CMMC or NIST CSF: which should a defense contractor pursue first?
Start with the contract, not the framework. If your DoD work involves Federal contract information (FCI) or Controlled Unclassified Information (CUI), CMMC is a contract condition for applicable work under 32 CFR Part 170, and the DFARS rule that carries it into contracts through clause 252.204-7021 took effect on 10 November 2025. The NIST Cybersecurity Framework (CSF) 2.0 is voluntary, and NIST states that it does not offer certifications or endorsements and has no plans for a conformity assessment program. So a CSF program cannot satisfy a CMMC requirement, and CMMC cannot be skipped in favor of CSF work for a contract that requires it. The first task is to identify which CMMC level each contract requires, since Level 1 covers FCI and Level 2 covers CUI, and that scope decides the work that must be finished first. Check three things before you plan. First, read the solicitation and contract clauses to confirm the level and whether a self-assessment or C3PAO certification applies. Second, confirm current status with the Department of War, because on 13 July 2026 it suspended CMMC Phase II, which had been scheduled to start 10 November 2026, and opened a 60-day review. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, so a contract that lists those duties still binds you. Third, ask the contracting officer how the Level 2 requirements will be enforced in the interim, because the Department has said it will enforce NIST SP 800-171 Rev. 2 in that period. Do both when your organization needs a governance program across commercial and defense lines. CSF 2.0 organizes work into six Functions, including Govern, which the CSF 2.0 Reference Tool links to requirements in SP 800-171 Rev. 3 for GV.OC-03. That mapping helps you plan a broader program while CMMC still assesses Rev. 2. Treat CMMC scope as the minimum you must prove to DoD, and treat the CSF program as the enterprise layer built on top of it.
How CMMC and the NIST CSF differ on scope, proof and status
This table sets CMMC against the NIST CSF 2.0 on who requires each, what it covers, which version and structure it uses, what proof it produces and whether it is a certification. Read it as a pairing: CMMC decides whether a defense contract can be awarded, while the CSF gives an enterprise a voluntary outcome structure that can sit beside it.
| Dimension | CMMC (32 CFR Part 170) | NIST CSF 2.0 |
|---|---|---|
| Who requires it | DoD contractors handling Federal contract information or CUI, enforced through contract clauses (DFARS 252.204-7021 and 252.204-7025) | Voluntary for most organizations; some customers or suppliers require it, and U.S. federal agencies were made subject to it by a 2017 executive order |
| What it covers | Safeguarding of FCI (Level 1) and CUI in nonfederal systems (Levels 2 and 3), scoped to the systems and assets that handle that information | Enterprise cybersecurity outcomes across Govern, Identify, Protect, Detect, Respond and Recover, scoped to the whole organization or a chosen profile |
| Requirement structure and version | Level 2 uses the 110 requirements of NIST SP 800-171 Rev. 2 across 14 domains, even though Rev. 3 is the current NIST version | 6 Functions, 22 Categories and 106 Subcategories in CSF 2.0, with Implementation Examples and informative references published separately |
| Proof it produces | Self-assessment results posted to SPRS, or a certification assessment by a C3PAO for Level 2 and DCMA DIBCAC for Level 3, with each requirement MET on final evidence | No assessor-issued proof; the organization documents its own Current and Target Profiles and Tier, which it may share with customers or regulators |
| Is it a certification? | Yes for Level 2 (C3PAO) and Level 3, issued through the CMMC program and tied to contract eligibility; Level 1 requires a Final status for award | No. NIST states it offers no certifications or endorsements and has no plans for a conformity assessment program |
| Maturity or status model | Levels 1 to 3 with fixed requirements and POA&M rules; a higher status satisfies lower ones for the same scope | Four Tiers (Partial, Risk Informed, Repeatable, Adaptive) describing governance rigor, not pass or fail |
| Licensing and cost drivers | Assessment fees and preparation costs depend on scope, number of enclaves and external providers in scope; confirm current fee schedules with the C3PAO or assessor | No licence fee to use the framework; costs come from internal staffing, tooling and any consultant hired, which NIST says is optional |
| Cost of switching later | Moving from a self-assessment to certification requires a fresh assessment against the rule in force at that time, so scope and evidence should be built to the CMMC model from the start | Low lock-in, since Profiles and mappings can be reused, but mappings to SP 800-171 Rev. 3 must be checked against the Rev. 2 requirements that CMMC still assesses |
Who must meet CMMC, and who can use the CSF voluntarily
CMMC is not a choice a contractor makes for itself. The level is set by the contract, and the model in 32 CFR 170.14 defines three of them: Level 1 covers the 15 safeguarding requirements of FAR 52.204-21 for Federal contract information, Level 2 covers the NIST SP 800-171 Rev. 2 requirements for controlled unclassified information (CUI), and Level 3 adds 24 selected NIST SP 800-172 requirements with DoD-assigned parameters. Start by reading the solicitation and the DFARS clauses in your contracts, then list which systems hold FCI or CUI. Confirm with your contracting officer which level applies to each contract, because a higher status can satisfy lower requirements for the same scope, but it does not shrink the scope you must assess.
The NIST CSF sits on the other side of that line. NIST is not a regulator, and most organizations use the CSF voluntarily. Some customers and suppliers still write it into their requirements, and a 2017 executive order made it mandatory for U.S. federal agencies. If a buyer asks for CSF alignment, get the expected deliverable in writing, such as a current profile, a target profile or evidence of a self-assessment, because the CSF itself does not define a pass or fail result.
Because the CSF is not limited to a contract scope, it can cover the whole enterprise, including corporate IT, identity, cloud and business systems that sit outside the CUI boundary. CMMC, by contrast, reaches only the assets that handle FCI or CUI and the security protection assets and external service providers in that scope. Inventory your environment first, then decide whether the CSF profile should cover everything while CMMC scope stays narrow, and confirm with your assessor and your customers where that boundary falls.
Where CMMC and CSF work overlaps, and where it does not
CMMC Level 2 and the CSF 2.0 share governance and risk concepts, and NIST publishes a Reference Tool that links CSF outcomes to SP 800-171 Rev. 3 requirements. The cards below separate what a mapping lets you reuse from what a CMMC assessment will actually accept as evidence.
Shared governance and risk vocabulary
Both approaches ask an organization to define its risk management, assign responsibility and review its controls over time. CSF 2.0 added the Govern Function for this purpose, and the Reference Tool links GV.OC-03 to requirement 03.15.01 of SP 800-171 Rev. 3. Use that shared language to brief leadership, but do not treat a governance outcome as satisfying a CMMC practice on its own.
Reference Tool informative references
NIST's CSF 2.0 Reference Tool export lists informative references to SP 800-171 Rev. 3, SP 800-53 Rev. 5.2.0 and other standards, alongside 363 Implementation Examples. Note the revision gap: CMMC Level 2 still assesses Rev. 2, so a Rev. 3 reference does not directly tell you which Rev. 2 requirement your evidence must meet. Confirm the revision on every mapping you rely on.
Tiers as a maturity lens
CSF Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how rigorously an organization governs and manages cybersecurity risk, moving from ad hoc responses toward continuous improvement. They are a useful internal progress measure. CMMC does not score maturity in tiers. Each requirement is either MET or NOT MET, so a Tier 3 self-rating cannot stand in for a passing Level 2 score.
Mapping is not evidence sufficiency
A CSF subcategory can be satisfied by a policy, a process narrative or a tool configuration, depending on the organization's own profile. CMMC assessments under 32 CFR Part 170 judge each requirement against the assessment objectives in NIST SP 800-171A, and a requirement is MET only when all applicable objectives are met with evidence in final form. Ask your assessor which artifacts they will accept before you reuse CSF evidence.
Mapping equivalence disclaimers
NIST does not check the correctness of non-NIST mappings, and listing a mapping does not imply endorsement. ENISA states that its own mapping is not a measure of equivalence and does not assess whether a standard fully covers a regulation. Treat any CSF-to-CMMC crosswalk, including vendor spreadsheets, as a starting point that you verify line by line against the CMMC model.
Scope beyond CUI systems
CSF 2.0 applies to the whole enterprise, including business systems, corporate IT and functions that never touch CUI. CMMC applies only to the systems that store, process or transmit FCI or CUI and to the assets that can affect them. Map your CSF program to the full organization, then confirm your CMMC assessment boundary separately, because outcomes achieved outside that boundary will not satisfy a CMMC assessment.
How each framework is assessed and what it issues
Level 1 applies to contractors that handle Federal contract information but no CUI. It requires the 15 safeguarding requirements of FAR 52.204-21, and the contractor performs the assessment itself under 32 CFR 170.15. The output is a self-assessment with no third-party certificate, so the proof is a documented record the contractor can show the contracting officer on request. The eCFR text of Part 170 sets the exact wording of each obligation.
- Cadence: The self-assessment repeats every year under 32 CFR 170.15, so the obligation recurs annually.
- Scoring: Every requirement must be MET. A single unmet requirement fails the level.
- No POA&M: A plan of action and milestones is not permitted at Level 1, so gaps must be closed before the result is recorded.
- Award status: DFARS 204.7502 requires a Final status for Level 1 award, so a Conditional status does not support award at this level.
- Affirmation and posting: Annual affirmations and SPRS postings remain in place under the current Phase I rules, so the entered result must be accurate.
Confirm with the contracting officer that each solicitation names Level 1, and confirm the current SPRS posting steps in your own account before relying on the result.
Level 2 applies when a contract involves CUI. The requirements are the 110 requirements of NIST SP 800-171 Rev. 2, as set in 32 CFR 170.14(c)(3) and counted in 32 CFR 170.4. The contractor assesses itself against the assessment objectives of NIST SP 800-171A (June 2018), and the score is posted to SPRS. Because the contractor generates this evidence, the quality of the evidence file determines whether the record holds up when a later assessor or contracting officer reviews it.
- Scope: Systems, people and facilities that handle CUI, along with those that could affect them, fall inside the assessment boundary. Scope drives most of the effort.
- Scoring: A requirement is MET only when every applicable objective is satisfied with evidence in final form, including drafts that were never finalized.
- Plan of action: Open items may be carried on a POA&M only under the conditions in 32 CFR 170.21, so check those conditions before using one.
- Higher status: A Level 2 (Self) result also satisfies Level 1 (Self) for the same assessment scope.
- Level selection: The contract or solicitation sets the required level, so the contractor applies the level stated in the contract.
Ask the contracting officer which level applies to each contract, and confirm the repeat interval for Level 2 self-assessments in the current text of 32 CFR 170.16 before scheduling the next cycle.
Level 2 certification is an assessment performed by a C3PAO authorized or accredited by The Cyber AB, the CMMC Accreditation Body. It uses the same 110 requirements and SP 800-171A objectives as the self-assessment, but an independent assessor makes the determination. Under DFARS 204.7502(b)(2), Level 2 may hold a Conditional status for up to 180 days from the CMMC status date, and award can occur during that window, which shapes pursuit timing for each contract.
- Conditional status: Levels 2 and 3 may hold a Conditional status for up to 180 days from the CMMC status date, and award can occur while that status is in effect.
- Higher status: A Level 2 (C3PAO) result also satisfies Level 1 (Self) and Level 2 (Self) for the same assessment scope.
- Who assesses: The C3PAO performs the assessment, and this path is the only one that produces a third-party Level 2 certification determination.
- Program status: On 13 July 2026, the Department of War suspended CMMC Phase II, which would have required Level 2 C3PAO certification for applicable contracts. A 60-day review by a CMMC Reform Task Force followed, and Phase I self-assessments remain in place.
- Cost drivers: Assessor fees, remediation, evidence preparation and the size of the CUI environment drive cost. Ask each C3PAO for a written scope and fee basis before engaging.
Confirm the current Phase II status and whether each solicitation requires C3PAO certification, since the suspension changes timing for individual contracts.
The NIST Cybersecurity Framework 2.0 has no assessment, no certificate and no conformity program. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans to develop a conformity assessment program. Any evidence of CSF maturity is therefore a record the organization builds for itself or one that a customer defines in a contract.
- Profiles: Organizational Profiles record Current and Target states across the Core, and they are the working record most CSF programs keep.
- Tiers: Partial, Risk Informed, Repeatable and Adaptive characterize the rigor of governance and risk management. They produce no pass or fail result.
- Core structure: The Core has six Functions, 22 Categories and 106 Subcategories, and CSF 2.0 added the Govern Function to the five Functions of earlier versions.
- Who requires it: NIST describes most CSF use as voluntary, though some customers or suppliers require it. A 2017 executive order made it mandatory for U.S. federal agencies.
- Consultants: NIST states that organizations are not required to hire a consultant to implement or assess the CSF.
Ask any customer or regulator what evidence they will accept, since a CSF profile alone will not satisfy a contract that names a CMMC level.
Who assesses CMMC and the CSF, and what each produces
This table shows who checks each CMMC level or the CSF, what document or status that check produces, and how often it recurs. Read the rows as a ladder: CMMC is a contract condition with a fixed assessor and status model, while the CSF has no assessor or certificate at all. Confirm the current Phase schedule with the contracting officer before you plan an assessment, because the rule text and the DoW CIO page differ.
| Level or framework | Assessor | Output and cycle |
|---|---|---|
| CMMC Level 1 (self) | The organization itself, with results entered in SPRS | Annual self-assessment and affirmation; every requirement must be MET, and no POA&M is permitted under 32 CFR 170.15 |
| CMMC Level 2 (self) | The organization itself, scored against NIST SP 800-171A objectives | Self-assessment result posted to SPRS with annual affirmation; used where a contract allows self-assessment rather than certification |
| CMMC Level 2 (C3PAO) | Certified third-party assessment organizations accredited through The Cyber AB | Certification status with a defined validity period; Conditional status can permit award for up to 180 days under DFARS 204.7502 |
| CMMC Level 3 (DCMA DIBCAC) | DCMA DIBCAC, the government assessor | Government-issued certification status for the highest CMMC tier; applies only where the contract requires Level 3 |
| NIST CSF 2.0 (no certification body) | No assessor; NIST offers no certification or conformity assessment program | No certificate or attestation; the organization documents its own Current and Target Profiles and Tier, and any customer audit is contractual |
| Phase schedule to confirm | DoW CIO and the contracting officer | The 13 July 2026 suspension of Phase II and the 17 October 2026 DoW CIO page describe a paused Phase 1, while the eCFR text of 32 CFR 170.3(e) still lists the original four phases. Confirm the current schedule in writing before planning. |
Doing both: the order that avoids duplicate evidence
This sequence lets a contractor meet the CMMC level its contracts require first, then build the wider CSF program on evidence that already exists, so the same controls are documented once and mapped many times.
Confirm contract and CUI scope
Contracts/legal and the program owner read the solicitation, the DFARS clauses in the contract and the requirements that govern federal contract information and controlled unclassified information. The output is a written statement of which CMMC level each contract requires and whether the work involves FCI only or CUI. Ask the contracting officer or your prime contractor to confirm the required level if the contract language is unclear. The step is done when each contract is tagged with a level and a data type.
Define the CUI asset boundary
The security lead, with IT operations, lists every system, enclave, service and external provider that stores, processes or transmits CUI or FCI, plus the people and networks that connect to them. Diagram data flows so that out-of-scope assets are documented as well as in-scope ones. The output is a scoped asset inventory and boundary diagram that the assessor can review. The step closes when the boundary has been approved by the accountable executive and matches the data flows observed in practice.
Complete the CMMC level required
The compliance lead assesses the in-scope boundary against the CMMC Model requirements for the required level, using the assessment objectives in NIST SP 800-171A. Level 1 requires every requirement to be MET with no POA&M, and Level 2 assessments require final-form evidence for each applicable objective. Where a higher status satisfies a lower one for the same scope, record that relationship once. The output is a scored self-assessment or certification-ready evidence package, with SPRS posting handled where the rule requires it. The step closes when each requirement has a MET or documented status and the evidence is final, not drafts.
Store evidence in final form once
The compliance lead sets up one evidence repository keyed to CMMC requirement IDs, such as AC.L2-3.1.1, and requires owners to upload approved versions only. Policies, configuration exports, logs and training records are tagged with the requirement they support and the date they were approved. The output is a single evidence index that every later framework references rather than copies. The step closes when a sample of requirements can be traced to a final artifact without consulting a draft.
Map CMMC evidence to CSF outcomes
The GRC analyst uses the NIST CSF 2.0 Reference Tool to link CSF Subcategories to SP 800-171 Rev. 3 requirements and to the CMMC evidence already in the repository. Because CMMC still uses Rev. 2, the team records which Rev. 2 requirement each Rev. 3 mapping covers and notes any gaps. Mappings are informative, so the team confirms each one against its own environment rather than assuming equivalence. The output is a crosswalk from CSF Subcategories to existing evidence, plus a list of enterprise outcomes with no evidence yet. The step closes when every mapped Subcategory points to a repository entry or a named gap.
Set Organizational Profiles and Tiers
Executive leadership and risk owners define a Current Profile and a Target Profile for the enterprise, then select the Tier, from Partial to Adaptive, that describes how risk decisions are governed. This governance layer sets priorities for non-CUI systems that CMMC does not assess, such as corporate IT, HR and business applications. The output is an approved Profile pair and Tier statement with named owners and a review cadence. The step closes when governance minutes or decisions show that CSF priorities were approved, not only drafted.
Extend the CSF program beyond the CUI scope
Program owners apply the same evidence repository and crosswalk to systems outside the CUI boundary, adding Subcategories that CMMC does not cover, such as Govern, supplier risk and recovery planning. Each extension is marked as a CSF outcome, not a CMMC requirement, so auditors and customers can see what the certification covers. The output is an enterprise CSF scorecard that reuses existing evidence where it applies and documents new evidence where it does not. The step closes when the scorecard is reviewed against the Current Profile and any gaps have owners and dates set internally.
What drives cost and effort on each side
On the CMMC side, the largest cost is usually internal staff time, and it is mostly one-time at first and recurring after that. Level 1 is a self-assessment repeated every year under 32 CFR 170.15, and every requirement must be MET with no POA&M permitted, so the company pays its own people to gather final-form evidence each cycle. Level 2 certification adds fees paid to a C3PAO authorized or accredited by The Cyber AB, and the size of that fee follows the assessment scope, which is set by how many systems and people touch CUI. The most controllable cost driver is enclave scope. A narrower CUI environment means fewer of the 110 Level 2 requirements, as defined in 32 CFR 170.14(c)(3), must be implemented across many systems. Ask the assessor and any consultant to show, in writing, which assets are in scope and why.
Rework is the cost most often underestimated. Under 32 CFR 170.16, 170.17 and 170.24(b), a requirement counts as MET only when every applicable objective in NIST SP 800-171A is satisfied with evidence in final form, not drafts. Policies written late, screenshots taken without dates, and configurations that changed after evidence was captured all force re-testing. Before you request a quote, confirm the current assessment status with the Department of War, because the 13 July 2026 suspension of Phase II means the timing and required level for your contracts may change. On the CSF side, costs are mostly internal governance work: assigning owners, building Current and Target Organizational Profiles, and tracking Subcategory outcomes across six Functions. NIST does not recommend consultants and does not certify them, so any outside help is an optional expense. Tooling for the CSF 2.0 Reference Tool is free, so tool cost is mainly license spend on GRC or ticketing products you choose. NIST has not published cost figures for either side, so request a written quote listing staff hours by role, assessor fees, scope assumptions, retest allowances, and which items recur annually.
Common questions before choosing or hiring outside help
Does a NIST CSF program satisfy CMMC requirements?
No. A CSF program does not satisfy CMMC by itself. CMMC Level 2 assesses the 110 security requirements that 32 CFR 170.14 ties to NIST SP 800-171 Rev. 2, and each requirement must be MET with evidence in final form. The CSF can help organize governance and risk work across the enterprise, and its informative references point to SP 800-171 Rev. 3, but a CSF profile is not a CMMC assessment result. Contractors handling CUI still need to scope those systems and check each CMMC requirement against them, and the assessment itself is set by the rule, not by the framework.
Can our team self-assess CMMC Level 2 without an outside assessor?
Only if the contract allows it. Level 2 self-assessment is permitted for some contracts, while others require a certification assessment by a C3PAO, and the contract's CMMC requirement determines which applies. Confirm the required level and status with the contracting officer before planning the work. Self-assessment still requires the team to test each requirement against the NIST SP 800-171A assessment objectives, produce final evidence, and post results to SPRS. Because the Department of War suspended Phase II in July 2026, confirm the current rules in the contract and the DoW CIO's CMMC pages before deciding.
How long does a CSF program or CMMC readiness effort take?
No duration can be stated from the supplied material. The timeline depends on the contract requirement, the size of the CUI scope, how many systems and third parties fall inside it, and how much evidence already exists in final form. Ask for the timeline as a written milestone plan tied to the agreed scope, and ask which deliverables each milestone produces. For a CSF program, the duration depends on which Categories and Subcategories are in scope and which Tier the organization targets. Treat any single number offered without a scope as a red flag.
What does the work need from our internal staff?
Internal staff own the decisions and the operating evidence, so the work needs named people in IT, security, HR, and the business units that touch CUI. Engineers must document how systems are configured, who has access, and how changes are logged. Leaders must approve the scope, the system security plan, and any risk acceptance. Plan for these people to be available throughout the work, not only at the start. Ask any outside firm which roles it expects from your side and how it will record decisions, since missing internal owners is one of the most common reasons evidence stalls.
Is the NIST CSF required for our organization?
It depends on the organization. NIST describes the CSF as a voluntary framework with no certification, and NIST is not a regulatory agency. Most organizations use it voluntarily, though some customers or suppliers require it contractually, and U.S. federal agencies were required to use it under a 2017 executive order. For defense contractors, the binding obligations come from the contract, DFARS 252.204-7012 and the CMMC rule, not from the CSF. Check your contracts, customer security questionnaires and sector regulators to see whether the CSF is named.
What does outside help cover, and what stays with us?
Outside help can plan the scope, design the control environment, integrate the controls with systems, document the evidence, test readiness, and prepare the package for the assessment. DeployOpen plans, implements, documents, and supports self-hosted open-source platforms in your own infrastructure, and prepares systems, controls, and evidence for compliance assessments. It does not issue audit reports, attestations, or certifications, and it does not act as a C3PAO or DCMA DIBCAC. Most engagements are fixed-scope, with scope, deliverables, and timelines agreed in writing before work starts, and pricing follows from that written scope. Ask for a list of deliverables, the owner for each, and what remains your responsibility after handover.
How DeployOpen prepares CMMC and CSF readiness
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For CMMC vs NIST CSF work, we prepare the systems, controls and evidence a contractor needs, while the assessment itself stays with the body that the rule names.
How we scope
- Agree in writing which systems hold FCI or CUI and which support them before any work starts.
- Confirm which assessment path applies, self-assessment or third-party certification, before choosing controls to build.
- Record the in-scope environment, deliverables and timelines in a fixed-scope agreement, with a quote following from that scope.
How we build
- Implement and configure self-hosted platforms in your own cloud accounts, data centers or air-gapped networks.
- Map each CMMC requirement and CSF subcategory to the controls, owners and evidence your environment produces.
- Run security testing against in-scope systems so gaps are found and fixed before an external assessor reviews them.
How we hand over
- Deliver system documentation, control mappings and evidence packages in a form your assessors and auditors can review.
- Hand over runbooks and configuration records so your own staff can operate and update the controls after the engagement.
- Document open gaps and any items you must confirm with the assessment body, your contracting officer or the vendor.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover.
- Keep the control mappings current when the CMMC rule, DFARS clauses or NIST guidance change.
- Support evidence refreshes for each assessment cycle, while your organization keeps responsibility for its own compliance status.
Sources and further reading
- eCFR: 32 CFR Part 170, CMMC Program ↗
- CMMC Program final rule, 32 CFR Part 170 (Federal Register, 15 October 2024) ↗
- NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 (PDF) ↗
- NIST CSF 2.0 Reference Tool export: Core, Implementation Examples and Informative References ↗
- NIST Informative References for CSF 2.0 ↗
- DoW CIO: About CMMC ↗
