CMMC Doesn’t Have to Mean Securing Your Entire Company the Same Way

You just learned that a government customer or prime contractor expects your company to meet CMMC requirements. Does that mean every employee, smartphone, server, jobsite, and machine must become part of the same controlled environment?

Not necessarily. Start with the information and the contractual requirement—not a shopping list of security products.

The first question is: Where does Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) enter your business, and where does it go? Answering that question helps define a defensible assessment boundary without unnecessarily spreading protected information throughout the company.

This article uses two fictional, illustrative examples—not client case studies or approved architectures: a New Jersey electrical contractor and a 25–50 employee manufacturer.

Start with scope, not assumptions

Under 32 CFR § 170.19, the organization must specify its CMMC assessment scope before assessment. Level 1 generally includes information systems that process, store, or transmit FCI. Systems that do not are outside that scope, and the rule separately addresses specialized assets.

Level 2 is not simply a “does CUI touch it?” test. It distinguishes CUI assets, security protection assets, contractor risk managed assets, specialized assets, and out-of-scope assets. Security systems may belong in scope even when they do not themselves hold CUI. An out-of-scope determination requires more than saying a device is not normally used for defense work.

Your contracts, required assessment level, information flows, technical separation, external providers, and asset categories all matter. Explore our CMMC readiness and advisory services for help connecting those decisions.

Example 1: A New Jersey electrical contractor

Imagine an electrical contractor serving commercial, industrial, and government customers. It has an office, project managers, estimators, administrative staff, electricians, service vehicles, laptops, mobile devices, and Microsoft 365. Most employees install and maintain electrical systems; only some work with protected government information.

Management hears “CMMC” and worries that every technician and commercial job must be brought into one controlled environment. Before recommending technology, MeasureRISK starts with discovery:

• Which contracts contain the requirement, and what level and assessment type apply?
• Does the company receive or create FCI or CUI? Who identifies and receives it?
• Where is it stored, shared, printed, and transmitted?
• Do estimators, field technicians, or subcontractors need access?
• Does it reach personal email, unmanaged phones, tablets, or removable media?
• Which identity systems, security tools, and external providers support those workflows?

Define the government-project workflow

Suppose four project managers, two estimators, one operations executive, and eight field technicians need access. Those illustrative numbers do not define the scope by themselves. They help identify the business workflow to examine.

The controlled environment might include authorized users, managed laptops, approved field devices, identity and authentication services, approved Microsoft repositories, relevant networks, security tools, and supporting providers. Each must be evaluated under the applicable level’s rules.

Commercial-only technicians, marketing, payroll, and unrelated project systems may be candidates to remain outside the boundary—but only if their actual information flows, access, dependencies, and asset classification support that conclusion. A department label is not evidence of separation.

Make the approved field workflow usable

A technician at a government jobsite needs a controlled project document. Rather than emailing it to a personal account or saving it on an unmanaged device, design an approved path:

Approved repository → authorized employee → approved device and access controls → authorized jobsite use.

Review downloads, offline access, printing, screenshots, sharing, and subcontractor handoffs. The aim is to keep protected information from spreading into systems that do not need it while allowing technicians to do their jobs.

Example 2: A 25–50 employee manufacturer

Now consider a precision manufacturer supplying commercial customers and defense primes. Its environment includes Microsoft 365, engineering workstations, CAD drawings, ERP software, quality systems, CNC equipment, inspection machines, shop-floor computers, and vendor remote access.

Management asks: “Does every CNC machine now have to be treated like a CMMC workstation?” The answer starts with discovery—not a blanket yes or no.

Follow the information through production

Defense customer → contract information → project management → engineering drawings → manufacturing instructions → inspection and quality records.

At each step, ask whether FCI or CUI is processed, stored, or transmitted; which people need access; what data leaves the system; and whether the system provides security protection to the controlled environment.

Engineering workstations, drawing repositories, quality systems, relevant network infrastructure, identity services, security monitoring, and external providers may all matter. Do not assume that a derived production file or inspection record is outside the requirement simply because its format changed.

CNC, operational technology, and specialized assets need individual review

A CNC controller is not necessarily equivalent to a standard Windows laptop. Older operational technology may not support modern endpoint tools, and installing them without validation can disrupt production.

The CMMC rule specifically addresses specialized assets, including IoT, IIoT, operational technology, government-furnished equipment, restricted information systems, and test equipment. Specialized assets are excluded from the Level 1 assessment scope under § 170.19; Level 2 has different documentation and risk-management treatment. This is not a blanket exemption from contractual safeguarding obligations.

Identify and categorize each asset, document its relationship to covered information, and design appropriate controls and separation. Never assume that all shop-floor systems are excluded—or that every machine must be secured identically.

Microsoft 365 can support the strategy—not certify it

Both businesses already use Microsoft technology. Depending on the approved architecture and licensing, a solution may involve Entra ID, multifactor authentication, Intune, Defender, managed Windows devices, SharePoint, Teams, Exchange, and security logging.

Purchasing Microsoft 365 does not establish CMMC compliance. Tenant selection, cloud-service requirements, contract clauses, data sensitivity, configuration, operational practices, and evidence all need review. Do not assume a commercial tenant—or any government-branded plan—is automatically appropriate for every CUI workload.

The practical question is: who can access protected information, on which device, through which system, and under what conditions? Our ManageIT managed security and IT operations can help implement and operate the agreed environment.

Meet today’s requirement while planning for tomorrow

Level 1 is based on the basic safeguarding requirements in FAR 52.204-21. Readiness work includes individual identities, access restrictions, malware protection, patching, boundary protection, physical access, approved information sharing, and media disposal. This is a planning summary, not the complete assessment checklist.

If future contracts will involve CUI, consider that roadmap now. Level 2 uses a more detailed scope and security requirements; whether a self-assessment or C3PAO certification assessment applies depends on the applicable requirement. Advisory support, penetration testing, or buying a security product does not replace the required assessment or guarantee certification.

How Proactive Risk helps build the program

1. Measure: MeasureRISK helps map information flows, identify assets and gaps, prioritize remediation, and organize evidence.
2. Manage: ManageIT supports identity, Microsoft 365 administration, endpoint operations, patching, security configuration, and monitoring within the agreed engagement.
3. Test: CATSCAN validates security through appropriately scoped testing. Identify, secure, test, remediate, and retest—without treating testing as a substitute for CMMC assessment.
4. Govern: CyberAdvisor / vCISO helps leadership assign owners, sequence investments, document decisions, and oversee readiness. Our CMMC advisory page explains the focused readiness offering.
5. Manage third-party risk: RISKWatch helps assess supplier and provider risk. Consider subcontractors, engineering partners, machine vendors, cloud services, and IT providers—not only your own employees. Use our third-party risk checklist to start the conversation.

Keep evidence current as access, suppliers, contracts, and systems change. A boundary that was accurate last year may not describe the way your business works today.

Start small. Scope smart. Build forward.

For the electrical contractor: identify the government-project workflow, authorize the right people, control devices and data, secure access, and document evidence.

For the manufacturer: follow FCI and CUI through engineering and production, categorize assets, define the boundary, secure it, test it, and document the result.

Don’t make your CMMC environment larger than necessary. Make it defensible. Scoping does not mean leaving the rest of the business unprotected. General business systems still need sound security even when they are legitimately outside a particular assessment boundary.

Authoritative references

• 32 CFR § 170.19 — CMMC scoping
• FAR 52.204-21 — Basic safeguarding of covered contractor information systems
• DoD CMMC documentation and scoping guides

This article provides general educational guidance, not a determination of your assessment scope or a certification guarantee. Confirm requirements against your contracts and the applicable CMMC rules and guidance.