cmmc compliance it support
A CMMC clause in a customer contract can put a shipment, renewal, or future defense work at risk before your team knows what to do next. CMMC compliance IT support should turn that requirement into scoped controls, maintained evidence, and a workable plan for your systems.
Key Takeaways
- A CMMC requirement in a customer contract affects your shipping schedule and eligibility for defense work, so treat it as an operations issue before it becomes a compliance emergency.
- Good CMMC compliance IT support translates the standard into specific controls mapped to the systems you actually run, including legacy equipment that cannot be patched.
- Maintained evidence matters more than a one-time assessment, because auditors and prime contractors want documentation that reflects your current environment.
- Ask any prospective provider to define scope, name the controls involved, and explain how changes will be sequenced around your production windows.
- Andromeda aligns security and compliance work with CMMC and NIST requirements while protecting uptime on the plant floor.
Start by determining which information you handle, which CMMC level applies, and how to meet its requirements without unnecessarily bringing production systems into the assessment.
Why a CMMC Clause in a Customer Contract Changes Your IT Reality
When a defense customer adds a Cybersecurity Maturity Model Certification (CMMC) requirement, your company may need to demonstrate cybersecurity practices to remain eligible for the work. The Department of Defense (DoD) uses CMMC to assess whether contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The contract and information involved determine the applicable requirements, not company size alone.
Identify whether your contract involves FCI, CUI, or both, then confirm the required CMMC level with your contracting contact. Level 1 covers basic safeguarding of FCI. Level 2 applies to CUI and aligns with National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171). Level 3 applies to the highest-priority programs and adds selected requirements from NIST SP 800-172. A support provider can help implement and document controls, but your organization remains accountable for its contract commitments.
FCI, CUI, and Why the Distinction Decides Your Level
FCI is information provided by or generated for the government under a contract that is not intended for public release. CUI is government-created or government-owned information that requires safeguarding or dissemination controls. It is not automatically classified information. The contract, customer direction, and information markings help establish what you handle.
Map where the information enters, travels, and resides, including email, file shares, engineering workstations, backups, and systems used by contract staff. This scoping work informs the assessment boundary and helps keep unrelated business or production systems outside it without a reason to include them.
The Three CMMC 2.0 Levels and What Each One Actually Requires
CMMC 2.0 has three levels. Confirm the required level with the contracting authority rather than guessing from a general description of your business.
| Level | Information and framework | Assessment path |
|---|---|---|
| Level 1, Foundational | FCI; aligns with FAR Clause 52.204-21 and its basic safeguarding requirements. | Annual self-assessment and executive affirmation. |
| Level 2, Advanced | CUI; aligns with the security requirements in NIST SP 800-171. | Assessment frequency and type depend on the contract; applicable contractors undergo a triennial assessment by a Certified Third-Party Assessment Organization (C3PAO). |
| Level 3, Expert | Selected requirements from NIST SP 800-172 for the highest-priority programs. | Government-led assessment for applicable programs. |
How CMMC Maps to NIST SP 800-171
NIST SP 800-171 defines security requirements for protecting CUI in nonfederal systems. CMMC Level 2 uses that framework as its control foundation, while the CMMC program sets the assessment and affirmation structure for applicable contracts. Meeting a checklist once does not keep controls operating or evidence current.
Self-Assessment vs C3PAO Third-Party Assessment
A self-assessment means your organization evaluates its implementation and records the result. A C3PAO assessment is an independent evaluation by an authorized third-party organization when the contract calls for it. Both require an accurate scope, supporting evidence, and accountable leadership. Andromeda’s IT Compliance Support can support customer-driven compliance alignment, including CMMC, while your company retains responsibility for its assessment statements.
What CMMC Compliance IT Support Looks Like Month to Month
Controls can fall out of date when employees change roles, devices are replaced, or system configurations shift without documentation. CMMC compliance IT support is ongoing operational work: maintaining access rules, applying approved updates, recording evidence, and tracking gaps. Your provider should show what changed, when, and who approved it.
Andromeda’s IT Compliance Support includes automated tracking, real-time dashboards, change logs, audit-ready documentation, and version control. These tools organize the work; they do not replace your organization’s decisions, policies, or required affirmations.
The Controls a Support Provider Touches Every Week: Access, MFA, Patching, Media, Auditing
Routine support should make control changes traceable, not treat compliance as a separate annual project. A practical weekly and monthly review can include:
- Checking account creation, role changes, departures, and privileged access.
- Confirming multifactor authentication (MFA) is active for required accounts and reviewing exceptions.
- Tracking patch status, documenting approved deferrals, and escalating unsupported systems.
- Recording removable-media approvals and relevant audit events.
For systems that cannot be patched on a standard schedule, document the constraint and agreed safeguards. A “patch complete” report is not enough if it omits exceptions and ownership.
Evidence Collection, the SSP, and POA&M Upkeep as Ongoing Work
The System Security Plan (SSP) describes the system boundary, implemented controls, and how the organization meets requirements. A Plan of Action and Milestones (POA&M) tracks permitted gaps and planned remediation. Keep both current rather than assembling them from memory before an assessment. Maintain evidence close to the work: access reviews, configuration records, training logs, incident procedures, and approved exceptions.
Assign an owner and due date to each open item, then update its status when evidence changes. A provider can maintain technical records and flag missing documentation; your team must verify that the description matches actual practice.
Keeping Controls From Decaying Between Assessments: Change Control and Continuous Monitoring
Equipment replacements, new software, vendor access, and network changes can alter the system boundary or weaken a control. Record each change request, risk review, approval, implementation, and validation. Real-time risk alerts can surface issues, but they need an assigned responder and documented disposition.
Andromeda’s compliance work includes change logs, version control, and continuous monitoring with real-time risk alerts. Your team should be able to explain a change and show its supporting record months later.
Annual Affirmations and Who Signs
For Level 1, the annual self-assessment is paired with an executive affirmation. Applicable Level 2 contractors also have affirmation responsibilities under the CMMC program. The accountable senior official must understand what is being affirmed and have a reasonable basis for the statement. A provider may prepare reports and explain technical status, but company leadership must sign.
Operational takeaway: Assign a business owner for each compliance decision, a technical owner for each control, and a recurring review date for evidence. Keep controls and records current between formal assessment events, not just at assessment time.
Keeping CUI Work Off the Production Floor: OT, Uptime, and the Compliance Boundary
CUI work should not pull every production system into the assessment boundary or put a running line at risk. Map where contract information is created, accessed, stored, and transmitted. That map helps identify the users, devices, applications, and networks needing controls, while documenting why unrelated systems sit outside the boundary.
Scoping the Assessment Boundary So the Line Keeps Running
Trace information from customer files through engineering, email, storage, backups, and connected service providers. Include systems that process, store, or transmit CUI, plus systems that protect them. Confirm the scope with your customer and qualified compliance personnel. A provider can document technical dependencies, but contract interpretation and assessment decisions need appropriate owners.
Segmenting IT From OT/MES Networks and Legacy Controllers
A flat network can let an office laptop and machine controller communicate without a production reason. Segmenting information technology (IT) from operational technology (OT), including manufacturing execution system (MES) networks, limits unnecessary paths. Legacy programmable logic controllers (PLCs) may not support current patching, so safeguards can include restricted access, monitored connections, and documented exceptions. Test changes against machine and vendor dependencies.
Sequencing Compliance Changes Around Maintenance Windows and Shifts
Authentication changes, firewall rules, endpoint protection, and software updates can interrupt production data access if rushed. Review dependencies with operations and maintenance, test changes in a controlled setting when feasible, and schedule disruptive work during approved maintenance windows. Keep a rollback plan and named decision-maker available. Compliance work should protect the contract boundary without creating avoidable downtime.
A Shared Responsibility Matrix: What Your MSP Owns, What Microsoft Owns, What You Still Sign For
Cloud services divide technical responsibilities, but your organization remains accountable for CUI. The split depends on the service, configuration, contract, and system boundary. Use a written responsibility matrix and verify it against your tenant and assessment scope.
| Control area | Provider or MSP | Microsoft cloud platform | Your organization |
|---|---|---|---|
| Accounts and access | Configure approved access, maintain records, and escalate exceptions. | Operate platform identity features included in the subscribed service. | Approve access, assign business roles, and review user need. |
| Cloud infrastructure | Manage customer-side settings and document changes within its agreement. | Secure and operate the underlying cloud infrastructure under its service commitments. | Select appropriate services and confirm the configuration fits the CUI boundary. |
| Endpoints and network | Apply agreed device safeguards, monitor alerts, and record remediation. | Provide relevant cloud controls and service information. | Identify approved devices, production dependencies, and operating constraints. |
| Policies and affirmation | Supply technical evidence and explain open items. | Provide service documentation for applicable controls. | Approve policies, validate practice, and sign required affirmations. |
Can Your Generalist MSP Get You CMMC-Ready? How to Vet a Provider
A generalist provider may support the work if it can explain CUI scoping, control implementation, evidence, and production dependencies in concrete terms. The difference is whether it assigns control owners, maintains records, and coordinates changes with operations. Ask for examples of its process, not a broad promise of readiness.
Why CMMC Compliance IT Support Is a Different Job Than a Help Desk Contract
Ticket response addresses individual interruptions. Compliance work also requires an accurate system boundary, documented configurations, risk tracking, and evidence that reflects how controls operate over time. Andromeda’s IT Compliance Support supports customer-driven compliance alignment, including CMMC, with audit-ready documentation and version control. It can complement technical operations, but does not replace your assessor, legal guidance, or leadership decisions.
14 Questions to Ask Any Provider Before You Sign
Use these questions to check that the work covers implementation and ongoing maintenance, not documentation alone:
- How will you map our CUI flow and assessment boundary?
- How will you confirm which systems handle CUI?
- Who validates the scope with our customer?
- How will you separate production OT from the CUI environment?
- How do you handle controllers that cannot be patched?
- Who approves access and account changes?
- How are multifactor authentication exceptions tracked?
- How are cloud settings checked and documented?
- Who maintains the System Security Plan and open-item records?
- What evidence will we receive, and how often?
- How are alerts assigned, investigated, and closed?
- How are changes tested and scheduled around shifts?
- What work is excluded from the contract?
- Who prepares us for an assessment without claiming to certify us?
Contract Terms and Red Flags: Binder Consulting vs Implemented Controls
A documentation package has limited value if it describes controls that are not operating. Contract language should name technical tasks, evidence deliverables, review frequency, escalation paths, exclusions, and remediation responsibilities. Ask how the provider verifies that written procedures match account settings, network rules, device records, and staff practices.
What to Expect in the First 90 Days and the Normalization Period
Early work commonly includes discovery, boundary decisions, access review, risk prioritization, and assigning owners for evidence and remediation. The schedule depends on your controls, contract scope, legacy equipment, and internal availability. Andromeda reports a **12.0-minute median ticket response time** and **97% of issues resolved within 8 business hours**, based on site metrics updated weekly from the trailing 30 days. These service measures describe support responsiveness, not a CMMC completion timeline.
Andromeda’s IT Compliance Support can help organize technical work, while your team retains ownership of contract commitments and affirmations. Expect a documented plan, clear control owners, and progress reviews before expecting every gap to close.
CMMC Compliance IT Support FAQ
Does CMMC Apply to Subcontractors or Only Prime Contractors?
CMMC requirements can apply to subcontractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) under a Department of Defense contract. Subcontractor status alone does not determine whether a requirement applies. Review contract flow-down clauses and confirm the level with your prime contractor or contracting contact.
What Is the Difference Between CMMC and NIST SP 800-171?
National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171) defines security requirements for protecting CUI in nonfederal systems. CMMC establishes a Department of Defense assessment and affirmation program. Level 2 aligns with NIST SP 800-171, while the contract determines the assessment path and required evidence.
Which CMMC Level Does a Small Manufacturer Need?
Company size does not set the level. Level 1 applies to contracts involving FCI, Level 2 generally applies when work involves CUI, and Level 3 is for designated, highest-priority programs. Check your contract and ask your contracting contact to confirm the level before budgeting for assessment work.
How Long Does CMMC Readiness Take and What Does a C3PAO Assessment Involve?
Readiness time depends on your scope, current controls, documentation, and unresolved gaps. A Certified Third-Party Assessment Organization (C3PAO) evaluates applicable Level 2 requirements and evidence. Expect interviews, record reviews, and examination of how controls operate. Build time for corrective work before scheduling; a provider cannot responsibly promise a fixed timeline without reviewing your environment.
What Happens If We Lose Certification or Miss an Annual Affirmation?
A missed affirmation or certification issue can affect contract eligibility and future work. Notify the appropriate contracting contact, determine which requirement was missed, and document corrective actions with accountable owners. Seek guidance from responsible contracting and compliance contacts; a technical provider cannot resolve the contract impact on its own.
If a contract clause has raised questions about your systems or next steps, Andromeda’s IT Compliance Support can help organize technical controls and evidence. If you are not ready to speak with a provider, use the IT Drag™ Calculator to identify operational friction first.
Frequently Asked Questions
What is CMMC compliance?
CMMC compliance means demonstrating to the Department of Defense (DoD) that your company protects Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Defense contractors must show implemented cybersecurity practices and maintain evidence, because a CMMC requirement in a customer contract directly affects eligibility for defense work.
When is CMMC compliance required?
CMMC compliance is required when a DoD contract or a defense customer adds a CMMC clause to your agreement. The contract and the type of information you handle determine the requirements, not your company size. Confirm the applicable level with your contracting contact before making changes.
What are the CMMC compliance levels?
CMMC 2.0 has three levels. Level 1 (Foundational) covers basic safeguarding of FCI with an annual self-assessment. Level 2 (Advanced) applies to CUI and aligns with NIST SP 800-171, with triennial C3PAO assessment where applicable. Level 3 (Expert) adds selected NIST SP 800-172 requirements with a government-led assessment.
How do I prepare for a CMMC assessment?
Start by mapping where FCI or CUI enters, travels, and resides in your systems, including email, file shares, and backups. That scoping work sets your assessment boundary. Then keep your System Security Plan (SSP) and POA&M current, and maintain evidence like access reviews and training logs close to the work rather than assembling them from memory before an assessment.
What does CMMC compliance IT support look like month to month?
CMMC compliance IT support is ongoing operational work: maintaining access rules, applying approved updates, recording evidence, and tracking gaps. A good provider shows what changed, when, and who approved it. Andromeda's IT Compliance Support includes automated tracking, real-time dashboards, change logs, and audit-ready documentation.
What is the difference between FCI and CUI?
FCI is information provided by or generated for the government under a contract that is not intended for public release. CUI is government-created or government-owned information requiring safeguarding or dissemination controls, and it is not automatically classified. Which one you handle decides your CMMC level.
Who is responsible for CMMC compliance, my company or my IT provider?
Your organization remains accountable for its contract commitments and assessment statements. A support provider can help implement and document controls, maintain evidence, and keep the SSP and POA&M current. The decisions, policies, and required affirmations stay with your leadership.