CMMC for UK Defence Companies: Scope and Next Steps

A UK supplier can be outside the United States and still receive US defence contract information that needs protection. That doesn't mean every UK defence business needs CMMC certification. Your contract and the information you handle determine the requirement.

For UK defence contractors pursuing US Department of War (DoW) work, CMMC is a scope question. A UK location neither exempts a supplier nor automatically creates an obligation. Check what information will reach your systems and what the contract requires for CMMC 2.0 compliance, including the security controls you must demonstrate.

Key takeaways

• CMMC requirements apply through relevant DoW contracts and subcontracts. A UK address doesn't create an exemption, but defence-sector work alone doesn't create an obligation.

• Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) have different protection requirements. Identify which, if either, your organisation will handle.

• CMMC has three levels. Level 1 and some Level 2 requirements use self-assessment, while other Level 2 requirements call for an independent assessment.

• CMMC is being introduced through phased DoW acquisition requirements. Check the current phase and assessment route against the applicable contract or solicitation.

• Cyber Essentials, MOD requirements and ISO 27001 may support your security programme, but none automatically satisfies a CMMC requirement in a US contract.

What CMMC requires and what it doesn't

The Cybersecurity Maturity Model Certification (CMMC) is the DoW's programme for assessing how contractors protect certain unclassified information. It draws on existing US security requirements rather than replacing them with an unrelated set of controls. 32 CFR Part 170 sets out the programme's levels, assessment rules and scope.

For a UK business, the distinction is between preparing for CMMC and holding a required CMMC status. A readiness assessment can help you check your scope and prepare for CMMC 2.0 compliance before pursuing a contract. A formal status becomes an eligibility matter when the relevant solicitation, contract or subcontract requires it for the information and systems in scope.

That distinction protects businesses from unnecessary expenditure. A company supplying standard components may have no CMMC assessment requirement for that work if it doesn't receive FCI or CUI. A specialist engineering subcontractor may face substantial obligations if it receives controlled US technical data. Neither conclusion follows from the word "defence" in the company description; it depends on the work agreed.

When does CMMC for UK defence companies apply?

CMMC requirements can reach UK defence contractors at different tiers of a DoW programme, including through transatlantic supply chains, when requirements are flowed down. The CMMC applicability rules describe how requirements enter DoW solicitations and contracts. The key questions are whether the work involves FCI or CUI on contractor systems and what assessment status the contract requires.

Follow the contract, not the postcode

A UK company doesn't avoid a US subcontract requirement by storing information in Britain. Equally, a US customer relationship doesn't, on its own, mean a particular CMMC level applies.

Ask the prime contractor to confirm the specific DFARS clauses, required level and assessment type in the solicitation or subcontract. Check whether the requirement appears in the subcontract, an attachment or a formal flowdown from the prime contract. If those documents conflict, resolve the position before accepting the information or committing to a delivery date.

Trace what your team will receive

Sales teams may describe a project as "hardware only", whilst engineers receive drawings, test results or programme correspondence. Map the real information flow across purchasing, engineering, quality, support and any subcontractors.

Include portals and shared folders, not only files stored on your own network. If your organisation can access covered information to perform the work, that access needs reviewing. Contract and data mapping together give you a defensible answer about scope.

FCI and CUI: identify the information before choosing a level

CMMC's first two levels turn on different types of information. Confusing them can lead either to an undersized security programme or to an assessment effort the contract doesn't require.

Federal Contract Information

FCI is information provided by, or generated for, the US government under a contract to develop or deliver a product or service, where that information isn't intended for public release. Routine-looking contract material can qualify.

Level 1 addresses the basic safeguarding of FCI through the 15 requirements in FAR 52.204-21. If a supplier receives relevant contract information, it should identify where staff view, store and send it before deciding which systems are in scope. A public marketing brochure isn't FCI simply because it mentions a defence customer.

Controlled Unclassified Information

CUI is unclassified information that requires safeguarding or dissemination controls under applicable US rules or policies. For a UK engineering supplier, controlled technical information can be especially relevant. It may arrive through drawings, specifications or an approved customer portal.

Don't rely on a file name or an informal assurance that material is "sensitive". Ask the customer to identify the information category and applicable handling instructions. Where markings or contract documents are unclear, seek clarification from the prime or information owner before sharing the material more widely.

How the three CMMC levels differ

The required level depends on the contract and the information involved. The CMMC model in federal regulations links each level to established safeguarding requirements, including FAR 52.204-21 and NIST SP 800-171 Revision 2.

The main distinctions are:

Level	Information and requirements	Assessment route
Level 1	FCI; 15 basic safeguarding requirements	Annual self-assessment and affirmation
Level 2	CUI; 110 NIST SP 800-171 Revision 2 requirements	Self-assessment or C3PAO assessment every three years, depending on the requirement; annual affirmation
Level 3	Selected higher-priority CUI programmes; additional requirements, including NIST SP 800-172	Government-led assessment following the required Level 2 assessment

A C3PAO assessment organisation (CMMC Third-Party Assessment Organization) conducts independent Level 2 assessments. “Third-party certification” is common shorthand, but the formal requirement is an assessment and the required status. It doesn't apply to every Level 2 supplier.

Level 2's two routes matter: handling CUI doesn't automatically mean every supplier needs a C3PAO assessment at the same point in the rollout. Read the solicitation and flowdown wording to establish which route applies.

Level 3 is aimed at selected programmes, not the default destination for a supplier that handles CUI. If your customer names it, obtain the assessment and timing requirements in writing before planning the work.

Where the rollout stands in September 2026

The Department of War (DoW) programme rule took effect on 16 December 2024, establishing the assessment framework. The acquisition rule introduced CMMC requirements through DFARS clauses, with phased implementation starting on 10 November 2025.

Confirm the rollout position for September 2026 against current DoW guidance and the applicable solicitation. A third-party certification isn't required for every Level 2 contract; the solicitation and applicable phase determine whether one is needed.

  A change to a rollout milestone doesn't remove a CMMC clause already applicable to your contract.  

This is a reason to check the current solicitation, not to put preparation on hold. Contract-specific requirements and subcontract flowdowns still need attention. If a prime requests a higher assessment type, establish the contractual basis and deadline rather than assuming that every Level 2 engagement follows the same route.

CMMC is separate from UK defence assurance

UK suppliers often have established controls before CMMC enters the conversation. That work has value, but a familiar certificate doesn't replace the assessment status specified by a US customer.

Cyber Essentials and MOD contract requirements

Cyber Essentials tests a defined set of baseline technical controls. UK Ministry of Defence contracts can also impose their own cyber security requirements through procurement and contract terms. Assess each obligation against the agreement that creates it.

The Defence Cyber Protection Partnership is part of the UK defence supply-chain context, but check current authoritative UK guidance and contract terms to confirm what applies. The term Defence Cyber Certification shouldn't be treated as a blanket name for a UK certificate or as equivalent to CMMC status.

A supplier may therefore need to maintain UK assurance and satisfy a CMMC requirement for a separate US programme. Cyber Essentials evidence can support baseline assurance, but confirm what the US customer accepts. Keep a clear register of customer requirements so that evidence can be reused where appropriate without claiming that one framework grants automatic acceptance under another.

ISO 27001 and existing security programmes

ISO/IEC 27001 gives an organisation a structured information security management system. Its risk assessment, policies, internal audit and improvement processes can support CMMC preparation. The control sets, assessment boundaries and evidence rules are different, however.

If you already have certification, map implemented controls to the relevant CMMC requirements and document any gaps. ISO 27001 implementation support can strengthen that management foundation, whilst the contract-specific CMMC work still needs its own plan.

Define the systems that need to be assessed

Assessment cost and effort depend heavily on scope. Start with where covered information is processed, stored or transmitted, then include systems that provide security for that environment. The CMMC scoping rules should guide how you classify assets.

Map the full information route

Follow information from customer receipt through design, manufacture, inspection, delivery and retention. Record the people, devices, cloud services, backup locations and suppliers with access.

For example, a controlled drawing may arrive through a customer portal, move into an engineering file store and later appear in a quality record. Restricting the original download folder won't address copies elsewhere. Document the actual route before choosing technical changes.

Make boundaries manageable

Segmentation or a dedicated environment can reduce unnecessary exposure, but segmentation alone doesn't remove an asset or service from scope. Consider identity services, administrators, remote access, monitoring, backups and other systems that provide security controls for the in-scope environment.

A System Security Plan (SSP) should describe the systems and how relevant requirements are met. Keep diagrams, asset records and the SSP aligned. If staff routinely bypass the stated process to meet production deadlines, the documented boundary won't withstand a careful assessment.

Implement controls that produce credible evidence

For Level 2, NIST SP 800-171 Revision 2 contains 110 security requirements across 14 families. These cover configuration management, system integrity and other areas. Policies matter, but assessors also need evidence that requirements operate in the assessed environment.

Start with operational weaknesses

Review access control, including who can access CUI, how privileges are approved and whether multi-factor authentication works where required. Examine configuration baselines, change records, vulnerability handling and incident reporting. Monitoring helps teams identify cyber threats, while an incident response plan alone can't show staff know when and how to use it.

A readiness assessment should use a gap analysis to distinguish a missing control from security controls that are implemented but lack evidence of operation. That difference affects remediation effort and how long preparation takes.

Keep proof alongside the control

Maintain access reviews, configuration records, relevant logs, training records and evidence of security testing. Collect them through normal operations rather than assembling a large folder shortly before an assessment.

A mock assessment can test whether staff explanations match the SSP and technical settings. For a closer look at independent assessment activity, AKRUP's CMMC Level 2 audit guide covers preparation and typical evidence requests. A Level 2 C3PAO assessment, a form of third-party certification, is required only where the applicable route calls for it.

Choose the right assessment route and plan for gaps

A self-assessment remains a formal declaration of the organisation's CMMC position. Assign an owner, assess the correct boundary and retain evidence for each requirement. An annual affirmation also requires confidence that controls continue to operate after the initial assessment.

Where a Level 2 C3PAO assessment is required, plan for an independent review of documents, interviews and technical evidence. An assessment organisation checks implementation, but it doesn't build your controls. Keep readiness support separate from the independent assessor's decision.

Only eligible unresolved requirements may be covered by a time-limited Plan of Action and Milestones (POA&M), as determined by applicable programme rules. Don't assume every gap can be carried into an assessment. Document permitted remediation accurately and allow time for closure.

A proportionate CMMC readiness and implementation plan helps teams prioritise CMMC 2.0 compliance work by contract need, information risk and assessment timing. It also gives leadership a clear view of what remains unfinished.

Build CMMC into bid and subcontract decisions

CMMC preparation has a commercial timetable. If a bid requires a particular status at award, starting control implementation after selection is too late. Ask procurement teams to identify applicable contractual provisions when an opportunity first enters review. This includes any relevant DFARS clauses and flowdowns, as determined by the specific contract.

Confirm the required level, assessment type, system boundary and date. Check who will provide CUI, whether it can be accessed before award and what obligations must pass to your own subcontractors. Put unresolved assumptions in writing with the customer or prime contractor.

Budget depends on your starting controls, the number of systems in scope, remediation and whether an independent assessment is required. Avoid buying a new cloud environment or committing to an assessment solely because a provider describes it as "CMMC-ready". First establish the contractual requirement and the information flow.

For smaller suppliers, security leadership may be shared across IT, operations and management. Give one person authority to coordinate the plan and escalate contract decisions. Virtual CISO support can help maintain that oversight where a full-time security leader isn't practical.

Frequently asked questions

Does every UK defence supplier need CMMC certification?

No. Applicability depends on the relevant DoW contract or subcontract, the FCI or CUI handled, and the assessment requirement. Some suppliers may have no CMMC requirement for a particular contract, while others may need an assessment but not third-party certification.

Does Level 2 always require a third-party assessment?

No. Level 2 has self-assessment and C3PAO assessment routes. The applicable contract and rollout rules determine whether third-party certification is required. Confirm the route with the customer or prime before booking an assessment.

Can Cyber Essentials or ISO 27001 replace CMMC?

No. Both can provide useful controls and evidence, but neither delivers the CMMC status required by a US contract. Map existing work to the applicable requirements rather than starting again or assuming equivalence.

Should a supplier wait for the next rollout phase?

No, if an active contract already requires a status or a forthcoming bid has a clear deadline. The suspension of Phase II doesn't cancel Phase I requirements. Establish scope and close material control gaps in line with the contract you intend to perform.

Conclusion

A UK address doesn't settle the CMMC question. The contract, the information and the assessment route do.

Identify those three things before investing in tools or booking an audit. That gives your organisation a security plan matched to the work and a sound basis for discussing eligibility with a US customer.

If you would like to find out more information or require any of our services, Please Contact Us.