CMMC vs NIST 800-53: Scope, Assessment and Overlap

CMMC vs NIST 800-53: which to pursue first when you hold both federal civilian and defense work

If your defense work is governed by DFARS contract clauses, CMMC Level 2 is the obligation you must meet first, and it assesses the 110 NIST SP 800-171 Rev. 2 requirements. SP 800-53 is a different instrument. It is the full federal control catalog that sits behind FISMA for agency systems and the FedRAMP baselines for cloud services. Your civilian work is usually governed by the contract's security terms, agency authorizations and, for cloud offerings, FedRAMP, so the two frameworks rarely compete for the same system. The decision turns on which contract imposes which obligation on which system, and on whether a single system is asked to satisfy both. Start by listing each contract, its clauses and the systems that touch federal contract information or CUI. The defense side is also in motion. On 13 July 2026 the Department of War suspended CMMC Phase II, which would have required Level 2 C3PAO certification for applicable contracts, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Confirm with your contracting officer which CMMC requirement appears in each solicitation and whether a Level 2 certification or self-assessment is required, because the clause in the contract governs, not the program schedule. Keep your SPRS score and your System Security Plan current either way, since those obligations do not pause.

For planning, treat SP 800-171 Rev. 2 as the baseline for defense CUI systems and use SP 800-53 as the reference for civilian and cloud obligations. Where a civilian contract requires FedRAMP Moderate for a cloud service that holds CUI, the rule at 32 CFR 170.16(c)(2) and 170.17(c)(5) accepts a FedRAMP Authorized Moderate offering, so a provider already on the FedRAMP Marketplace can satisfy that part of your defense scope. Ask any cloud provider for its current FedRAMP Marketplace listing and baseline rather than relying on a stated authorization. Do not assume that satisfying SP 800-53 at the moderate level automatically satisfies SP 800-171, because NIST derived the 800-171 requirements from a tailored subset, and assessors judge CMMC against the 800-171A objectives. Map each control to its CMMC requirement ID, such as AC.L2-3.1.1, and record gaps separately.

How the two frameworks differ on scope, structure and proof

This table compares CMMC Level 2 and NIST SP 800-53 factor by factor, from who requires each one to what proof it produces. Read it by row: the first rows show whether a contract or a federal system authorization drives the work, and the later rows show how requirements are counted, structured and assessed.

Factor	CMMC Level 2 (32 CFR Part 170)	NIST SP 800-53 Rev. 5
Who requires it	DoD contracts that involve CUI, applied through the DFARS clause 252.204-7021 and provision 252.204-7025	Federal agencies under FISMA and OMB Circular A-130, and cloud providers pursuing FedRAMP authorization
Source document	NIST SP 800-171 Revision 2, incorporated by 32 CFR 170.14(a)(2), with the assessment objectives in SP 800-171A	SP 800-53 Rev. 5 controls, with baselines in SP 800-53B and assessment procedures in SP 800-53A
Number of requirements	110 requirements, counted in 32 CFR 170.4	Release 5.2.0 has 324 base controls and 872 control enhancements; the moderate baseline selects 287 of these
Control structure	14 domains that map to the SP 800-171 Rev. 2 requirement families, with IDs such as AC.L2-3.1.1	20 control families with IDs such as AC-02 (labels use leading zeros from Release 5.1.1)
Tailoring origin	Requirements tailored from the 800-53 moderate baseline to protect CUI confidentiality	Baselines defined in SP 800-53B, tailored by impact level and organization-specific overlays
Assessment methods	Examine, interview and test per SP 800-171A, with sampling under CAP v2.0	Examine, interview and test per SP 800-53A, with assessment objects suggested for each control
What is issued	Self-assessment, or a C3PAO certification assessment for Level 2 (the Phase II certification requirement is suspended as of 13 July 2026)	No certificate from NIST; authorization to operate from an agency, or FedRAMP authorization for cloud services
Rule for cloud services holding CUI	Use requires FedRAMP Authorized at the Moderate baseline or higher, or equivalent security under DoD policy	FedRAMP baselines apply, and the moderate impact level is the common starting point for CUI-type data

How NIST tailors SP 800-171 from the SP 800-53 moderate baseline

The 110 requirements in NIST SP 800-171 did not start as a standalone list. NIST built the Rev. 3 requirements by tailoring the SP 800-53 Rev. 5 controls in the SP 800-53B moderate baseline. During that tailoring, NIST removed controls that are primarily the federal government's responsibility, controls not directly related to protecting the confidentiality of CUI, controls adequately addressed by other controls, and controls that do not apply to nonfederal systems. For a contractor, the practical point is that SP 800-171 is a subset of the federal catalog, so a control that appears in 800-53 may simply be absent from CMMC without any gap in the CUI protection it targets. Confirm this against the tailoring tables in the SP 800-171 Rev. 3 document before you assume a particular 800-53 control is out of scope for your environment.

Two details matter when you map your program. First, the Planning family is one of three families added in Rev. 3 to stay consistent with the SP 800-53B moderate baseline, so it has no CMMC Level 2 domain. A contractor who builds its CMMC evidence around the 14 CMMC domains will not find a Planning domain there, yet the organization may still need written system security plans for other reasons, such as contract or customer requirements. Second, CMMC does not use the current NIST text. Under 32 CFR 170.14, the CMMC Level 2 security requirements incorporate NIST SP 800-171 Revision 2, and requirement IDs such as AC.L2-3.1.1 follow the CMMC Model format. Build your evidence against the Rev. 2 numbering and keep a crosswalk to Rev. 3 so that the program survives any future rule change. The CMMC Program final rule is the authoritative source for which version applies.

The 287 moderate items in the SP 800-53B OSCAL profile for Release 5.2.0 count base controls and enhancements together. That figure describes the federal moderate baseline a federal system must address. It is not a CMMC count and should not be used as one, because CMMC Level 2 assesses 110 requirements. If a board paper or customer questionnaire quotes the 287 figure next to CMMC, correct it. Where your environment also handles federal civilian systems under FISMA, the 800-53 baseline becomes the relevant set for those systems, and the two requirement sets will overlap heavily but not match item for item.

Where the controls overlap and where they do not

CMMC Level 2 and SP 800-53 share a common lineage, since SP 800-171 Rev. 3 was tailored from the SP 800-53 moderate baseline. The differences are in scope, in what each one requires you to prove, and in which mappings are official and which are informative.

Shared access control and audit themes

Access control and audit and accountability appear in both. SP 800-171 Rev. 2 requirements were derived from the moderate baseline of an earlier SP 800-53 release, so a control family such as access control looks familiar in both documents. The overlap is thematic, not one-to-one. Check each requirement against its own assessment objectives in NIST SP 800-171A, because a control ID in SP 800-53 may cover more or less than the matching CMMC requirement. Map evidence by objective, not by family name.

SP 800-53 families with no CMMC domain

Some families in SP 800-53 have no CMMC Level 2 domain. The Planning family is one example, added in Rev. 3 to stay consistent with the SP 800-53B moderate baseline. A contractor that treats the CMMC scope as the whole federal catalog will leave gaps, but the reverse is also true: CMMC does not assess controls outside its CUI scope. For federal civilian work under FISMA or FedRAMP, confirm which families your system authorization requires before you assume CMMC evidence will satisfy them.

Official CSF crosswalks as reference points

NIST publishes an official crosswalk from the CSF 2.0 to SP 800-53 Rev. 5.2.0 in its Online Informative References catalog. The CSF 2.0 Reference Tool also maps to SP 800-171 Rev. 3. Use these as starting points when a team needs one vocabulary across both programs. They map CSF outcomes, not CMMC assessment objectives, and CMMC Level 2 still assesses Rev. 2. Ask your assessor which revision governs your contract before you rely on a Rev. 3 mapping for CMMC evidence.

Non-NIST mappings need independent checks

NIST states that it does not check the correctness of non-NIST mappings, and that listing a mapping does not imply endorsement. Third-party spreadsheets, GRC tool exports and vendor crosswalks may link a CMMC requirement to an SP 800-53 control that does not assess the same thing. Before you accept any such mapping, test it against the SP 800-171A objectives and record who reviewed it. A mapping is a working aid, not evidence that one assessment satisfies the other.

Revision and release drift

Both sides move. SP 800-53 Rev. 5 is now at Release 5.2.0, which added controls such as SA-24 and revised SI-7(12). CMMC Level 2 still incorporates SP 800-171 Rev. 2, which NIST withdrew on 14 May 2024. A mapping built against one release can drift from the other within a single contract cycle. Record the exact release each mapping cites, and confirm with the contracting officer which SP 800-171 revision applies to your Level 2 scope.

Who assesses each framework, what is issued and how often

This table shows who assesses each CMMC level, SP 800-53 under FISMA and FedRAMP Moderate, what each produces and where the status is still moving. Read it by first checking which contract or cloud obligation applies, then confirming the current status with the contracting officer before planning the cycle.

Assessment	Assessor and output	Method and cycle	Current status
CMMC Level 2 self-assessment	The contractor's own senior official signs the result. Scores are posted to SPRS for the applicable contracts. No third-party certificate is issued.	Assessment objectives of NIST SP 800-171A, using examine, interview and test. Requirement is MET only with final evidence. Cycle is set by the contract and the program rule.	Phase I self-assessments, SPRS postings and annual affirmations remain in place according to the DoD's 13 July 2026 release. Confirm current scope with the contracting officer.
CMMC Level 2 certification assessment by C3PAO	A C3PAO authorized or accredited by The Cyber AB issues the certification result for applicable contracts. Output is a certificate and assessment report, not an SP 800-53 authorization.	Level 2 assessment objectives of NIST SP 800-171A, with sampling at the FOCUSED value under CAP v2.0 and increased sampling when evidence is questionable. Renewal cycle is set by the program and contract.	Phase II, which would have required C3PAO certification, was suspended on 13 July 2026 for a 60-day review. Confirm whether a specific contract still requires certification.
CMMC Level 3 by DCMA DIBCAC	DCMA DIBCAC performs the certification assessment for Level 3, which adds selected NIST SP 800-172 requirements to the Level 2 baseline.	Level 3 assessment against DoD-assigned parameters. Cycle and scope are set by the contract. Level 3 depends on Level 2 status first.	Level 3 falls under the same suspended Phase II milestones. Confirm with DoD whether Level 3 is required on any contract you hold.
SP 800-53 under FISMA	Federal agencies authorize their own systems. Inspectors General independently assess agency system security and report to OMB. No public certificate is issued for the contractor's SP 800-53 implementation.	Assessment procedures in SP 800-53A using examine, interview and test per control. Cycle is set by agency policy under OMB Circular A-130 and the system's authorization schedule.	NIST does not set federal implementation timelines. Confirm with each agency's authorizing official which controls and baseline apply to your system.
FedRAMP Moderate for cloud	A cloud service offering listed as FedRAMP Authorized at the Moderate baseline on the FedRAMP Marketplace. A third-party assessment organization assesses it. CMMC Level 2 accepts it for CUI in the cloud.	Moderate baseline controls drawn from SP 800-53 Rev. 5, with the Security Decision Record defining the control set. Cycle is set by the FedRAMP authorization and continuous monitoring process.	Under 32 CFR 170.16(c)(2) and 170.17(c)(5), Moderate or higher is required for CUI in a cloud offering unless equivalent DoD requirements are met. Confirm the Marketplace listing before relying on it.
Status of the CMMC rule text	Two sources describe the Phase 1 scope differently. The DoW CIO page says implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e) still lists the original four-phase schedule.	Not a method. Treat this as a dated conflict to resolve before scheduling assessments.	Open item. Ask the contracting officer or DoD CIO office which text governs your contract before committing budget or assessor dates.

Sequencing both programs and reusing evidence

This sequence lets a contractor with civilian and defense work scope the CUI boundary once, prove the SP 800-171 Rev. 2 requirements for CMMC, and then reuse that evidence to answer the SP 800-53 control questions that FISMA or FedRAMP work raises.

Inventory CUI, FCI and contract obligations
Start by listing every contract that carries DFARS 252.204-7012 and every system that stores, processes or transmits federal contract information or controlled unclassified information. Pair each contract with the systems it touches and record which federal civilian contracts or agency systems also sit in the same environment. The output is a dated inventory signed off by the contracts and security leads, showing which obligations apply to which systems. Confirm the exact clause language in each contract, since the obligations are set by the contract itself.
Scope the CUI boundary and cloud providers
Draw the CUI boundary around the systems and people in the inventory, then identify every external service provider inside that boundary. For any cloud offering that holds CUI, confirm whether it is FedRAMP Authorized at the Moderate baseline or higher on the FedRAMP Marketplace, or whether it meets equivalent requirements under DoD policy. The output is a boundary diagram and a provider register that names each provider's authorization status. Ask each provider for its current authorization documentation rather than relying on marketing statements.
Build the SP 800-171 Rev. 2 evidence set
Assess the in-scope environment against the 110 requirements of NIST SP 800-171 Rev. 2, using the assessment objectives in NIST SP 800-171A (June 2018). For each requirement, collect evidence through examine, interview and test methods, and record the requirement ID in the CMMC format such as AC.L2-3.1.1. Gaps found here are remediated before the evidence is finalized. The output is a requirement-by-requirement evidence file in final form, because a requirement counts as MET only when all applicable objectives are satisfied with final evidence, not drafts.
Finalize and version the evidence
Convert working notes, screenshots, policies and configuration exports into final, dated and approved artifacts. Remove drafts from the evidence store or mark them superseded, and confirm that each artifact traces to a specific objective and system in the boundary. Expect an assessor to test questionable evidence more deeply: under CAP v2.0, the assessment team uses nonstatistical sampling at the FOCUSED value and increases the sample when evidence is questionable. The output is an evidence index where every artifact is final, versioned and linked to its requirement.
Map evidence to SP 800-53 controls
Once the SP 800-171 evidence is final, map it to the SP 800-53 controls that the FISMA or FedRAMP work requires, using the Rev. 5.2.0 catalog and the moderate baseline in SP 800-53B as the reference. Use the official NIST OLIR crosswalk and the NIST Rev. 3 tailoring logic as a starting point, and mark every control where the mapping is partial, missing or specific to federal responsibilities. The output is a control matrix that shows which evidence satisfies which control and where additional 800-53 evidence, such as Planning or additional assessment procedures in SP 800-53A, must be produced. Treat the crosswalk as a guide, since it does not replace the control-by-control assessment.
Close the gaps unique to the federal baseline
Work through the controls the matrix marks as unmet, such as those with no CMMC Level 2 domain or those that the FedRAMP Moderate package requires beyond SP 800-171. Assign each gap an owner, a written remediation plan and an evidence type. Where a gap is a policy or planning artifact, produce it as a finished, approved document rather than a placeholder. The output is a closed or documented gap register that the assessors and the authorizing officials can each review without finding drafts in the file.
Confirm the assessment path for each contract
Before any assessment is booked, confirm with each contracting officer which CMMC level and assessment type the contract requires, and whether the current program status allows self-assessment or requires third-party certification. Check the current DoW CIO guidance and the eCFR text together, because they may differ during the phase transition. Record the answer per contract and per system. The output is a written assessment plan that states, for each contract, the required level, the assessment method, the SPRS posting obligation and the reviewer who confirmed it.
Maintain one evidence set for both programs
Keep the SP 800-171 evidence, the SP 800-53 control matrix and the boundary records in one controlled repository, with a change log that updates both views whenever a system, provider or configuration changes. Review the mapping after any SP 800-53 release or CMMC rule update, since NIST issues numbered releases and the CMMC rule still incorporates Rev. 2. The output is a single current evidence set that can answer a CMMC assessor, a FedRAMP reviewer or a federal agency assessor without rebuilding the file from scratch.

When a cloud service triggers FedRAMP Moderate for CUI

If a contractor stores, processes or transmits CUI in a cloud offering inside a CMMC Level 2 assessment boundary, the cloud service itself becomes a scoping decision. Under 32 CFR 170.16(c)(2) and 170.17(c)(5), that offering must be FedRAMP Authorized at the Moderate baseline or higher on the FedRAMP Marketplace, or meet equivalent security requirements in accordance with DoD policy. Treat this as a contract-level check on each cloud service in your data flows, not a general statement about your cloud provider. Start by listing every SaaS, IaaS or managed service that touches CUI, including backups, email and collaboration tools, then record each one's authorization status and the baseline it holds.

The FedRAMP Consolidated Rules for 2026 add a provider-side detail that helps you read a provider's authorization. Providers seeking a Rev5 certification must include at least 155 NIST SP 800-53 Rev. 5 controls and enhancements in their Security Decision Record for Class B, 322 for Class C and 409 for Class D. These minimums describe what the provider must document, so they do not tell you which class your service needs. Ask the provider which FedRAMP class and baseline its authorization covers, and confirm that status on the FedRAMP Marketplace rather than relying on a statement in a sales deck or a SOC 2 report.

If a provider is not authorized, the equivalency path under DoD policy is a narrower and more document-heavy route, and it should be confirmed with your contracting officer and the assessor before you rely on it. Ask in writing which DoD policy the provider's security meets, what evidence it can produce and how it maps to the Level 2 requirements in your System Security Plan. Also confirm whether the provider's responsibilities appear in your shared responsibility matrix, since your assessor will still test the controls you inherit from the cloud service.

Questions buyers ask before hiring help for CMMC and SP 800-53

Does a federal civilian contract require CMMC?

Not directly. CMMC is the DoD program under 32 CFR Part 170, and it reaches contractors through DFARS clauses 252.204-7021 and 252.204-7025, so a civilian-only contract is not governed by it. Civilian work usually brings its own requirements, such as FISMA for federal systems, FedRAMP for cloud services the agency uses, and agency-specific security terms that often draw on SP 800-53. If one company holds both kinds of work, a DoD contract involving CUI brings CMMC on top of any civilian terms. Confirm with the contracting officer which clauses bind each contract before you scope any work.

Does a defense contract require SP 800-53?

The CMMC rule does not name SP 800-53 as the test set. Level 2 assesses the 110 requirements of NIST SP 800-171 Revision 2, which NIST tailored from the SP 800-53 moderate baseline, so SP 800-53 sits upstream as the source catalog. A defense contract can still reference SP 800-53 directly, for example in a system authorization, a cloud service review or a program-specific security requirement. Read the statement of work and security clauses, then ask the contracting officer or program security office to name each document and revision in writing.

What drives cost and effort for CMMC and SP 800-53 work?

The main drivers are the CUI boundary, the number of in-scope systems, where CUI flows, and how many external service providers sit inside that boundary. Cloud providers matter because Level 2 requires FedRAMP Moderate authorization or equivalent security for a cloud offering that holds CUI. Evidence maturity also changes the effort: existing policies, logs and change records shorten the work, while missing evidence must be built and retained. For SP 800-53, the OSCAL moderate profile selects 287 base controls and enhancements together, which shows breadth but is not a price. NIST does not estimate compliance costs, so request a written scope and cost breakdown from each provider.

Can our team handle CMMC or SP 800-53 work ourselves?

Internal teams can handle much of the readiness work if they have security engineering, documentation and change management capacity. Self-assessment against the NIST SP 800-171A objectives is possible, but a requirement counts as MET only when every applicable objective is satisfied with evidence in final form, not drafts. The Phase I obligations, including self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012, remain in place. An independent assessor is still required for any Level 2 certification assessment, so the internal team should prepare evidence that an outside party can test and examine.

What does DeployOpen cover, and what does it leave to assessors?

DeployOpen plans, implements, customizes, integrates, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. It also runs security testing and prepares systems, controls and evidence for compliance assessments. It does not issue audit reports, attestations or certifications. Independent auditors and certification bodies perform those steps. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and ongoing support or continuous testing is available as a retainer. DeployOpen does not publish a price list, and a quote follows from the written scope.

How long does CMMC or SP 800-53 readiness take?

No duration is established for this work in the sources used here, so treat any number you hear with caution. The main factors are the number of systems in the boundary, how mature your evidence already is, and how many external providers must be brought into scope. The schedule is also moving: on 13 July 2026 the Department of War suspended CMMC Phase II and started a 60-day review by a CMMC Reform Task Force. Confirm the current schedule with the contracting office and the DoW CIO's About CMMC page, and ask any provider to tie its timeline to a written scope.

What does the work require from our internal staff?

Expect a named owner for the CUI boundary, system administrators who can supply configurations, logs and access records, and a security lead who can interpret each assessment objective. Procurement or legal staff must handle flow-down terms with external service providers, and leadership must approve the scope and sign the affirmations. The time commitment varies with the number of systems and the state of documentation, so ask each provider to state in writing which staff roles it needs, how often, and for how long. Staff who maintain the systems after handover should be included early so the evidence process continues.

Who pays for the C3PAO or assessor in CMMC?

Under 32 CFR Part 170, Level 2 certification assessments are performed by C3PAOs authorized or accredited by The Cyber AB, and Level 3 assessments are performed by DCMA DIBCAC. The rule does not set the commercial fee terms for a C3PAO engagement, so confirm in writing who pays, what the fee covers and what happens if the assessment is rescheduled. The Department of War's 13 July 2026 suspension of Phase II means certification may not be required on the original schedule for applicable contracts, so check your contract's current requirement before committing. DeployOpen prepares evidence for the assessment but does not perform or price assessor work.

What drives cost and effort on each side

CMMC Level 2 and NIST SP 800-53 programs are paid for in different places: assessor fees and internal evidence work on the defense side, and control implementation, assessment and authorization work on the federal side. The cards below separate who is paid for what, which costs recur, and which scope decisions move the total most.

Internal staff and evidence work

Most of the effort on either side is internal: system owners, security engineers and compliance staff who write policies, configure controls and collect evidence in final form. For CMMC, each Level 2 requirement is met only when every applicable assessment objective has final evidence, so drafts add rework. For SP 800-53, the same staff must trace controls to a chosen baseline and tailoring decisions. Ask any outside party to show how many hours of internal effort its quote assumes.

Assessor and authorization fees

Level 2 certification assessments are performed by C3PAOs authorized or accredited by The Cyber AB, and Level 3 by DCMA DIBCAC. Federal system assessments are carried out by the agency or by assessors it engages under FISMA. Fee structures differ by assessor and by assessment type, so confirm the current fee structure with each assessor and ask for a written scope that lists the systems, sites and requirements covered.

Enclave and cloud hosting

CUI can sit in a cloud offering only when that offering is FedRAMP Authorized at the Moderate baseline or higher, or meets equivalent requirements under DoD policy. If your existing cloud service is not authorized, the cost is a migration or a separate enclave with its own hosting, logging and access controls. Under SP 800-53, the same question drives the number of controls a cloud provider must document. Price each hosting option against the systems that actually touch CUI.

Tooling and monitoring

Recurring tooling costs cover log retention, vulnerability scanning, identity controls, configuration baselines and the ticketing used to track evidence. Under the NIST model, control monitoring is a continuous activity tied to the organization's risk management process, so tooling tends to recur. Ask whether a quote includes licenses, hosting for the evidence repository and the time needed to keep Security Assessment Plans, System Security Plans and Plans of Action current.

Scope size and system count

The biggest cost driver on both sides is the number of systems and people inside the assessed boundary. Every additional system that stores, processes or transmits CUI adds requirements to test, interviews to schedule and evidence to keep current. On the SP 800-53 side, selecting the moderate baseline with a tailored set of controls changes the count of items each system must document. Ask for the boundary diagram and system inventory in writing before accepting any estimate.

Recurring affirmations and reassessment

Phase I obligations stay in place even though the Department of War suspended Phase II requirements on 13 July 2026. Annual affirmations, SPRS postings and DFARS 252.204-7012 obligations recur, and a certification assessment has to be repeated on the program's cycle. Federal assessment and authorization work recurs through continuous monitoring. Ask each party which recurring items its quote covers, how often they repeat and what triggers a new assessment after a major system change.

What to confirm with your contracting officer and assessor

Start by confirming which revision of NIST SP 800-171 the contract cites. The CMMC rule at 32 CFR 170.14(a)(2) incorporates Revision 2, and the Department of War has said it will enforce Rev. 2 in the interim even though NIST withdrew Rev. 2 on 14 May 2024. Ask the contracting officer to name the revision in the solicitation and the DFARS clause, because a contract that references Rev. 3 changes which requirement numbers your gap analysis must cover. Also confirm whether the solicitation requires Level 2 self-assessment or C3PAO certification, since that answer depends on the current phase status.

Phase status is moving, so confirm it in writing rather than from memory. On 13 July 2026 the Department of War suspended CMMC Phase II and started a 60-day review by the CMMC Reform Task Force. Ask for the outcome of that review and its effective date. Then reconcile two sources that may disagree: the DoW CIO About CMMC page, which describes Phase 1 implementation as paused, and the eCFR text of 32 CFR 170.3(e), which still shows the original four-phase schedule. Ask the contracting officer which of them governs your contract, and record the answer in your contract file. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place under either reading.

For each cloud provider that stores or processes CUI, check the FedRAMP Marketplace yourself and record the authorization status and baseline. Under 32 CFR 170.16(c)(2) and 170.17(c)(5), a cloud offering used for CUI at Level 2 must be FedRAMP Authorized at the Moderate baseline or higher, or meet equivalent requirements under DoD policy. Ask the assessor how it will treat equivalency claims. Finally, ask the civilian agency whether its contract or authorization requires SP 800-53 control sets beyond the moderate baseline, such as additional enhancements or overlays. The CMMC requirements do not answer that question, and a civilian contract can set requirements that a CMMC assessment will not test.

How DeployOpen prepares evidence for CMMC and SP 800-53 readiness

DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares systems, controls and evidence for compliance assessments. We do not issue audit reports or certifications, and independent assessment bodies make those determinations. Our work starts from the control set that applies to your contracts, then builds the evidence that assessors will review.

How we scope

Written scope confirms which contracts, systems and CUI or FCI environments fall under CMMC Level 2 or SP 800-53 controls.
We map your system boundary, including external service providers and any cloud offering that stores CUI.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work begins.

How we build

We implement and configure controls in your environment against the NIST SP 800-171 Rev. 2 requirements that CMMC uses.
Where a control is tested, we run examine, interview and test steps aligned with the assessment methods in NIST SP 800-171A.
Security testing of applications, cloud and infrastructure checks the controls you rely on before an assessor does.

How we hand over

Documentation covers the system security plan, control implementation statements and the evidence index for each requirement.
Evidence is kept in final form, with dated artifacts that show each objective is satisfied, not drafts.
You receive runbooks and configuration records so your own team can maintain the controls after handover.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers can cover re-checking evidence when the CMMC rule, the assessment guide or a NIST release changes.
Confirm with your assessment body and contracting officer which assessment level and version apply to each contract.

CMMC vs NIST 800-53