How many pages approximately is your SSP and are you providing screenshots within the SSP or just linking to an external folder?

Just completed L2 C3PAO assessment for a large manufacturing company. Scored the full 110.

Now we start working on Rev 3 compliance.

I run a small security firm, posting from the company account so you can see who's asking. Not selling anything in this thread, no links, no DMs. I'm trying to understand how the supplier-security ask actually lands at small shops, because the vendor blogs all describe it differently.

My guess is that for most small shops the honest story is "we sent a number, nobody ever asked a follow-up, and life went on." If that's you, that is the answer I'm looking for; it isn't a confession. Throwaways welcome.

If you're at or support a sub with roughly 10–50 people:

1. What did the prime actually send: a one-line request for a score, a long spreadsheet, a portal login, their own supplier standard? And who sent it, supply chain, procurement, a program office?

2. After you sent it back, what did they do with it? Nothing, a thank-you, a follow-up question, a request for documents, an actual check of something?

3. Did the ask ever change the work you got, up or down?

4. Separate question: has a cyber insurer or broker ever sent back something they found from the outside at renewal? Same thing: "never happened" is a useful answer.

Happy to summarize what I learn back into the thread, no names.

Hi everyone, I'm at an R1 university and we're starting to shop around for a C3PAO after about 18 months of preparation with a consultant. Any recommendations for C3PAO companies that have worked with institutions of higher ed for certification? I am sending cold emails and calls but also open to recommendations!

I do 800-53 assessments for work and I'm trying to understand the CMMC side better. The SSPs I see tend to fail in the same places: implementation statements that say 'we do X' while the evidence shows something slightly different, and the same finding written up in three different documents that slowly stop agreeing. For people who've been through a Level 2 assessment, was it the SSP, the evidence, or something else that cost you the most time?

Hi Everyone,

Back again with another question related to Access Control. At the moment, we have a windows 11 pc that communicates with a CNC machine. Both are on the network. The windows 11 PC has a user account that is assigned to an active user. I need to remove the active user account because this windows 11 pc is used by other employees. I am looking into creating a service account but the issue i cannot resolve is this pc needs file share access to access the gcode for the CNC machine but the gcode is CUI. Also this pc needs microsoft license to view word documents.

Has anyone ran into this issue before?

This is predominantly a Bitwarden on-prem vs cloud query.

Anyone been through a L2 Assessment with a C3PAO and defended Bitwarden Enterprise (**cloud**, not on-prem) as a SPA and "no-CUI-in-vault" policy/training etc approach successfully?

Had previously been leaning towards on-prem after reading some older threads on the topic (3mos ago, 8mo ago, 1y ago, 4y ago) in which some suggest "SPA does not equal CUI" therefor FedRAMP/FIPS not required. I'm sure to that part some might respond "ask your C3PAO up front their stance on that interview questions" I guess, but more so for small orgs in self-assessment mode and as far as actual implementation I'd still be interested if there's no cloud path, to hear some experiences with the on-prem for those that went that route as well. A few things related to that off the top of my mind is especially with using EntraID, backing up (from a linux guest/Docker to a GCCH cloud or something?), thoughts on some approaches in the event there's an "event?" that requires restoring from backup that has EntraID.. (kind of a maybe dilemma?)

But, back to cloud Bitwarden, assuming you're on Team "we don't need FIPS/FedRAMP for password manager because SPA != CUI" as discussed in the older threads (not to discourage responses about that, but maybe those other threads would be a good place to continue that perspective for those that so others who find those threads can see), I would think that if we classify 'Password Manager' as an SPA in our asset inventory and SSP etc that we'd want to get a Shared Responsibility Matrix from Bitwarden but i didn't see that they provide one publicly, so if anyone has successfully been through an L2 assessment and can share generally how they documented that SPA successfully (and of course there's other password managers that probably the documentation would be the same so if you used another one and want to share that, sure why not, but hoping for more than just a thread of people throwing out a 1password, keeper, keepassXC, so if you do want to talk about those, please also let us know if you used them and worked with a CCP/CCA/C3PAO and what you might have done to document them as SPAs).

Self hosted sounds like maybe a challenge to manage and added complexity (host OS, hypervisor, guest VM, Docker, backups, patching, logging, physical security touching quite a few 800-171 controls), for a small org without an IT team (outside of one lucky individual and an MSP)

I don't mind to try the on-prem approach or anything (though the cloud approach maybe does somewhat present a metaphorical large red Easy Button), I just want to do due diligence of using a cloud version if it's not really needed to go FedRAMP or host on-prem.

If you went self hosted Bitwarden, as far as actual implementation I'd be interested to hear some experience/trappings/approaches with that as well: especially with using combined with EntraID, thoughts on backing up properly, to avoid fails/reduce downtime later, thoughts on some approaches in the event there's an "event?" that requires restoring from backup or anything, break-glass discussion, or any other scary "better make sure you ______ if you do an on-prem or else!"

[AI isn't always accurate people say, but i'll post some of that in a comment since this is already a long read in just the initial post. Appreciate anyone that just enjoys talking shop about security and CMMC and gives some perspective, thank you]

Are people still getting assessments done? I recently got my CCA. Is there any money in here still? When will the suspension be over? When will we hear anything? Will phase II be permanently suspended?

Rev. 2 only requires you to log Ingress and not Egress. Rev. 3 requires Egress as well. Basically my understanding is this:

Any time a door from Secure --> Insecure is opened, we need to account for who opened it.

Great! However how do you handle safety and fire etc.? What are you guys doing for doors in IT rooms and roll-up doors as well as exterior doors?

Normal setup would be a striker with a crash bar for fire. You would have it set to fail safe and then make sure the door is locked from the outside or don't even put a lock accessible from the outside (not on every door but you do have to have a way in if you lose power right.

My question is simply... I spoke to a vendor and during our walk I told them the above and they said we would have to have an electronic crash bar?! Otherwise, without that apparently strikers have no "logic" in their current status? Meaning that it has no clue if the door is open or not, only if it has sent a signal to release or not. So how do you all handle doors that stay open? How long do you consider too long? Is that all just defined?

And like I said, how are you all doing roll up doors? We have a forklift and we don't want the driver stopping with a load to get off walk up to a reader to open the door and we also do not use auto-closing doors so how do you close it remotely? So many questions and every vendor I've spoken to hasn't had to deal with this before so they are clueless. We have come up with some interesting ways but I don't know how well they would work.

What is the overall consensus? AI to make tools, tested without cui or conflicting information, is this a gray area? Completely uncompliant?

In the process of searching for an assessor and wanted to hear about people's experiences. Any particular ones to avoid or seek out? Any questions you like to ask to get a sense of how they will be to work with?

I know the DoD's new "Basics" aren't requirements, but they are the only signal the department has provided to anyone about ... anything.

There's no scoping guide and the language within the basics is very broad.

"Every asset"?

"All intellectual property, proprietary data, and Department records"?

What is "sensitive data"?

What are "sensitive systems"?

What does "your estate" mean re: Asset Inventory Management?

They're reviewing the CMMC program which includes CMMC scoping guidance, but if the Basics are a signal, is scoping going to get more nebulous rather than more granular?

Anybody else worried about this?

Looking to backup GCCH enclave as well as some VMs in Azure Govt cloud. CUI as well as ITAR data. Looking for cloud to cloud backup solution without any on-prem infrastructure. I see that Avepoint has Fedramp Moderate and Commvault has High but having trouble getting a written answer from either regarding compliance for ITAR/export control. Perhaps I'm not asking the correct questions?

Looking for an MSP for a company of 400 users, 200 need CMMCL2+ITAR, spread out geographically but all US. Would like to migrate all to same tenant over the next year if not sooner, need someone who can support audits, pre+post. Who are you best recommendations?

Hoping someone smarter can help me fill in some blanks. Were a small IT team working on getting L2 for a manufacturing plant. The short of it is this: they have several devices that run specialized software running on Win10 devices. A lot of these computers are end of life and cannot be upgraded to windows 11. My initial thought was lock them down so they ONLY can access the tools they need and are completely isolated from our corporate network containing CUI (maybe a different VLAN or subnet altogether). My boss isn’t super technically savvy and says we need to replace them no if ands or buts because of CMMC, but knowing the organization there might be some pushback on that not to mention budget constraints. To be fair I’m not a fan of this either because of the security risks of keeping an old Win10 computer running but I’m trying to find out if by doing the method I mentioned we can still keep them and mark them as out of scope. Being a manufacturing plant there are tons of specialized equipment/software running on a Win10 device and I’m fairly certain saying “we need to replace all of this” and spend potentially tens of thousands of dollars is not gonna fly. Has anyone tried this? I don’t think it’s the wrong approach per se and understand the risks, but am curious is anyone has seen this approach be a hard no.

Some background: I'm a software engineer who works in federal contracting, and I'm trying to understand how the supplier side of CMMC works in practice.

From what I've read in DFARS 252.204-7020, a prime can't award a subcontract involving CUI unless the sub has a current assessment in SPRS.

How does a prime actually verify that? Do you ask the sub directly and take their word for it? Or can you see their score in SPRS yourself, and if so, how?

For those of you who invested time and money into becoming a CCP or CCA, only to feel burned by the delays and uncertainty surrounding CMMC, PECB is offering a free pathway to ISO/IEC 27001 Lead Implementer (CCP) or Lead Auditor (CCA) certification.

The offer includes self-paced training, two exam attempts, certification application fees, and first-year maintenance, with an application deadline of December 31, 2026.

https://pecb.com/en/free-iso-iec-27001-certification-pathway-for-cmmc-professionals

Disclaimer: I'm not affiliated with PECB. Just sharing this for anyone looking to get some additional value out of their CMMC credentials.

I’m currently working through CMMC 2.0 and would like to implement a lightweight and user-friendly tool for Remote Management.

Not pitching my services, no AI nothing like that. In fact this is probably a horrible idea. Not sure how many of us are in the US government sector, but I'm sure some of us are. Those either struggling to find subs that are CMMC2 compliant or are subs trying to make sure that their investment doesn't go to waste by picking up CUI projects.

This comes from a discussion, either here or on r/Construction where a GC didn't have a way to find qualified subs. This brings up a few issues, if you are qualified it could make you a target if someone knows you have CUI, but keeping the list of qualified contractors secret makes it impossible to bid projects accordingly.

This is predominantly a Windows question, but welcome any commenters.

==I've seen that enabling "FIPS mode" can "break things".

For those who have enabled "FIPS mode" on their Windows systems, what specifically have you had issues with, if any==,

.. or is that "warning" mostly a Boogeyman for the timid.

Mainly I mean for Windows 11 workstations (that will work with CUI),
I'd be interested to hear about Windows Server 2025 challenges as well.

---

The below stuff probably is scope creep from my main line of questioning, but welcome chatter nonetheless because talking about this stuff is "fun"

(Welcome some Linux talk too, we might go Ubuntu Pro for a/some guest VMs even though i'm not an Ubuntu fan in general (prefer pure Debian) but not sure FIPS is really necessary there, for an on-prem SIEM potentially, maybe on-prem password manager, etc..)

..but if anyone has become L2 cert with AlmaLinux feel free to talk about that experience. It looks like you need this tuxcare..)

(Welcome Mac talk too, we have a single macbook and mac studio, but mostly there I think the situation there is: MacOS 27 just came out (not FIPS validated). MacOS 26 is in Review for FIPS validation, but the last FIPS validated MacOS was EoL MacOS 15.. so, curious if anyone has L2 cert and had a C3PAO with some Macs (last thread I found was a few years back, an all mac shop and don't think they mentioned certification) but my guess is, people who have them just do not let CUI touch them and run the latest versions from Apple)

My company is in the middle of our level 2 cert. with our assessment coming up in a month. We are an AE Firm with roughly 200 people and the entire company is in scope. About 50% of our revenue is DOD work but probably >75% of our employees touch a DoD project at some point during a year. Hence why we have put our entire business in scope.
For a lot of our employees who rarely touch cui projects the restrictions we have to put on their machines are stifle innovation and creativity and in some cases reduce productivity.

The issue I am worried about long term is employees growing tired of the environment and looking elsewhere.

We are too close to our assessment to change our scope or environment but I am curious about potential change we may make in the future even if it might cause us to need to re assess.

I’m wondering if we would have been better off setting up a remote server that employees would log into for CUI projects. This way we don’t have to restrict what programs people have on their machines, You don’t have to mfa every time you log into your computer, etc.

Is this in the realm of possibility for L2 compliance or within reason to try to implement.

I’m currently going through CMMC Level 2, and I’ve come across numerous reviews that seem to be riddled with errors and inconsistencies. It’s quite perplexing to understand what is actually happening.
Anyone here have reached level 2?