CMMC and ISO 27001 cost, with the published CMMC figures
A Level 2 self-assessment is performed by the organization itself against the assessment objectives of NIST SP 800-171A, and the cost is mainly internal staff time, documentation work and any outside help you choose to buy. The DoD's CMMC final rule (Federal Register, 15 October 2024) included a Regulatory Impact Analysis that estimated a Level 2 self-assessment plus initial affirmation at $43,403 per assessment for an other-than-small entity and $34,277 for a small entity. The same analysis put three-year totals, covering one assessment cycle with two annual affirmations, at $48,827 and $37,196.
- Estimate basis: The DoD's 2024 final rule estimated $43,403 and $34,277 per assessment, and three-year totals of $48,827 and $37,196. These are federal estimates, not quotes from your vendors.
- Internal labor: Staff time for scoping, evidence collection, and writing the system security plan is usually the largest cost you control.
- Recurring affirmations: The annual affirmation is a recurring obligation, so budget for it every year, not only at the first assessment.
- Tooling and outside help: Any GRC software, consultant, or managed services are optional costs you choose, and each should appear as a separate line in a quote.
- Ask for: A written breakdown of hours by role, which asset categories are in scope under 32 CFR 170.19(c), and what is included in the affirmation work.
Confirm the current Level 2 status and whether your contract requires self-assessment or certification, because the DoD sets that status per procurement under 32 CFR 170.5(b) and the 2026 phase changes affect what is required now.
A Level 2 certification assessment is performed by a C3PAO authorized or accredited by The Cyber AB, the CMMC Accreditation Body, so you pay an outside assessor in addition to your own preparation costs. The DoD's CMMC final rule estimated a Level 2 C3PAO certification assessment plus initial affirmation at $112,345 per assessment for an other-than-small entity and $101,752 for a small entity. Three-year totals, including two annual affirmations, were estimated at $117,768 and $104,670.
- Estimate basis: The DoD's 2024 final rule estimated $112,345 and $101,752 per assessment, and three-year totals of $117,768 and $104,670.
- Assessor fees: The C3PAO charges for the assessment itself, so ask whether the quote covers planning, on-site or remote assessment days, and report writing.
- Remediation: Fixing gaps before the assessment is often the variable cost, driven by how many of the 110 requirements are not yet met.
- Reassessment risk: A requirement is MET only when every applicable objective has evidence in final form, so a second assessment adds cost if gaps remain.
- Ask for: Assessor day rates, travel, retest terms, and whether affirmations are priced separately.
Confirm the current status of the Phase II suspension announced on 13 July 2026 with the requiring activity, because it determines whether certification is required for your contract at all.
ISO 27001 certification is voluntary and sold by accredited certification bodies, so the cost is the certification body's audit fees plus the internal effort to build and run an information security management system. Our sources do not supply an ISO cost figure, so you should request a written quote from each certification body you consider rather than comparing against a CMMC estimate. The accredited bodies operate to ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, and initial certification has a stage 1 and a stage 2 audit.
- Who is paid: Your certification body receives audit fees, and internal staff, consultants, and any tools are paid by you.
- Recurring cost: Under ISO/IEC 17021-1 the cycle is three years with at least one audit each calendar year, so surveillance audits recur.
- Scope drivers: Scope covers the organization, locations, or services, and the number of sites and users usually affects audit duration.
- Time between stages: The gap between stage 1 and stage 2 is set by you and the body to resolve concerns, and it affects calendar time more than fee totals.
- Ask for: Audit day counts for stage 1, stage 2, and each surveillance year, travel rules, and the fee for any scope change.
Confirm with the certification body whether a CMMC-related scope or customer requirement changes the ISMS scope you need, because a narrower CUI boundary and a broader ISMS boundary can produce different costs.
Where the work overlaps and where it does not
CMMC and ISO/IEC 27001 share controls at the technical level, so much of the evidence can be reused. They differ in what they certify, who decides the level, and how scope is drawn, so a mapping never replaces the assessment or certificate the contract or customer requires.
Level 2 is the NIST SP 800-171 set
CMMC Level 2 security requirements are identical to NIST SP 800-171 Revision 2, which 32 CFR 170.14(c)(3) counts as 110 requirements. ISO/IEC 27001 does not use that numbering, so a control-by-control comparison must start from the 110 requirement IDs, not from the Annex A control names. Ask your assessor which requirement IDs your evidence will be filed under.
Shared mappings in public tools
NIST's CSF 2.0 Reference Tool and the CIS Controls Navigator both map NIST SP 800-171 and ISO/IEC 27001:2022 to common outcomes and safeguards. These mappings help you find where one body of evidence may answer both questions. Treat each cross-reference as a starting point to be checked against your own control implementation, not as proof that one satisfies the other.
Mappings are not endorsements
NIST states that informative references are developed by NIST and non-NIST entities, that it does not check the correctness of non-NIST mappings, and that listing a mapping does not imply endorsement. ENISA makes a similar point: its mapping is not a measure of equivalence. Before you cite a mapping to a contracting officer or a certification body, verify each row against the actual control text and your own system boundary.
A mapping does not transfer a certificate
An ISO/IEC 27001 certificate does not show that a CMMC Level 2 assessment is met, and a CMMC result does not show conformity to an ISMS. The CMMC result depends on the 32 CFR 170.16 and 170.17 assessment rules and the CUI scope, while the ISO result depends on an accredited certification body auditing your ISMS scope. Ask each party which document they will accept as evidence before you plan reuse.
Scope is drawn differently
CMMC Level 2 scopes assets by category: CUI assets are assessed against all requirements, while assets separated from CUI may be out of scope. ISO/IEC 27001 scope is set by the organization, location or service, and clauses 4 to 10 cannot be excluded for a conformity claim. A narrow CUI enclave can therefore pass CMMC scoping while your ISMS scope still covers the wider business, so document both boundaries separately.
Evidence reuse with a clear owner
The same policy, access review, logging and incident records can serve both programs, but the CMMC evidence must be in final form and meet the NIST SP 800-171A assessment objectives. ISO evidence is judged against Annex A controls under an accredited audit cycle. Assign one owner for each evidence item, record which requirement IDs and Annex A controls it supports, and set a review date.
Doing both: order of work and shared evidence
This sequence settles which CMMC obligations apply and where the CUI boundary sits before any ISMS work starts, so that evidence written once can serve both the DoD assessment and the ISO/IEC 27001 audit. The result is a documented scope, a System Security Plan, and an Annex A mapping that shows where the two programs overlap and where they do not.
Confirm contract CMMC status and CUI boundary
Start with the contracts. Ask the contracting officer or requiring activity which CMMC level each procurement specifies, since under 32 CFR 170.5(b) that choice belongs to the DoD program manager or requiring activity, not to the supplier. Record the FCI or CUI each contract involves and the systems that handle it. Confirm the current Phase status with the contracting officer and against the DoW CIO's CMMC pages, because the Phase II suspension announced on 13 July 2026 changed what can be required. The step closes with a written statement of required level and the contracts it covers, signed off by the compliance lead.
Define the CUI asset scope
Inventory every asset that stores, processes or transmits CUI, then sort each one into the asset categories used in 32 CFR 170.19(c): CUI assets, security protection assets, contractor risk managed assets, specialized assets, and assets separated from CUI. Document the boundary, including where separation is claimed, because only assets outside that boundary can be excluded from the Level 2 assessment. Engineering and IT leads own the inventory, and the compliance lead reviews it. The output is a dated asset categorization that the rest of the sequence depends on.
Build the SSP and evidence for the 110 requirements
Write the System Security Plan for the CUI boundary and map evidence to each Level 2 requirement, which the CMMC rule takes from NIST SP 800-171 Rev. 2 and counts as 110 requirements. Assess each requirement against the objectives in NIST SP 800-171A. A requirement is MET only when every applicable objective is satisfied with evidence in final form, so drafts, unsigned policies and screenshots without dates do not count. Assign an owner and a review date to each evidence item. The output is an SSP and an evidence register that a C3PAO or a self-assessor could follow without help from the author.
Scope the ISMS to the organization
Define the ISMS scope under ISO/IEC 27001 separately from the CUI boundary. The scope may be narrowed by organization, location or service, but any requirement in clauses 4 to 10 must stay in, so the ISMS scope will usually cover more than the CUI environment: corporate IT, HR, sales systems and sites outside the defense program. Document the interested parties, including defense customers, and the risk assessment method. Confirm the scope statement with the certification body before stage 1 is booked. The output is an approved scope statement and a risk register that show which parts of the organization are under the ISMS.
Map Annex A controls to the same evidence
Build a cross-reference table linking each Annex A control in ISO/IEC 27001:2022 to the SSP sections and evidence items that support it, where a genuine match exists. Many access control, logging, incident and configuration items will map across, while Annex A controls covering the wider organization, such as supplier agreements or HR screening, need evidence the CMMC scope does not require. Mark gaps honestly rather than forcing a match. Ask the certification body whether it accepts a cross-reference of this kind as supporting evidence. The output is a mapping sheet with a column for each program and a list of controls that need separate evidence.
Keep evidence current across both audits
Set one evidence repository with version control, dated approvals and an owner for each item, so that a single change, such as a revised access review or a new logging rule, updates the SSP and the ISMS records together. Confirm how often the DoD assessment and the certification body's surveillance audits will need evidence, since ISO/IEC 17021-1 requires at least one audit each calendar year within a three-year cycle. The output is a change process that updates the SSP, the Annex A map and the ISMS records in one review, and a calendar showing which audit needs which evidence.
What manufacturers ask before choosing CMMC or ISO 27001
Does a defense supplier need ISO 27001 to meet CMMC?
No. The sources supplied for this comparison do not link ISO/IEC 27001 to CMMC as a requirement. CMMC Level 2 assesses the 110 security requirements of NIST SP 800-171 Revision 2, as set out in 32 CFR 170.14, and a contract sets the level. An ISO 27001 certificate does not satisfy those requirements, and CMMC does not accept it in place of them. Ask the contracting officer and the solicitation which CMMC status applies before you plan any work, and treat ISO 27001 as a separate business decision driven by commercial customers.
How much does CMMC cost, and what drives the price?
The cost depends on the level your contract requires and on the size of your CUI environment. The DoD's CMMC final rule (32 CFR Part 170, published 15 October 2024) estimated a Level 2 self-assessment plus initial affirmation at $43,403 per assessment for an other-than-small entity and $34,277 for a small entity. For a Level 2 C3PAO certification assessment, the same rule estimated $112,345 and $101,752 respectively. These are federal estimates, not quotes. Costs rise with the number of assets in CUI scope, the state of existing controls, the documentation you must produce, and any remediation before assessment. Ask for a written scope that lists the assets, the boundary and the work each party performs.
How long does ISO 27001 certification take?
The sources do not supply a fixed duration, so no timeline should be assumed from this page. Initial certification under ISO/IEC 17021-1 consists of a stage 1 audit and a stage 2 audit, with time between them for you to resolve concerns raised in stage 1, and European Accreditation sets no maximum interval. Stage 1 reviews documentation and readiness, and stage 2 tests whether the management system operates as described. Time depends on how mature your ISMS already is, how broad the scope is, and how quickly your staff can close findings. Request a written scope and a certification body timeline before committing internal resources.
What does ISO 27001 need from our staff?
An ISMS needs named owners, a defined scope, a risk assessment and treatment process, a statement of applicability, internal audits and management review. Clause 1 of ISO/IEC 27001:2022 means you cannot drop clauses 4 to 10 from the scope, so every requirement must be addressed. Staff time falls into several roles:
- Leadership sets policy, approves risk decisions and attends management review.
- Control owners in IT, HR and facilities operate and evidence Annex A controls.
- An internal auditor or coordinator maintains records and prepares for the certification body.
Ask the certification body which records it will sample and how many people your scope requires.
Can we run CMMC or ISO 27001 ourselves?
You can perform a Level 2 self-assessment yourself, but it must be conducted against the assessment objectives of NIST SP 800-171A, and each requirement is MET only when all applicable objectives are satisfied with evidence in final form. Level 2 certification must be performed by a C3PAO authorized or accredited by The Cyber AB, so independent assessment is required for that status. For ISO 27001, you can build and run the ISMS internally, but certification requires an accredited certification body to audit it. Internal work covers design, operation and evidence in both cases. Decide early which parts your team can run and which need outside expertise, and confirm the rules for each with the sponsor or certification body.
What happens if the CMMC phase schedule changes?
The schedule is currently in flux, so confirm the status before you plan. The Department of War suspended CMMC Phase II on 13 July 2026, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The DoW CIO 'About CMMC' page states that implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2, while the eCFR text of 32 CFR 170.3(e) still contains the original schedule. Confirm the applicable CMMC status in each solicitation and with the DoW CIO before committing budget.
Does ISO 27001 reduce our CMMC assessment scope?
Not automatically. CMMC scopes a Level 2 assessment by asset category under 32 CFR 170.19(c), so CUI assets are assessed against all requirements, while assets physically or logically separated from CUI assets are out of scope. An ISMS scope is set by the organization, location or service, and it is a different boundary. Controls you build for ISO 27001 may support CMMC evidence, but each CMMC requirement must be assessed against the CUI environment itself. Ask your assessor to confirm how the CUI boundary is drawn before reusing any ISMS documentation.
How DeployOpen prepares evidence for both frameworks
DeployOpen prepares the controls, scope and evidence that a CMMC or ISO 27001 assessment will examine, but it does not issue either certificate. For a CMMC readiness engagement, that work typically starts with mapping the CUI assets and the security protection assets around them, then documenting the system security plan and collecting evidence against the NIST SP 800-171 requirements. For an ISO 27001 readiness engagement, it starts with defining the ISMS scope, the Annex A control statement and the risk treatment records. Certification decisions rest with others: C3PAOs authorized or accredited by The Cyber AB perform Level 2 certification assessments, DCMA DIBCAC performs Level 3 assessments, and accredited certification bodies issue ISO/IEC 27001 certificates.
DeployOpen works under fixed-scope engagements, so the scope, deliverables and timelines are agreed in writing before work begins. Ask for a written statement of which assets, sites and services are in scope, which evidence each deliverable will produce, and who on your side signs off each artifact. Because the two frameworks draw their boundaries differently, the scope document should state explicitly which parts of the environment are assessed under CMMC and which are covered by the ISMS, so that one set of evidence is not presented as satisfying both without review.
Where your organization wants ongoing help, DeployOpen offers retainers for upgrades, continuous testing and support, and security testing can be scoped separately to exercise the controls before an external assessor does. Confirm with your certification body or C3PAO how they will accept evidence, and confirm with the DoW CIO's About CMMC page which assessment levels currently apply before committing scope.
How DeployOpen scopes and delivers readiness for both frameworks
DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares systems, controls and evidence for compliance assessments. For CMMC vs ISO 27001, we start by agreeing which assets hold CUI and which ISMS scope the organization needs, then build and document controls once for both programs. We do not issue audit reports or certifications; independent assessors and certification bodies do.
How we scope
- Written scope names the CUI asset categories, systems and sites in the CMMC boundary before any work starts.
- The ISMS scope for ISO/IEC 27001 is set by organization, location or service, and documented against the Annex A controls.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work begins.
How we build
- Controls are implemented in your environment, mapped to NIST SP 800-171 Rev. 2 requirements and to the relevant Annex A controls.
- Evidence is collected in final form, since a requirement is only met when every applicable assessment objective is supported.
- Security testing of in-scope applications and infrastructure can be included in the written scope to verify the controls work.
How we hand over
- Deliverables include the system security plan, policies, procedures and an evidence register tied to each requirement or control.
- Runbooks document how the self-hosted platforms, backups and access controls are operated by your own team.
- Handover sessions walk your staff through the evidence package so they can answer assessor and auditor questions directly.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial scope is delivered.
- Retainers can keep evidence current for surveillance audits and annual affirmations, which recur on a set cycle.
- Confirm with your assessor or certification body which evidence they expect, since their requirements govern the final decision.
