CMMC Phase 1 changes defense supply chain compliance timing

At a glance

What this is: CMMC Phase 1 is now live, making Level 1 or Level 2 assessment readiness a contract condition for many defense suppliers.

Why it matters: For IAM, NHI, and broader security teams, this shifts CMMC from a compliance project into an operational eligibility gate tied to evidence, scope, and control ownership.

By the numbers:

• As of the October CyberAB Town Hall, only 431 organizations had achieved a final CMMC Level 2 certification.
• Only 1% of DIB organizations felt fully prepared for upcoming CMMC assessments, according to CyberSheath research cited by Secureframe.
• Fewer than 50% have completed foundational documentation like an SSP or POA&M or implemented all NIST 800-171 requirements.
• The average SPRS score remains at just 60, far below the required 110.

Context

CMMC Phase 1 matters because it changes defence cybersecurity compliance from a future policy deadline into a live contract condition. The first practical question for contractors is no longer whether the framework is understood, but whether the organisation can prove scope, evidence, and assessment readiness at the point of award.

That shift has governance implications well beyond the compliance team. Security, IAM, PAM, asset owners, and third-party risk teams all have to align on who owns the evidence trail, which systems are in scope, and how quickly controls can be demonstrated when bids move. In that sense, CMMC readiness is now a procurement and identity governance problem as much as a control framework problem.

Key questions

Q: What fails when CMMC readiness is not in place at award time?

A: The failure is not just a compliance gap, it is a contract eligibility gap. When the required self-assessment, certification evidence, or third-party assessment is missing, the supplier may lose the award opportunity or face delay while it tries to close documentation and scope gaps.

Q: Why does CMMC create legal and operational risk before full rollout finishes?

A: Because the underlying security requirements already exist in contract and regulatory language, late or inaccurate readiness can create False Claims Act exposure, missed delivery timelines, and weaker supply chain resilience even before later phases arrive.

Q: How should contractors measure whether CMMC readiness is real?

A: They should measure whether they can produce current SSPs, active POA&Ms, scoped inventories, access review records, and system boundary evidence without last-minute reconstruction. If the evidence only exists during audit preparation, readiness is not operational. Real readiness shows up as repeatable proof, not as a one-time document sprint.

Q: What is the difference between CMMC Level 1 self-assessment and Level 2 assessment readiness?

A: Level 1 focuses on the basic safeguard set and a self-assessment, while Level 2 adds the much heavier burden of mapping CUI scope, implementing NIST SP 800-171 controls, maintaining richer evidence, and sometimes passing a third-party assessment.

Technical breakdown

How CMMC Phase 1 becomes a contract control

Phase 1 turns CMMC into an enforceable procurement requirement through the 48 CFR rule and DFARS 252.204-7021. That matters because the control no longer sits only in policy or guidance, it enters the award process itself. For Level 1, the contractor must show basic safeguard implementation and self-assess; for Level 2, the organisation must map CUI scope, document 110 NIST SP 800-171 requirements, and sometimes undergo third-party assessment. The technical burden is not just compliance paperwork. It is the ability to prove that controls, systems, and evidence all line up at contract time. Practical implication: treat CMMC readiness as a governed control state, not a periodic documentation exercise.

Practical implication: build contract-triggered evidence workflows that keep scope, controls, and attestations continuously current.

Why evidence readiness is the real bottleneck

CMMC is hard at Phase 1 because the limiting factor is evidence throughput, not awareness. Many organisations still lack a current SSP, a usable POA&M, or a reliable inventory of in-scope systems and vendors. That creates a documentation bottleneck that slows assessment, delays award, and weakens the credibility of self-attestation. For defence suppliers, the problem is especially acute because contract timelines are shorter than internal remediation cycles. When evidence is fragmented across spreadsheets and teams, the organisation cannot prove control operation quickly enough. Practical implication: centralise control evidence and assessment artefacts before the next solicitation arrives.

Practical implication: centralise control evidence and assessment artefacts before the next solicitation arrives.

Why assessment scope, not just controls, determines readiness

Level 2 readiness depends on scoping discipline as much as on control implementation. The organisation has to know where CUI or SPD resides, which users and vendors touch it, and which systems are truly in scope. Without that mapping, even a technically strong control set can fail an assessment because the boundary is wrong. This is where NHI, service accounts, and third-party access matter indirectly. If machine identities, vendor integrations, or service credentials can reach CUI systems without clear ownership and lifecycle controls, the assessment boundary becomes unstable. Practical implication: document identity, vendor, and system relationships before you attempt to certify the environment.

Practical implication: document identity, vendor, and system relationships before you attempt to certify the environment.

Threat narrative

Attacker objective: The operational objective is not traditional intrusion but contract exclusion, delayed delivery, and weakened supplier trust when readiness gaps cannot be closed in time.

1. Entry occurs when defence suppliers delay readiness and discover too late that CMMC requirements are already embedded in contracts and solicitations.
2. Escalation follows when incomplete SSPs, POA&Ms, and scoping evidence prevent the organisation from proving compliance at award time.
3. Impact is lost contract eligibility, delayed awards, and elevated legal and operational exposure across the defence supply chain.

NHI Mgmt Group analysis

CMMC Phase 1 is a governance test, not a documentation refresh: the decisive issue is whether a defence supplier can prove control operation at the moment eligibility is judged. That changes compliance from a back-office function into a live business dependency, especially where award timing, subcontract flow-down, and evidence ownership are distributed. Practitioners should treat readiness as a continuously maintained control state, not a project milestone.

Assessment scope is now a security boundary problem: Phase 1 exposes how often compliance programmes underestimate the complexity of system, vendor, and identity boundaries. A weak scope model creates false confidence because the organisation may have controls on paper while critical CUI paths remain unclearly owned or untracked. For IAM and security architects, this is where identity governance and third-party access management become part of compliance evidence, not separate concerns.

Evidence throughput is the new limiting factor in defence compliance: the article’s readiness data show that many suppliers are blocked less by intent than by their ability to assemble SSPs, POA&Ms, and assessment artefacts quickly and consistently. That creates a structural advantage for organisations that can centralise control evidence and automate drift detection. Practitioners should view automation as an evidence-production capability, not just a workflow convenience.

CMMC is becoming a supply chain discipline: once contract eligibility depends on provable readiness, primes and subcontractors inherit each other’s governance weakness. That creates an ecosystem effect where one supplier’s delay can cascade into programme delays and commercial risk. The practical conclusion is that defence supply chains need shared visibility into assessment status, control ownership, and remediation timing.

The control gap CMMC exposes is unmanaged readiness drift: organisations often assume compliance can be assembled at the end of the cycle, but the rule now rewards continuous readiness and punishes late evidence collection. That assumption failed here because contract award timing moved earlier than internal compliance habits. Practitioners should reframe readiness as a standing operational control, not a seasonal audit activity.

What this signals

Contract eligibility is now the governance outcome that matters most: the practical measure of success is no longer whether a defence supplier has started its CMMC journey, but whether it can pass an award-time check without disrupting delivery. That shifts budget, ownership, and board attention toward continuous evidence readiness rather than periodic remediation.

Identity governance now sits inside compliance execution: CMMC scope depends on which users, systems, vendors, and service accounts can touch controlled information. If those relationships are not mapped, the organisation cannot prove the boundary of the environment it is certifying, and that is where many programmes will stall.

Readiness drift is the operational problem to watch: organisations that rely on spreadsheets and one-time assessments will struggle to keep SSPs, POA&Ms, and control evidence aligned with contract timing. The programme signal to watch is whether evidence can be regenerated quickly enough to support award decisions without manual reconstruction.

For practitioners

• Map contract-triggered CMMC obligations Identify which bids, solicitations, and subcontract flows now require Level 1 or Level 2 evidence before award, then assign control owners for each requirement.
• Stabilise CUI and FCI scope boundaries Document where CUI, SPD, and FCI reside, which systems support them, and which third parties or service accounts can reach them.
• Close the SSP and POA&M gap first Create or refresh the System Security Plan and Plan of Actions and Milestones so assessment evidence exists before the next procurement cycle.
• Automate evidence collection and drift checks Replace spreadsheet-based collection with continuous monitoring for controls, so changes in configuration or ownership are visible before assessment time.
• Prepare for assessor availability early If Level 2 third-party assessment may apply, book C3PAO capacity early and align the evidence package to the assessment timeline.

Key takeaways

• CMMC Phase 1 turns defence cybersecurity into an eligibility gate, so readiness now has direct commercial consequences.
• The article’s core evidence points to a large readiness gap across the DIB, with very few organisations fully certified or fully prepared.
• The organisations most likely to keep contracts are the ones that can keep scope, evidence, and assessment artefacts continuously current.

Key terms

• System Security Plan: A System Security Plan describes how an organisation implements required security controls across its environment. For CMMC readiness, the SSP must match reality, including architecture, ownership, and operational detail, or assessors will treat it as unreliable evidence rather than a trustworthy control narrative.
• Plan of Action and Milestones: A Plan of Action and Milestones is a structured remediation record that shows what gaps exist, who owns them, when they will be closed, and how completion will be verified. In compliance work, it turns unresolved weaknesses into tracked obligations rather than informal intentions.
• Controlled Unclassified Information: Controlled Unclassified Information, or CUI, is sensitive federal information that must be protected according to defined handling rules outside federal systems. For practitioners, the key issue is not only storage security but also proving that every system, identity, and data path in scope preserves those rules.
• Assessment scope: Assessment scope is the set of systems, identities, and processes that auditors or assessors must review to determine compliance. In CUI programmes, scope expands whenever data flows through a new service, account, device, or vendor that can touch the protected environment.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It gives security and identity teams a shared language for governing identity-driven controls across complex programmes.