What Is CMMC Compliance? What Defense Buyers Need to Know When Vetting Suppliers

If you’re sourcing components, services, or materials for defense programs, a supplier’s cybersecurity protocol is no longer a background detail. The Cybersecurity Maturity Model Certification (CMMC) is becoming a standard checkpoint in supplier qualification, and buyers who don’t account for it risk inheriting compliance gaps they didn’t create.

Here’s what CMMC is, why it matters when you’re choosing suppliers, and how to evaluate a supplier’s readiness before you sign a contract.

What is CMMC?

Cybersecurity Maturity Model Certification (CMMC) is a Department of Defense framework that requires defense contractors to demonstrate specific cybersecurity standards before they’re allowed to handle Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) across the defense industrial base (DIB). The CMMC accreditation body, Cyber-AB, was created to close a long-standing gap in the defense supply chain: contractors and subcontractors routinely handle sensitive program data, but historically had no consistent way to prove their systems were secure enough to protect it.

For a prime contractor, this matters directly. If a supplier in your chain mishandles CUI or can’t demonstrate adequate cybersecurity controls, that exposure doesn’t stay contained to them. It can affect your own contract compliance, your audit trail, and your standing with the DoD.

Obtaining this certification requires significant resources, a full commitment from the supplier’s team, and extended time to achieve full compliance — most organizations report 12 to 24 months from start to finish. It’s estimated 80,000-300,000 suppliers will need to obtain CMMC certification, but, to date, less than 3% of companies have achieved full Level 2 certification. Firstar is proud to be one of them.

The CMMC Levels: What to Look For in a Supplier

CMMC is structured in tiers, with the requirements scaling based on the sensitivity of the information a government contractor will handle.

The level most relevant to your sourcing decisions is Level 2. It’s the most common requirement for Tier 1 and Tier 2 defense suppliers, and it requires full implementation of all 110 security practices outlined in the National Institute of Standards and Technology’s special publications (NIST SP 800-171), plus an audit by a Third Party Assessment Organization (C3PAO).

Each CMMC control has various point values assigned through the qualification process. Critical controls such as multi-factor authentication are worth 5 points, moderate controls are worth 3 points, and low-impact controls are worth 1 point. To self-certify for CMMC Level 1, all 58 controls worth 5 and 3 points must be met. Consider these the table stakes for beginning the CMMC certification process.

To qualify for conditional certification at CMMC Level 2, a supplier must also meet at least 22 of the 1 point controls. If any of these are not met, the audit will be considered failed. The failure rate at this stage is estimated to be 80%.

If a supplier will be touching CUI on your program, Level 2 is generally the baseline you should expect.

When a supplier tells you they’re “CMMC compliant,” that claim is only useful once you know which level they’re referring to and whether it matches what your contract actually requires. A supplier certified for a lower tier than your program needs isn’t a qualified supplier yet, regardless of how the conversation is framed.

Why This Matters Now for Your Sourcing Decisions

Starting in 2025, CMMC compliance is increasingly being written directly into defense contracts as a flow-down requirement. That means the obligation doesn’t stop at the prime level. It passes down through the supply chain, and primes are responsible for ensuring their suppliers meet it.

This creates two risks worth weighing during supplier selection:

First, a supplier without a CMMC pathway may not be eligible to handle CUI on your program at all, which can stall delivery or force a late-stage resourcing scramble.

Second, awarding work to a supplier with no credible compliance plan can put your own bid eligibility at risk, since flow-down requirements mean your compliance posture is partly a reflection of theirs.

In practice, this means CMMC status should be part of how you qualify suppliers, not something you check after the relationship is already underway.

Conditional vs. Full Certification: What’s the Difference for You?

Not every supplier will show up to a conversation with full Level 2 certification in hand, and that’s not automatically disqualifying. Many capable suppliers are mid-process, holding a status known as conditional compliance.

Conditional compliance generally means a supplier has documented its security practices and has a plan of action to close any remaining gaps, but hasn’t yet completed a full assessment through a C3PAO. It’s a legitimate stage in the certification process, but it comes with limits. A conditional status with a vague or stalled timeline is a very different risk assessment than one with a clear, credible path to full certification.

When you encounter a supplier with conditional certification, the right move isn’t to default to “yes” or “no.” It’s to ask for specifics.

How to Evaluate a Supplier’s CMMC Readiness

Before finalizing a sourcing decision, especially for a supplier who will handle CUI, it’s worth building a short list of questions into your vetting process:

• What CMMC level are they pursuing, and does it match your program’s requirements? A supplier targeting CMMC Level 1 isn’t a fit for Level 2 work, no matter how strong their general security practices are.
• Can they produce a System Security Plan (SSP)? This document show whether a supplier has actually mapped their environment against the required practices, or whether they’re speaking in generalities.
• Where do they stand in the assessment process? Self-assessment, conditionally compliant pending assessment, or fully certified are three different risk levels, and your contract may dictate which ones are acceptable.
• What’s their realistic timeline to full certification, and is it documented? A specific date tied to a scheduled assessment is a stronger signal than an open-ended “we’re working on it.”

A few patterns are worth treating as caution flags: vague answers about which level applies to them, no documentation to support claimed status, or certification timelines that have already slipped without explanation. On the other side, suppliers who can speak specifically to their NIST SP 800-171 implementation, produce real documentation, and give you a credible date are generally lower-risk partners, even if they haven’t crossed the finish line yet.

The goal isn’t to eliminate every supplier who isn’t fully certified. Conditional compliance with a credible plan can be a reasonable basis for moving forward, particularly if your contract timeline allows for it. The goal is to make that judgment with full information rather than after a problem surfaces.

What’s the Difference Between ITAR and CMMC?

CMMC and ITAR are both compliance frameworks that come up in defense contracting, but they govern different things.

ITAR (International Traffic in Arms Regulations) controls the export and transfer of defense-related articles, services, and technical data. It’s administered by the State Department and focuses primarily on what information can be shared and with whom, particularly restricting access to foreign nationals and entities.

CMMC is focused on how that information is protected once it’s in your systems. It’s a cybersecurity framework, not an export control. Where ITAR governs disclosure and transfer, CMMC governs storage, handling, and access controls for Controlled Unclassified Information.

In practice, a supplier can be ITAR-registered and still have significant CMMC gaps because registration under one framework doesn’t satisfy the other. For defense primes vetting suppliers, both should be evaluated independently. ITAR compliance tells you a supplier understands the boundaries around sensitive data; CMMC compliance tells you they have the systems to protect it.

Building CMMC Checks Into Supplier Qualification

CMMC vetting works best when it’s a standard step in your supplier qualification process, not a one-off question raised when a deal is already moving. That might mean adding CMMC-specific questions to your RFP or vendor questionnaire, requesting documentation upfront rather than taking verbal assurances, and revisiting supplier status periodically rather than treating it as a one-time check.

As flow-down requirements become more common across defense contracts, the suppliers who can clearly demonstrate where they stand, and back it up with documentation, will be easier to work with and lower-risk to bring into your programs.

CMMC compliance isn’t just a certification a supplier either has or doesn’t. It’s a window into how seriously they take the security obligations that come with handling defense-related information. Building that evaluation into how you choose suppliers protects your own contract eligibility and strengthens the integrity of your supply chain.

If you need a CMMC Level 2 supplier for precision components, contact Firstar to talk about your project needs. We’re happy to answer any and all questions about our certifications to help you make your sourcing decision.