Decoding DoD cybersecurity: CMMC, DFARS, and FedRAMP Equivalence demystified

If you’re part of the defense industrial base (DIB), you already know the ground has shifted. The Cybersecurity Maturity Model Certification (CMMC) 2.0 became effective on December 16, 2024, and its acquisition requirements started appearing in Department of War (DoW) (renamed from the Department of Defense) contracts on November 10, 2025. The long-term direction is clear: independent verification of cybersecurity compliance rather than unverified claims. As of July 2026, that transition is partly on hold. The department suspended CMMC Phase II pending a program review. But self-assessment is no free pass, because every affirmation a contractor submits is a formal attestation the government can act on.

But CMMC doesn’t stand alone. It’s one layer of a connected framework that includes Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 (which has been mandatory since 2017), National Institute of Standards and Technology (NIST) SP 800-171, and Federal Risk and Authorization Management Program (FedRAMP) Equivalence requirements for cloud service providers (CSPs). Each serves a different purpose. Each imposes distinct obligations. And misunderstanding how they relate to one another is a frequent and costly mistake organizations make.

This blog post provides clarity on the requirements. Whether you’re a prime contractor, a subcontractor deep in the supply chain, a managed service provider (MSP) supporting DIB clients, or a CSP hosting defense workloads, this post explains what’s required, who’s responsible, and how to build a compliance strategy that holds up under scrutiny. Because nearly every one of these pathways ultimately runs on cloud infrastructure, we also highlight where Amazon Web Services (AWS) and AWS GovCloud (US) fit. The foundation you build on shapes how achievable compliance becomes.

Summary

CMMC Phase II was suspended (July 2026):

• What happened –On July 13, 2026, the DoW suspended CMMC Phase II. This was the step that would have required third-party Level 2 and DIBCAC Level 3 assessments in new solicitations beginning November 10, 2026. The Department is conducting a 60-day program review and will issue further guidance upon completion.
• What isn’t changing –NIST SP 800-171 Revision 2 remains the baseline, and CMMC Level 1 and Level 2 self-assessment requirements stay in place alongside select government-led assessments. DFARS 252.204-7012, including its 72-hour incident-reporting and FedRAMP Equivalence obligations discussed below, remains fully in effect.
• What organizations should keep doing –Implement all 110 NIST SP 800-171 controls and keep your SPRS score accurate. A self-assessment is a formal attestation; affirming compliance you haven’t achieved carries False Claims Act exposure. Phase II is widely expected to return in some form, so organizations that stay ready now avoid a scramble later.
• Key insight – DFARS 7012, CMMC 2.0, and FedRAMP Equivalence are complementary frameworks, not alternatives. Understanding how they interact is essential for full compliance.

DFARS 252.204-7012: The foundation many overlook

Before CMMC, DFARS 252.204-7012 established the baseline. Effective since December 31, 2017, it applies to virtually all DoW acquisitions except contracts solely for commercial off-the-shelf (COTS) items. If your organization handles covered defense information (CDI) under a DoW contract, you’ve been legally required to implement the 110 security controls in NIST SP 800-171 Revision 2 for years.

A note on terminology

CDI and Controlled Unclassified Information (CUI) are related but distinct categories. CDI is defined by DFARS 7012 and includes CUI that is provided to or generated by a contractor in the performance of a DoW contract. CUI is the broader category established by Executive Order 13556 and governed by 32 Code of Federal Regulations (CFR) Part 2002. In practice, most CDI is CUI, and the NIST SP 800-171 controls required by DFARS 7012 are the same controls CMMC uses to protect CUI.

Throughout this post, we use the term that matches each framework’s language: CDI when discussing DFARS 7012 obligations and CUI when discussing CMMC requirements.

Pursuant to DFARS 252.204–7012, the contractor shall report cyber incidents to the DoD Cyber Crime Center (DC3) within 72 hours of discovery, preserving forensic images and cooperating with damage assessments. These aren’t aspirational goals; they’re contractual obligations with real enforcement consequences.

“We consistently find that organizations treat DFARS 7012 as a historical footnote now that CMMC is here. That’s a mistake. DFARS 7012 remains the foundational contractual requirement. CMMC adds a verification mechanism on top of it, but it does not replace it. The incident reporting obligations, the 72-hour timeline, the forensic cooperation requirements: those all still live in DFARS 7012.” — Tim Sandage, Chief Growth Officer, SecureIT

What many organizations miss

DFARS 7012 also established the cloud security standard that now causes widespread confusion across the DIB. The clause requires that any external CSP storing, processing, or transmitting CDI must meet security requirements “equivalent” to the FedRAMP Moderate baseline. What “equivalent” means wasn’t clarified until the DoW’s December 2023 memorandum, and the answer prompted many CSPs to reassess their compliance strategies.

The clause also distinguishes between two system types. Type 1 systems are IT services operated on behalf of the government, subject to the DISA Cloud Computing Security Requirements Guide (CC SRG). Type 2 systems are contractor information systems not operated on behalf of the government and are subject to NIST SP 800-171 requirements. This distinction matters because it determines your compliance pathway.

Critically, prime contractors must flow DFARS 7012 requirements down to all subcontractors that will process, store, or transmit CUI. These compliance obligations flow down through the entire supply chain, a reality that CMMC is now enforcing through independent third-party assessment.

CMMC 2.0 now requires verification

The main change CMMC introduces isn’t new security requirements. At Level 2, the controls are the same 110 from NIST SP 800-171 that DFARS 7012 has required since 2017. The shift is verification. Organizations can no longer merely assert compliance; they must demonstrate it through structured assessments and, for most CUI-handling contractors, independent third-party certification. The Department suspended this requirement in July 2026, leaving self-assessment as the near-term mechanism.

The three-level framework

CMMC 2.0 organizes requirements into three levels, each with distinct scopes and assessment methods:

1. Level 1: Foundational – Level 1 applies to contractors handling only federal contract information (FCI). It requires implementation of 15 basic safeguarding practices from FAR 52.204-21, validated through an annual self-assessment with affirmation submitted to the Supplier Performance Risk System (SPRS). Plans of Action and Milestones (POA&Ms) aren’t permitted at Level 1. Every requirement must be fully met.
2. Level 2: Advanced – This is the critical compliance level for most of the DIB. Level 2 applies to contractors handling CUI and requires all 110 NIST SP 800-171 Revision 2 controls. Organizations can complete a self-assessment (Level 2 Self) or undergo a third-party assessment by a Level 2 Certified Third-Party Assessment Organization (C3PAO) . C3PAO certifications are valid for 3 years with annual affirmation required. Approximately 182,000 entities, roughly 35 percent of DIB contractors, fall into the prioritized acquisitions category requiring C3PAO certification.
3. Level 3: Expert – Reserved for contractors supporting the most critical DoW programs, Level 3 requires all Level 2 controls plus 24 additional controls from NIST SP 800-172. DIBCAC leads the government assessment, and organizations must first achieve Level 2 C3PAO certification. Approximately 1,500 companies fall into this tier.

The POA&M reality check

CMMC 2.0 allows limited use of POA&Ms for Level 2 and Level 3, but the constraints are strict. Contractors can achieve a conditional CMMC status only if they score at least 80 percent and fully implement all designated critical requirements. Every noncompliant item must be remediated within 180 days. If you don’t achieve final CMMC status within that window, your conditional status expires and you lose contract eligibility. This is a firm deadline, making early preparation critical.

Implementation timeline

The following table summarizes CMMC’s phased rollout schedule. Organizations should use this timeline to prioritize assessment readiness and remediation planning. On July 13, 2026, the Department suspended the Phase 2 transition; the dates in the table reflect the original schedule and are subject to change pending the current review.

FedRAMP Equivalence: The cloud security standard that set a higher bar

The December 21, 2023, DoW memorandum clarifying FedRAMP Moderate Equivalence was a turning point for CSPs and the contractors who depend on them. The memo established that “equivalent” means 100 percent compliance with the FedRAMP Moderate baseline, all 323 controls based on NIST SP 800-53, with no gaps and no POA&Ms except for operational items.

In practice, this can be more stringent than full FedRAMP authorization. With a full FedRAMP Authority to Operate (ATO), a government Authorizing Official can accept residual risk and approve systems with open POA&Ms. With equivalency, no government official accepts risk, which is why zero findings are required. CSPs on the equivalency path should seriously weigh whether full FedRAMP authorization is the more achievable route.

Why SaaS solutions typically require FedRAMP authorization or equivalence

This is a commonly misunderstood requirement that often surprises organizations: virtually every software as a service (SaaS) application used to store, process, or transmit CUI in a defense contractor’s environment must be FedRAMP Moderate authorized or equivalent. This isn’t optional guidance; it’s a direct regulatory mandate with roots in two converging requirements.

The first mandate comes from DFARS 252.204-7012 itself. Paragraph (b)(2)(ii)(D) is explicit: “If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.” SaaS solutions are, by definition, external cloud services. When a contractor uses a SaaS platform to collaborate on CUI, whether that’s email, file sharing, project management, engineering tools, or any other application, that SaaS provider is an external CSP subject to FedRAMP requirements.

The second mandate flows from CMMC scoping. The 32 CFR Part 170 final rule and the DoW’s Technical Application of CMMC Requirements guidance confirm that cloud service providers storing, processing, or transmitting CUI within their cloud environment must meet FedRAMP Moderate or equivalent standards. During a CMMC assessment, C3PAOs will examine every CSP in your assessment boundary. If a SaaS provider in your CUI environment can’t demonstrate FedRAMP authorization or equivalence with a complete Body of Evidence, that’s a finding and potentially a failed assessment.

In the regulatory chain, CUI requires, at minimum, FedRAMP Moderate confidentiality protection per FIPS 199 and 32 CFR Part 2002. NIST SP 800-171 protects CUI in nonfederal systems. But when CUI moves to an external cloud service, DFARS 7012 requires FedRAMP Moderate authorization or equivalence, elevating the standard to the full NIST SP 800-53 Moderate baseline of 323 controls.

The commercial SaaS trap

A common compliance failure happens when organizations using standard commercial SaaS platforms (such as email, file sharing, and collaboration tools) to handle CUI without realizing those platforms aren’t FedRAMP authorized. Commercial versions of popular productivity and collaboration tools typically lack FedRAMP authorization, US data residency guarantees, US-person access controls, and the DoW SRG Impact Level authorizations defense information requires. Using these platforms for CUI is a compliance violation, regardless of any additional security layers added on top.

This requirement extends to every SaaS application in your CUI boundary: project management platforms, engineering collaboration tools, customer relationship management (CRM) systems, human resources (HR) platforms storing personnel security information, and ticketing systems processing technical data. If CUI flows through it and it’s a cloud service, FedRAMP authorization or equivalence is required. DIB contractors should audit every SaaS application in their CUI boundary and verify its status on the FedRAMP Marketplace. Vendor claims of “NIST 800-171 compliant” or “government-grade security” are insufficient; what matters is FedRAMP Moderate authorization or a complete Body of Evidence demonstrating equivalence as assessed by a FedRAMP-recognized 3PAO.

AWS GovCloud (US) provides FedRAMP High authorized infrastructure built for these sensitive workloads. SaaS providers building on AWS GovCloud (US) inherit significant security controls from the infrastructure layer, though they must still independently demonstrate compliance at their own service layer. For DIB contractors, choosing SaaS solutions hosted on FedRAMP-authorized infrastructure such as AWS GovCloud (US) is a foundational step, but verifying authorization at every layer of the stack remains the contractor’s job.

“I’ve seen this catch even well-prepared organizations off guard. They invest months preparing for CMMC, implement all 110 NIST 800-171 controls on their internal systems, and then discover during assessment that their project management tool, their file sharing platform, or their email system isn’t FedRAMP authorized. Every SaaS application in your CUI boundary is a potential point of failure. The time to audit your SaaS stack is before your C3PAO shows up, not when they ask for your cloud service provider’s Body of Evidence.” — Tim Sandage, Chief Growth Officer, SecureIT

Contractor accountability

A key part of FedRAMP Equivalence is the liability model. Defense contractors bear responsibility for validating their CSPs’ compliance. They must endorse the use of the cloud service offering, confirm the CSP has an incident response plan, verify the CSP follows that plan, and report any compromise. The contractor, not the CSP, is held accountable for reporting and compliance failures.

This gives organizations a strong reason to work with CSPs that hold full FedRAMP authorization, where compliance has been independently validated and is publicly verifiable on the FedRAMP Marketplace.

“The shared responsibility model in cloud computing has always been central to how AWS approaches security. What the FedRAMP Equivalence memo did is make that shared responsibility explicit in the defense context. Contractors need to understand exactly where their responsibility ends and where the CSP’s begins, and they need documentation to prove it. That’s why working with CSPs who maintain full FedRAMP authorization and provide comprehensive customer responsibility matrices is not just convenient; it is a risk management necessity.” — Aakash Tanwani, Worldwide Public Sector Solutions Architect, AWS

Conclusion

In this post, we laid out the foundational framework for defense compliance: the core regulations that govern how contractors and cloud providers protect federal data, the difference between Federal Contract Information and Controlled Unclassified Information, and the obligations that come with handling each, including cyber incident reporting, forensic preservation, and cooperation with damage assessments. We also showed where AWS GovCloud (US) fits, so you can see how much of each requirement you inherit from an already-authorized platform rather than build yourself.

In part two of this blog post series, we map out your specific compliance pathway based on your role in the defense supply chain, whether you’re a prime contractor, subcontractor, MSP, or CSP, and provide a step-by-step roadmap for building continuous assurance into your operations.

Explore AWS compliance resources for DFARS to understand how AWS GovCloud (US) supports your defense workloads. Visit the FedRAMP Marketplace to verify the authorization status of your CSPs. Review the CMMC Assessment Guide for detailed assessment objectives and evidence requirements. Read Decoding DoD cybersecurity: Compliance guide for DIB organizations for your compliance pathway and step-by-step roadmap.