CMMC in Practice: Industry Perspectives on Evolving Strong Frameworks
If you’re deep into the world of CMMC (Cybersecurity Maturity Model Certification), you know how foundational compliance is to the culture and structure of organizations within the Defense Industrial Base (DIB) that are handling Controlled Unclassified Information (CUI). It brings accountability and, most importantly, security to the network of contractors and subcontractors that are involved with this type of federally mandated information. And most professionals within the industry understand the vitality of not only the certification, but the implementation and continued maintenance of cyber systems operating within the DIB.
With that being said, there are others that work directly with these processes and regulations (e.g,. Managed Service Providers (MSPs), contractors, assessors, etc.) that may encounter real-world challenges that the framework wasn’t initially designed to address. In a recent podcast episode, Axiom’s Bobby Guerra and Kaleigh Floyd voice their suggestions on what they believe could make the system more flexible, cost-effective, and accessible without compromising its integrity. Below are the five ideas they touched upon.
Note: These are not official changes nor are they meant to point out anything that is wrong within the ecosystem. They are merely opinions of those that believe with a few adjustments, CMMC can better serve the organizations it was created to protect.
1. Allow C3PAOs to Offer Limited Recommendations
Under the current regulations, Certified Third-Party Assessment Organizations (C3PAOs) are not allowed to offer recommendations during assessments. And while this protects objectivity, we believe that assessors could provide structured, limited feedback without crossing boundaries.
This idea is not to blur the line between assessor and consultant, but to encourage collaborative compliance. Which is when the assessment process itself helps organizations learn and improve in real time.
2. Provide Conditional Pass Options for Scores Like 88
The CMMC scoring system requires a perfect score of 110 to achieve certification, which matches up with the number of controls you must meet for Level 2 compliance. We suggest a conditional passing threshold, such as scoring at least an 88, provided the organization agrees to a follow-up review or remediation plan within a year. This has the possibility to create space for organizations that have made substantial progress but fall slightly short, reinforcing that security is a journey, not a binary outcome.
3. Develop a Service-Focused Assessment Process for MSPs
When contractors have a Managed Service Provider (MSP), CMMC compliance is a shared responsibility. That doesn’t mean organizations should simply trust their MSP without evidence on if the services they provide are Level 2 compliant. This even applies to CMMC Level 2 Certified MSPs. The services provided by the MSP were NOT the focus of their assessment. For many contractors we talk to, this is misinterpreted. So, imagine if the MSPs CMMC services were assessed by a C3PAO? How much more validity would that give? Would it allow for more inheritance?
According to Chapter 2 of NIST SP 800-53, when a security control is “inheritable,” it means:
- Your system or program benefits from a control (like a firewall, authentication system, or physical security).
- But you (the system owner) didn’t build or directly manage that control.
- Instead, another entity — like your company’s IT department or a corporate security team — is responsible for:
- Developing it
- Implementing it
- Assessing and testing it
- Authorizing it (deciding it meets requirements)
- Monitoring it over time
That’s why we believe MSPs should undergo a C3PAO assessment directly on the CMMC services they provide at scale.
Think about it:
- Cloud Service Providers (CSPs) are required to be FedRAMP authorized for their services to qualify. What if MSPs CMMC offerings were held to a similar standard?
- If MSP CMMC services are assessed, clients can more clearly understand what they are receiving and if it’s been verified. This can help expedite compliance.
- A service assessed MSP enables faster, more cost-effective scenarios for Organizations Seeking Assessment (OSAs). But because this type of assessment is not required, OSAs must vet MSPs and review risk of their services, even if they are CMMC Level 2 Certified.
In some cases, the biggest barrier to compliance isn’t always the controls; it’s the lack of clarity around who owns them and how they’re implemented. A C3PAO-assessed MSP, that is assessed on their services, removes a lot of uncertainty.
4. Substitute Annual Reviews for Full CMMC Reassessments
Rather than requiring a full reassessment every three years, we suggest introducing annual reviews for organizations that maintain strong compliance records. This would reduce the cold and disruption all while encouraging consistent attention to cybersecurity practices year over year.
5. Clarify FIPS Requirements and Security Data Guidelines
Federal Information Processing Standard (FIPS) compliance is a sticking point for many organizations. Ambiguities around what’s required and how to demonstrate it can stall otherwise strong security programs. We call for clearer guidance on FIPS-related requirements and better definitions around “security protection data,” so that expectations are consistent and achievable.
CMMC: A Shared Goal
The ideas outlined here don’t reflect disagreement with the purpose of CMMC, they reflect a commitment to ideas and starting a conversation within a community we feel so connected to.
In the end, everyone wants the same result: a secure, resilient supply chain that meets the cybersecurity needs of today’s threats. These suggestions only aim to support that goal while also acknowledging the realities organizations face on their path to compliance.
If you’d like to check out the full episode, you can find it linked here. And if you have any questions, feel free to reach out.