Defense Contractor Cybersecurity Preparation Package

Package 03: Defense contractor cybersecurity

Gather the contract, information flow and security records a CMMC or NIST SP 800-171 specialist needs to scope the work. Who uses it: Contract managers, small business owners, CISOs, project coordinators and IT providers. Scope: Safeguarding of Federal Contract Information and Controlled Unclassified Information under FAR 52.204-21 and DFARS 252.204-7012, and preparation for CMMC. Scoring, assessment and certification stay with the specialist and the authorized assessor.

Before you gather

Read the contract first. The Department of War CIO memorandum of July 13, 2026 suspended the November 2026 CMMC Phase 2 transition. Class Deviation 2026-O0025 Revision 3 directs contracting officers to amend solicitations and contracts to match, permits Level 1 and Level 2 self assessments, keeps baseline compliance with NIST SP 800-171 Revision 2 under DFARS 252.204-7012, and prescribes the clause at DFARS 252.240-7997, NIST SP 800-171 DoD Assessment Requirements (FEB 2026). The client's own solicitation amendments and contract modifications decide what applies, so collect them.

Use the right revision. NIST has published SP 800-171 Revision 3, but the CMMC rule incorporates Revision 2 (32 CFR 170.2), and Revision 2 is the baseline the deviation keeps. Map evidence to the Revision 2 requirements and the matching SP 800-171A assessment procedures unless the contract says otherwise.

Separate the information types. FCI, CUI, export controlled information and classified information each rest on a different basis. Ask the government or prime contractor owner for the CUI categories, markings and handling instructions, which set the level and the boundary.

Plan where artifacts will live. For a Level 2 certification assessment or a Level 3 assessment, the organization hashes its artifact files with a NIST approved hashing algorithm and keeps them for six years from the CMMC Status Date (32 CFR 170.17 and 170.18). Keep sensitive records in the agreed controlled environment and let the preparation index point to them.

Using the worksheets

Give each request to its suggested owner and record each response, including any gap, in Gathering-checklist.csv. Point to records held in the approved evidence location, where passwords, real patient data and controlled technical information stay.

Defense contractor cybersecurity: records to find

Each request below matches a row in Gathering-checklist.csv. Record the response, status and record IDs there.

CM-R01 Actual contract package

Ask: Contract administrator.

Gather: Solicitation, statement of work, contract, orders, incorporated clause versions, flowdowns, amendments, modifications, options and correspondence about CMMC.

Where to ask: Contract repository and prime customer.

Why it matters: Establishes the basis for specialist scoping.

If missing or uncertain: Ask prime or contract officer through authorized client channels; record unresolved interpretations.

Sources: CM04; CM05; CM06; CM07

CM-R02 Current implementation instructions

Ask: Contracts and counsel.

Gather: Current applicable deviations, written direction and modification history addressing the July 2026 suspension and any subsequent changes.

Where to ask: Contract file and official deviation index.

Why it matters: Prevents reliance on a superseded generic rollout date.

If missing or uncertain: The specialist reconciles the deviation with the actual contract before an assessment path or date is set.

Sources: CM02; CM03; CM07; CM10

CM-R03 Information types and authority

Ask: Program or data owner.

Gather: Customer provided CUI categories or markings, handling instructions, FCI description, contract data lists and export or security restrictions; masked examples where permitted.

Where to ask: Program office, contract data repository.

Why it matters: Supports the data classification and boundary discussion.

If missing or uncertain: Record who can confirm the designation; the government or prime owner sets CUI designations and markings.

Sources: CM01; CM04; CM06

CM-R04 Boundary and data flow

Ask: IT architect and process owners.

Gather: Systems that create, receive, process, store, transmit or protect relevant information; tenant, site or network diagrams, users, interfaces and external transfers.

Where to ask: Architecture, process walkthrough and providers.

Why it matters: Lets the specialist define candidate in scope assets and dependencies.

If missing or uncertain: List unconfirmed paths, personal accounts and legacy systems for follow up.

Sources: CM08; CM01

CM-R05 System security plan and asset facts

Ask: Security lead.

Gather: Existing SSP and revision history; asset inventory; proposed asset categories; facilities, endpoints, identity, remote access, backups and security services.

Where to ask: Security repository and asset manager.

Why it matters: Helps the specialist evaluate actual scope and existing descriptions.

If missing or uncertain: Supply drafts as drafts. Label each control as operating, planned or unverified.

Sources: NI01; CM08

CM-R06 Providers and cloud responsibilities

Ask: Provider manager.

Gather: MSP, MSSP or CSP contracts, service boundaries, customer responsibility matrices, subcontractor access and existing authorization or equivalency evidence requested by the specialist.

Where to ask: Procurement, cloud providers and contract files.

Why it matters: Clarifies inherited versus client performed work and evidence access.

If missing or uncertain: Request the client's configured service boundary alongside any sales claim or FedRAMP listing. Ask for exact service or scope and responsibility records.

Sources: CM05; CM08

CM-R07 Access and identity records

Ask: IT administrator.

Gather: Authorized user or device lists, role approvals, remote, privileged or MFA settings, employee lifecycle records and prior reviews.

Where to ask: Identity, HR, endpoint and application records.

Why it matters: Enables evidence planning for access and identification or authentication topics.

If missing or uncertain: Provide scoped records through the approved route, with credentials kept in their secure store.

Sources: NI01 access control and identification/authentication

CM-R08 Configuration and change records

Ask: Infrastructure and development owners.

Gather: Baselines, inventory, authorized software, change approvals, configuration reviews and existing patch, vulnerability or remediation records.

Where to ask: Configuration, software and ticket systems.

Why it matters: Supports configuration, integrity and risk topics.

If missing or uncertain: Identify unsupported assets and missing historical settings as gaps.

Sources: NI01 configuration management, risk assessment and system integrity

CM-R09 Logging and incident records

Ask: Security operations.

Gather: Logging policy and actual coverage or retention, alert reviews, time synchronization, incident plans, existing exercises and reporting records when releasable.

Where to ask: SIEM, providers and incident repository.

Why it matters: Prepares audit or accountability and incident response discussions.

If missing or uncertain: Document inaccessible logs or periods; incident reports follow the incident response plan.

Sources: NI01 audit and accountability, incident response; CM05

CM-R10 Physical and personnel records

Ask: Facilities and HR.

Gather: Authorized areas, visitor or access records, personnel screening or separation processes, relevant training and responsibility records.

Where to ask: Facilities, HR and providers.

Why it matters: Includes nontechnical evidence often outside IT's custody.

If missing or uncertain: Use restricted handling for personnel data and route missing policies to their owner.

Sources: NI01 awareness, personnel security and physical protection

CM-R11 Media maintenance and transfer records

Ask: IT and operations.

Gather: Removable media rules, transfer paths, storage or disposal records, maintenance approvals and remote support restrictions.

Where to ask: IT, operations, service partners.

Why it matters: Supports discussions of portable copies and service provider work.

If missing or uncertain: Identify any untracked path; specialist chooses follow up rather than assuming a control failure.

Sources: NI01 media protection and maintenance

CM-R12 Network and data protection records

Ask: Network and application owners.

Gather: Existing diagrams, boundary rules, segmented environments, communications protection, encryption or module descriptions and applicable exception decisions.

Where to ask: Network, application and cryptographic owners.

Why it matters: Lets the specialist request evidence appropriate to the actual environment.

If missing or uncertain: Supply the module and validation certificate details, with secrets kept in their secure store.

Sources: NI01 system and communications protection

CM-R13 Prior assessments and status records

Ask: Security lead and affirming official.

Gather: Existing assessment reports, scope or CMMC UID if issued, dates, SPRS records, affirmations, scoring basis and previous government findings.

Where to ask: Authorized SPRS user and assessment repository.

Why it matters: Distinguishes actual status from a readiness worksheet or marketing claim.

If missing or uncertain: State Not provided or No prior assessment reported, as appropriate. Record the status, assessment date and score exactly as issued.

Sources: CM01; CM04

CM-R14 Outstanding actions and artifacts

Ask: Project lead and security owner.

Gather: Existing POA&M, owners, dates, supporting evidence, documented constraints and prior closeout records.

Where to ask: Risk or project and assessment repository.

Why it matters: Helps plan remediation discussion; eligibility and permitted deferrals are specialist decisions.

If missing or uncertain: The specialist decides which gaps may be deferred; label proposed actions separately from implemented ones.

Sources: CM01 170.21; NI01

CM-R15 Evidence handling and collection access

Ask: Data owner and receiving specialist.

Gather: Approved repository, authorized recipients, artifact retention instructions, provider cooperation, export limits, handling labels and secure review arrangements.

Where to ask: Security, legal and contract administration.

Why it matters: Keeps sensitive evidence in the controlled environment.

If missing or uncertain: Agree the route before providing CUI or detailed artifacts. If assessment hashes or retention records are required, obtain the applicable instructions.

Sources: CM01 170.17, 170.18; CM05

CM-R16 Specialized systems and field access

Ask: Operations and specialist.

Gather: OT, test equipment, restricted systems and shared services; owners, support or vendor rules, safe review options and exclusions.

Where to ask: Operations, engineering and providers.

Why it matters: Makes technical constraints visible before a proposed assessment.

If missing or uncertain: Scanning, penetration testing and physical entry each run under a written scope and permission.

Sources: CM08; NI05

Defense contractor cybersecurity: questions for IT and system owners

A useful answer names the actual system, period, supporting record and limits. Where someone else holds the answer, record who can give it. The same questions are in IT-and-owner-questions.csv.

Defense contractor cybersecurity: decisions and handoff

These decisions belong to counsel or the receiving specialist. Each stays open until its owner records a decision. Add questions specific to the client and a responsible person in Open-questions.csv.

Preparing the handoff

The handoff is ready when the actual contract package and its current amendments are indexed; the FCI and CUI questions and any boundary or provider gaps are visible; security records are grouped by subject and period with planned items labeled as planned; and the specialist has confirmed the assessment pathway, the requirement revision and the handling route before formal work starts.

Use Record-index.csv for one row per file or defined record set, and follow the walkthrough in the library for custody, restricted records and receipt.

Sources for this package

Laws and regulations set duties within their scope; agency guidance explains how they are applied; NIST supplies methods; vendor documentation describes how a product can behave. The full list is in Source-register.csv.

CM04 DFARS CMMC clause. Federal acquisition clause. 252.204-7021 as incorporated in the contract. https://www.acquisition.gov/dfars/252.204-7021-contractor-compliance-cybersecurity-maturity-model-certification-level-requirements.

CM05 DFARS safeguarding and cyber incident reporting. Federal acquisition clause. 252.204-7012; cloud and incident obligations where incorporated. https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.

CM06 FAR basic safeguarding. Federal acquisition clause. 52.204-21; FCI and safeguards. https://www.acquisition.gov/far/52.204-21

CM07 Current defense acquisition class deviations. Agency implementation index. Class Deviation 2026-O0025 Revision 3 and any later revision. https://www.acq.osd.mil/dpap/dars/dfars_far_overhaul_class_deviations.html

CM02 Current CMMC program information. Agency program announcement. Phase 2 suspended July 13, 2026; Phase 1 continues. https://dodcio.defense.gov/cmmc/About/

CM03 CMMC Phase II suspension announcement. Agency announcement. Suspension of the Phase 2 transition, July 13, 2026. https://business.defense.gov/Engage/News/Newsfeed-Repository/Article/4542563/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/

CM10 Class Deviation 2026-O0025 Revision 3 (signed memorandum and attachments). Signed agency implementation memorandum and attachments. Suspension of the Phase 2 transition, NIST SP 800-171 Revision 2 baseline, clause 252.240-7997. https://www.acq.osd.mil/dpap/dars/classdev/DFARS_RFO/Part-240/2026-O0025_Rev3_TAB_A_Deviation_Memo.pdf

CM01 CMMC program rule. Federal regulatory compilation. 170.2 definitions and incorporation, 170.14 to 170.24 assessment requirements. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170

CM08 CMMC Level 2 scoping guidance. Agency technical guidance. Asset categories, external and cloud service providers. https://dodcio.defense.gov/Portals/0/Documents/CMMC/ScopingGuideL2v2.pdf

NI01 NIST SP 800-171 Revision 2. Technical standard publication page. 110 security requirements; the revision CMMC incorporates. https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final

NI05 NIST SP 800-115. Technical testing guidance. Assessment planning, logistics, rules of engagement and reporting. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf