CMMC Scope Decisions Shape Cybersecurity Costs for Small Defense Suppliers

Small defense suppliers face an early CMMC decision that can influence both compliance workload and cybersecurity spending: defining which systems, people, and processes handle controlled unclassified information (CUI). An Aviation Week sponsored article from Exostar argues that costs begin not with selecting a product, but with establishing a clear system boundary. That boundary informs the system security plan and what assessors—or, where applicable, the supplier’s own assessment process—must examine. Exostar senior director Kevin Hancock said, “The essence of any CMMC program starts with building your system security plan, and that plan is based on the scope of the system the assessors will review.” He added that a larger scope increases complexity and the number of items subject to review.

The article’s central operational recommendation is to trace CUI throughout the organization before choosing a compliance model. Suppliers should identify where CUI enters, who can access it, how it moves between systems and organizations, and how it is ultimately destroyed. This is not only an IT inventory exercise: the article notes that human-resources processes such as employee screening and offboarding can matter, as can contractors, outside vendors, cloud services, and managed service providers (MSPs). Suppliers are advised to verify that cloud services appear in the FedRAMP Marketplace and to include an MSP in the scope analysis when it administers systems that touch CUI.

After mapping information flows, companies can compare enterprise-wide implementation with a smaller, segmented enclave. The article says the choice often depends on how much of a supplier’s business supports Department of Defense (DoD) contracts. A company whose operations are substantially devoted to government work may find enterprise-wide compliance appropriate. By contrast, a supplier with 20% or 40% of revenue tied to defense work may consider isolating CUI in a cloud environment, on the shop floor, or in a secure file room instead of remediating the entire business. A segmented approach can reduce the number of systems and users in scope, but only if the boundary is practical, documented, and consistently maintained.

The source also emphasizes that using a cloud provider or MSP does not transfer all cybersecurity obligations to that provider. It describes shared responsibility matrices as a way to document which controls a provider meets, which are shared, and which remain the supplier’s responsibility. The supplied article excerpt states that Exostar’s enclave meets 80% of NIST SP 800-171 requirements, but the excerpt ends mid-sentence and does not provide further detail on the remaining controls. Because the article is sponsored content and presents Exostar’s capabilities, procurement teams should distinguish general scoping guidance from vendor-specific claims and assess those claims against their own requirements and evidence.

The reported suspension of CMMC Phase 2 third-party assessment requirements changes the near-term assessment route, not the underlying need to protect CUI. Suppliers still need to meet applicable security obligations and complete relevant Level 1 and Level 2 self-assessments. For primes and procurement teams, a supplier’s documented scope can provide a clearer basis for evaluating readiness, understanding subcontractor information handling, and identifying gaps before award or performance. It is therefore useful to ask suppliers for a current CUI flow map, an explanation of their chosen operating model, and records supporting their scope and shared-responsibility decisions.

• Map CUI flows from receipt through access, transfer, storage, and destruction; include relevant HR processes, contractors, vendors, cloud services, and MSP administration.
• Define and document the system boundary because it drives the system security plan and the systems, users, and processes subject to applicable CMMC requirements.
• Compare enterprise-wide controls with a segmented enclave based on the share of business supporting DoD contracts and the operational feasibility of isolating CUI.
• The article gives examples of suppliers with 20% or 40% of revenue tied to defense work that may find a smaller enclave less costly than remediating the whole company; these are illustrative examples, not universal thresholds.
• For cloud and managed services, examine FedRAMP Marketplace status and obtain a shared responsibility matrix identifying provider, shared, and supplier-owned controls.
• The article states that Exostar’s enclave meets 80% of NIST SP 800-171 requirements; the provided excerpt does not explain the remaining controls, so buyers should seek supporting detail.
• The reported pause in CMMC Phase 2 third-party assessment requirements affects the near-term assessment approach, but does not eliminate CUI protection duties or applicable Level 1 and Level 2 self-assessments.
• Prime contractors and procurement teams can use documented scope decisions to evaluate supplier readiness and clarify how subcontractors handle CUI.
• Treat the article’s vendor-specific product discussion as sponsored content and independently validate capabilities against contract requirements and evidence.