CMMC & ITAR FAQ – CMMC Guardian

Question 1

What is CMMC and who needs to comply?

Accepted Answer

The Cybersecurity Maturity Model Certification (CMMC) is a DoD framework that verifies defense contractors protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). Any organization in the Defense Industrial Base (DIB) that handles CUI or bids on DoD contracts must achieve the appropriate CMMC level before contract award.

Question 2

What are the three CMMC levels?

Accepted Answer

CMMC 2.0 has three levels. Level 1 (Foundational) covers 17 basic safeguarding practices for companies handling only FCI. Level 2 (Advanced) aligns with NIST SP 800-171's 110 practices for companies handling CUI. Level 3 (Expert) adds a subset of NIST SP 800-172 practices for companies supporting critical DoD programs.

Question 3

What is the difference between a self-assessment and a C3PAO assessment?

Accepted Answer

Level 1 and some Level 2 contracts allow annual self-assessments, where your organization evaluates its own compliance and submits results to the Supplier Performance Risk System (SPRS). Level 2 contracts involving prioritized acquisitions and all Level 3 contracts require a triennial assessment by a DoD-authorized Certified Third-Party Assessment Organization (C3PAO).

Question 4

What is a Plan of Action & Milestones (POA&M)?

Accepted Answer

A POA&M documents security deficiencies identified during an assessment and the planned remediation steps with target completion dates. Under CMMC 2.0, limited POA&Ms may be accepted at contract award for Level 2, but all items must be closed within 180 days. Level 1 does not allow POA&Ms at award.

Question 5

What is Controlled Unclassified Information (CUI)?

Accepted Answer

CUI is government-created or government-owned information that requires safeguarding per law, regulation, or government-wide policy, but is not classified. Examples include technical data, export-controlled information, privacy data, and law enforcement sensitive information. The National Archives CUI Registry defines all authorized categories.

Question 6

How long does CMMC certification remain valid?

Accepted Answer

C3PAO assessments for Level 2 and Level 3 are valid for three years, provided the organization maintains its security posture and conducts annual affirmations. Self-assessments must be renewed annually. Any significant change to your environment may require a new assessment before the three-year period expires.

Question 7

What is SPRS and why does my score matter?

Accepted Answer

The Supplier Performance Risk System (SPRS) is the DoD portal where contractors submit their NIST SP 800-171 self-assessment scores. Contracting officers review SPRS scores during source selection. A score ranges from -203 to +110; a higher score signals stronger cybersecurity posture. Submitting a false score can trigger False Claims Act liability.

Question 8

What is a System Security Plan (SSP)?

Accepted Answer

An SSP describes how your organization implements each of the 110 NIST SP 800-171 security requirements. It documents the system boundary, data flows, hardware, software, personnel, and the specific controls in place. The SSP is a required artifact for both self-assessments and C3PAO assessments and must be kept current.

Question 9

Can a small business achieve CMMC compliance?

Accepted Answer

Yes. CMMC 2.0 was designed with small businesses in mind. Level 1 requires only 17 practices and is achievable with basic IT hygiene. Level 2 is more demanding but manageable with proper planning, a scoped environment, and use of cloud services that carry FedRAMP authorization. CMMC Guardian specializes in right-sizing compliance programs for small and mid-size DIB companies.

Question 10

What is scoping and why does it matter for CMMC?

Accepted Answer

Scoping defines which assets, systems, and personnel are in scope for your CMMC assessment. A well-scoped environment limits the number of systems that must meet all 110 practices, reducing cost and complexity. Assets that store, process, or transmit CUI — and systems that provide security protection for those assets — are always in scope. Proper network segmentation is key to effective scoping.

Question 11

What is ITAR and who does it apply to?

Accepted Answer

The International Traffic in Arms Regulations (ITAR) controls the export and import of defense-related articles, services, and technical data listed on the United States Munitions List (USML). Any U.S. person or company that manufactures, exports, imports, or brokers USML items must register with the Directorate of Defense Trade Controls (DDTC) and comply with ITAR requirements.

Question 12

What is the United States Munitions List (USML)?

Accepted Answer

The USML is a list of 21 categories of defense articles, services, and technical data subject to ITAR controls. Categories range from firearms and ammunition (Category I) to military electronics (Category XI) to spacecraft and satellites (Category XV). If your product, component, or technical data falls under any USML category, ITAR applies.

Question 13

What is the difference between ITAR and EAR?

Accepted Answer

ITAR (administered by the State Department) controls items on the USML — primarily military and defense articles. The Export Administration Regulations (EAR), administered by the Commerce Department, controls dual-use items on the Commerce Control List (CCL) that have both commercial and military applications. Some items have been transitioned from USML to CCL through Export Control Reform. Determining which regime applies requires a commodity jurisdiction or classification review.

Question 14

What counts as an "export" under ITAR?

Accepted Answer

Under ITAR, an export includes not only physical shipment of hardware abroad but also electronic transmission of technical data to a foreign person, oral disclosure of technical data to a foreign national (even inside the U.S.), and allowing a foreign national to access ITAR-controlled systems or data. This broad definition means ITAR compliance is an internal HR and IT issue as much as a shipping issue.

Question 15

What is a Technology Control Plan (TCP)?

Accepted Answer

A TCP is an internal policy document that describes how your organization controls access to ITAR-controlled technical data and hardware. It identifies controlled items, defines who may access them, establishes physical and IT security measures, and outlines employee training requirements. Many DoD contracts and facility security agreements require a current, approved TCP.

Question 16

What are the penalties for ITAR violations?

Accepted Answer

ITAR violations can result in civil penalties up to $1,308,326 per violation, criminal penalties up to $1 million per violation and 20 years imprisonment, debarment from future government contracting, and reputational damage. The State Department's DDTC has broad enforcement authority. Voluntary self-disclosure of violations is strongly encouraged and typically results in reduced penalties.

Question 17

How does ITAR interact with CMMC?

Accepted Answer

ITAR technical data is a subset of CUI, so ITAR-controlled information stored or processed on your systems is automatically in scope for CMMC Level 2. Meeting CMMC Level 2 requirements helps protect ITAR data, but CMMC does not replace ITAR registration, licensing, or export authorization requirements. Both frameworks must be addressed independently and in parallel.

Question 18

What does a CMMC gap assessment involve?

Accepted Answer

A gap assessment compares your current security practices against the applicable CMMC level requirements. We review your existing policies, procedures, and technical controls; interview key personnel; and inspect system configurations. The output is a prioritized gap report showing which of the 110 NIST SP 800-171 practices are fully implemented, partially implemented, or not implemented — along with remediation guidance.

Question 19

How long does it take to achieve CMMC Level 2 compliance?

Accepted Answer

Timeline varies significantly based on your starting posture. Organizations with mature IT programs may reach readiness in 6–12 months. Those starting from scratch typically need 12–24 months. Key factors include the complexity of your environment, the number of CUI systems in scope, available budget, and internal resource capacity. Starting early — well before a contract requirement — is strongly advised.

Question 20

What should I do first to start my CMMC journey?

Accepted Answer

Begin with three foundational steps: (1) Identify all CUI your organization handles and where it lives — systems, email, file shares, cloud storage. (2) Define your assessment scope and segment CUI systems from the rest of your network where feasible. (3) Conduct a gap assessment against NIST SP 800-171 and document findings in an SSP and POA&M. These steps form the foundation for everything that follows.

Question 21

What is the role of a Registered Practitioner Organization (RPO)?

Accepted Answer

An RPO is a company registered with the CMMC Accreditation Body (Cyber AB) that provides CMMC consulting and preparation services. RPOs employ Registered Practitioners (RPs) and Certified Professionals (CPs) who help organizations understand requirements, conduct gap assessments, and prepare for formal C3PAO assessments. CMMC Guardian operates as an RPO, providing advisory services without conducting the formal certification assessment.

Question 22

Do subcontractors need CMMC certification?

Accepted Answer

Yes. CMMC requirements flow down through the supply chain. If a prime contractor handles CUI and passes any of that CUI to a subcontractor, the subcontractor must meet the same CMMC level as the prime for the CUI they handle. Prime contractors are responsible for verifying their subcontractors' compliance status before sharing CUI.

Question 23

What is the CMMC Accreditation Body (Cyber AB)?

Accepted Answer

The Cyber AB (formerly CMMC-AB) is the independent accreditation body authorized by the DoD to manage the CMMC ecosystem. It accredits C3PAOs, certifies assessors (CCA, CCP), and registers practitioners (RP, CP) and RPOs. The Cyber AB marketplace is the authoritative source for finding accredited assessment organizations.

Question 24

How does cloud usage affect CMMC compliance?

Accepted Answer

Cloud services that store, process, or transmit CUI must meet FedRAMP Moderate authorization or equivalent security requirements. Using a FedRAMP-authorized cloud service provider (CSP) can significantly reduce your compliance burden by inheriting many security controls. However, you remain responsible for configuring the service correctly and for controls the CSP does not cover (shared responsibility model).

CMMC & ITAR
Frequently Asked Questions

Still have questions?

CMMC & ITARFrequently Asked Questions

Still have questions?

CMMC & ITAR
Frequently Asked Questions