Your shop's software is inside your CMMC boundary

Most of the defense industrial base is small companies: machine shops, fabricators, engineering firms. Most have no security staff, and now there's a certification standing between them and the work.

The part of CMMC that tends to sink in last, and costs the most, is that it covers more than policies and laptops. The software your shop runs on is part of the assessment too. So it's worth understanding how a system ends up in scope, and what you can do about it.

How a system ends up in scope

It comes down to Controlled Unclassified Information (CUI). As soon as a customer drawing, a traveler, a spec or a quote attachment that carries CUI lands in a system, that system is inside your assessment boundary, and somebody has to be able to explain it to an assessor.

Follow one drawing through a typical shop. It arrives by email. Someone saves it to the shared drive, attaches it to a job in the tracker and refers to it in the quoting spreadsheet, and a copy ends up on the shop-floor PC that runs the DNC software. That's five systems, and the assessment will ask about every one of them. Nobody chose that boundary. It grew that way on its own.

What an assessor wants to know about each system

An assessor isn't there to judge whether the software is any good. They want to know whether it can produce evidence. At Level 2, the assessment is measured against the 110 controls of NIST SP 800-171, and the questions that touch your day-to-day software are very concrete:

• Who can see this? Each person needs their own login, with access set by their role, rather than one shared login for the whole shop.
• Who changed what, and when? The system itself should keep that record, so nobody has to piece it together from memory.
• Where is the data stored? You need a specific answer, backed by the vendor's hosting arrangements.
• Who keeps it patched, and how do you know? "The IT guy handles it" doesn't count as evidence.

Software built for the average small business usually can't answer these, because its customers never needed it to. That leads to the most common finding of all.

The spreadsheet holding CUI

Travelers, drawings and job packets sit on a shared drive and get tracked in a spreadsheet, with no access control worth the name and no record of who opened what. It's the most common finding and the least comfortable one, because that spreadsheet didn't get there by accident. It's how the shop runs. You can't write a policy that gets around it. The fix is a system that does the same job with proper permissions, a saved history of every version, and a record of who did what and when.

Fewer systems, smaller boundary

While shops are busy buying tools, it's easy to miss that every system you add makes the boundary bigger, and every system you retire makes it smaller. A shop that quotes in one product, tracks jobs in another, schedules in a third and keeps files on a shared drive has four sets of assessment questions to answer, and a cheap tool rarely stays cheap once it's inside the boundary. Bring that work into one platform, built knowing it will be assessed, with access control and record-keeping designed in, and you have one system to explain instead of four.

What nobody can sell you

Walk away from anyone selling "CMMC certified software." There's no such thing. Organizations get certified, products don't, and a vendor who says otherwise either doesn't understand how CMMC works or is hoping you don't.

And so you know exactly where we stand: we're not a C3PAO, we don't certify anyone, and we don't sell compliance. We build operations software that can answer an assessor's questions, and we work alongside whoever is running your readiness, not instead of them.

Work in the right order with your consultant

If you have a readiness consultant, the order that works is for them to scope the boundary and run the gap assessment first. The software work then responds to whatever keeps coming up as a finding. Buying or building tools before the scoping is how shops end up paying to widen the boundary they were trying to shrink. The security questions worth asking any software vendor matter twice as much here, because your assessor will be asking them of you.

At the end of all this is your SPRS score, which is checked before a contract is awarded. It ranges from -203 to +110, and it's a self-attestation, with False Claims Act consequences if it's wrong. We've built a platform that calculates that score from the assessment itself, instead of someone typing it into a spreadsheet, and that work showed us how much of readiness comes down to keeping the right records. If your shop is heading into this, our page for defense suppliers covers what we build and what we deliberately don't claim, and the first conversation is free.