CMMC scope confusion: what do contractors need to do now?

TL;DR: CMMC confusion persists because many organisations still do not know whether they fall into scope, especially MSPs and small or medium business clients working with defence customers or covered information, according to Todyl. The real issue is not the certificate itself but whether scoping, evidence, and assessor readiness are aligned before compliance becomes a contract requirement.

Editorial analysis by NHI Mgmt Group, based on content published by Todyl: “Understanding the CMMC Program”.

Key questions

Q: How should an organisation implement CMMC 2.0?

A: Implement CMMC 2.0 by first determining the level required for the work, then closing gaps against the required practices and documenting evidence for each control.

Q: Why do MSPs often find CMMC compliance harder to scope than direct contractors?

A: MSPs usually sit inside multiple customer environments, which means access paths, support tooling, and evidence records can span more than one boundary.

Q: What should teams do first when CMMC requirements are unclear?

A: They should run a structured scope review before building controls or collecting evidence.

Practitioner guidance

• Define the CMMC compliance boundary first Document which customers, contracts, systems, and support workflows place the organisation in scope before assigning control work.
• Map managed-service access paths Inventory every administrative, support, and remote access path that could touch covered defence information or customer environments.
• Align evidence with assessed systems Make sure policies, screenshots, logs, and ownership records describe the same environment that will be reviewed by an assessor.

Bottom line: CMMC uncertainty is mainly a scoping problem, because organisations cannot comply reliably until they know whether defence contracts and covered information place them in scope.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →