The Cybersecurity Maturity Model Certification (CMMC) was designed to solve a specific problem: the US defense supply chain was leaking controlled unclassified information (CUI), and the breach paths almost always ran through third-party contractors and subcontractors. CMMC’s answer was to make cybersecurity certification mandatory — and to push that requirement down the entire supply chain, not just to prime contractors.

If you’re a defense contractor or a subcontractor in the DIB (Defense Industrial Base), CMMC compliance is not optional. But what does it mean for how you manage your own vendors? Here’s what the framework requires and how organisations are automating the hardest parts.

CMMC 2.0: The Current Framework

CMMC 2.0, finalized in late 2024, streamlined the original five-level structure into three levels:

• Level 1 (Foundational): 17 practices covering basic cyber hygiene — access control, identification and authentication, media protection, and system integrity. Annual self-assessment.
• Level 2 (Advanced): 110 practices aligned to NIST SP 800-171. Required for any contract involving CUI. Third-party assessment by a C3PAO (Certified Third-Party Assessment Organization) required for most contracts.
• Level 3 (Expert): 110+ practices aligned to NIST SP 800-172 for the most sensitive programs. Government-led assessments.

The key point: CMMC requirements are flow-down obligations. Prime contractors must ensure their subcontractors meet the required level. This creates a supply chain compliance challenge that can’t be managed with spreadsheets and annual emails.

What CMMC Actually Requires for Vendor Management

Under CMMC, your vendor compliance obligations extend in two directions. First, you must be able to demonstrate your own controls to your customer (the DoD or prime contractor). Second, you must ensure that any vendor you share CUI with meets equivalent requirements.

This means your vendor risk program needs to:

• Identify which vendors handle or have access to CUI
• Assess each vendor’s CMMC compliance level
• Include CMMC requirements in vendor contracts (flow-down clauses)
• Monitor vendor compliance on an ongoing basis — not just at contract signing
• Maintain documentation of vendor assessments for audit purposes

The documentation requirement is where most organisations stumble. An assessor asking for evidence of supplier compliance needs more than “we sent them an email asking about their security.” You need assessment records, response documentation, and evidence of remediation follow-through.

The Supply Chain Assessment Problem

Manually assessing every sub-vendor against 110 NIST 800-171 controls is not feasible at scale. A Level 2 assessment covers access control, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity — across every supplier with CUI access.

For organisations with dozens of subcontractors, the manual assessment burden alone can consume entire compliance teams. The solution isn’t hiring more assessors — it’s automating the collection, analysis, and monitoring of vendor control evidence.

How Automated CMMC Vendor Assessment Works

Modern vendor risk management platforms replace the questionnaire-and-spreadsheet model with automated evidence collection and continuous monitoring. For CMMC specifically, this means:

• Sending structured CMMC-aligned assessments to vendors (mapped to specific control families)
• Automatically analysing vendor responses against required control baselines
• Tracking remediation of identified gaps with timestamped evidence
• Maintaining a continuous audit trail of vendor compliance status
• Flagging changes in vendor posture that could affect your own compliance standing

Findings maps all of this against the CMMC control framework automatically — so your team knows which vendors are compliant, which have gaps, and which are at risk of dragging your own certification down.

What to Do Before Your Next Assessment:

1. Map all vendors who handle CUI — this is your assessment scope
2. Tier them by risk: who has persistent access vs. occasional access?
3. Send CMMC-aligned assessments to all Tier 1 CUI vendors
4. Review and update vendor contracts to include CMMC flow-down requirements
5. Implement continuous monitoring — not just pre-assessment point-in-time checks

Need the full CMMC compliance playbook?

Our CMMC guide covers all three certification levels in detail, the supply chain flow-down requirements, an assessment checklist for each control family, and how to build an audit-ready vendor compliance program. Download it free. →