CMMC vs ISO 27001: A Guide for UK Defence Suppliers

A UK supplier can hold ISO 27001 certification and still face a separate CMMC requirement on a US defence contract. That distinction matters when a prime contractor asks for evidence of security controls, or a bid names a particular assessment level.

In practice, CMMC and ISO 27001 protect information in different ways. ISO 27001 gives you a system for managing information-security risk. CMMC 2.0 sets contract-linked requirements for protecting certain US government information on applicable US defence contracts. Understanding where they overlap can save duplicated work, but first you need to establish what your contract requires.

CMMC vs ISO 27001: the essential difference

CMMC follows the contract and the information

CMMC 2.0 is a US Department of Defense programme for applicable contractors and subcontractors in the US supply chain, including defense contractors. Its requirements concern Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The contract, the information you handle and the required CMMC level determine what you must demonstrate.

For a UK organisation, geography alone doesn't settle applicability. A supplier receiving CUI through a US defence supply chain may have obligations even if its people and systems are in Britain. But CMMC doesn't apply to every UK defence supplier, and selling to a defence company doesn't automatically mean every project or system needs a CMMC assessment.

ISO 27001 follows an information-security management system

ISO/IEC 27001 is an international standard for an Information Security Management System (ISMS). The organisation defines its ISMS scope, assesses information-security risks, chooses treatments and checks whether its arrangements remain effective.

An ISO 27001 certificate demonstrates that the defined ISMS meets the standard. It doesn't establish that each CMMC practice is met in a CUI environment. ISO certification cannot replace a required CMMC assessment, although its controls and records can provide a useful starting point.

Check the contract before choosing a compliance path

Identify the requirement you are being asked to meet

Start with the solicitation, contract clauses and any flow-down terms from your prime contractor. These can create CMMC obligations for a UK supplier supporting the US defense industrial base. Confirm the required CMMC level, assessment type and information you will receive or create. Ask for clarification if a customer uses terms such as "sensitive defence data" without identifying whether it is FCI or CUI.

Then trace where that information goes: email, engineering systems, shared drives, backups, external support and subcontractors. A drawing sent to a machine shop can create a different assessment boundary from a project managed entirely within one controlled environment.

Separate customer expectations from formal requirements

Some customers request ISO 27001 certification as part of supplier assurance. Others impose CMMC requirements through US defence contracts. A prime may ask for additional evidence beyond either framework.

Record each requirement against its source and owner, separating formal contract obligations from customer preferences and broader information security practices. That gives your commercial and security teams a common view of what is mandatory, what is a customer preference and what needs confirming with the contracting party. For hands-on scoping support, see CMMC compliance consulting for defence contractors.

What the levels and controls cover

CMMC has three levels tied to information sensitivity

CMMC has three maturity levels, each tied to information sensitivity. Level 1 addresses FCI through 15 foundational practices. Level 2 addresses CUI through 110 requirements aligned with NIST SP 800-171 Revision 2. Level 3 adds selected requirements from NIST SP 800-172 for contracts needing stronger protection.

The Level 2 requirements span 14 families, including access control, incident response and configuration management. Suppliers need to show that applicable controls work within the assessed environment, not just that they have a company-wide policy.

ISO 27001 uses risk treatment and Annex A

ISO/IEC 27001:2022 sets requirements for the ISMS, including risk assessment, internal audit, management review and continuous improvement. Its risk-based approach considers Annex A controls, comprising 93 reference controls across organisational, people, physical and technological themes. The Statement of Applicability (SoA) records which controls apply and why.

The distinction is easiest to see side by side:

Question	CMMC	ISO 27001
What drives it?	An applicable US defence contract	The defined ISMS scope and certification goals
What is protected?	FCI or CUI within the assessment scope	Information covered by the ISMS
How are controls selected?	Required practices for the specified level	Risk treatment, with Annex A considered and justified
What is the outcome?	A required CMMC status or assessment result	Certification of the defined ISMS, if pursued

A control can appear in both columns without having the same boundary, test criteria or evidence requirements.

How assessments and audits differ

CMMC requires evidence against defined practices

CMMC assessors examine implementation through records, interviews and technical checks. For Level 2, they may check multi-factor authentication on relevant systems, review access permissions and test whether incident procedures are used. An audit-ready policy alone won't establish that a practice is met.

Assessment arrangements depend on the applicable CMMC level and the rollout phase. The route may include self-assessment or a C3PAO assessment, depending on current requirements. Check the live solicitation, contractual terms and official notices, including the DoD page linked as suspended the planned Phase II transition. Don't assume every Level 2 contract requires a third-party audit. CMMC's assessment model also includes annual affirmations of continuing compliance.

ISO certification examines the management system

An independent certification body audits whether the ISMS meets ISO 27001 requirements and operates within its stated scope. ISO 27001 certification commonly involves an initial audit, surveillance audits during a three-year cycle and recertification at the end.

The auditor examines how risks are assessed, controls are selected, and management reviews and internal audits drive improvement. A C3PAO assessment is a third-party audit against CMMC requirements, not an ISO certification audit. Neither audit result should be presented as the other.

How an existing ISO 27001 ISMS helps with CMMC Level 2

Reuse the control, then test its boundary

An established ISMS may already include access control policies, asset records, supplier reviews, security awareness training and incident response management. These controls and records can reduce preparation work if they cover the CUI environment and meet the relevant CMMC requirement.

Take access control. Your ISO audit may have reviewed joiner and leaver procedures across the business. A CMMC Level 2 review may need proof that accounts, privileges and multi-factor authentication are controlled on systems handling CUI. The same process can support both, but its records must identify the relevant users and systems.

Map requirements without claiming automatic equivalence

Build a crosswalk between ISO controls and individual NIST SP 800-171 requirements. Mark where one implementation supports both frameworks, where the CMMC test is narrower or more prescriptive, and where a gap remains. NIST SP 800-53 can help compare control concepts. Check each mapping against applicable NIST SP 800-171 requirements and assessment objectives, as a mapping isn't an assessment result.

This is where an ISO 27001 gap analysis and audit preparation process can provide value. It identifies working controls before you invest in changes. The CMMC gap review must still test each applicable requirement against its own criteria.

Build one evidence workflow, with distinct records

Give every shared control an owner and a test

Use one evidence register for recurring controls such as access reviews, patching and incident exercises. For each item, record the owner, affected systems, collection date and review frequency. Map it to the relevant ISO and CMMC requirements, including the applicable NIST SP 800-171 requirement.

A monthly patch report, for example, may support an ISO control and a CMMC practice. Before reusing it as audit evidence, check that it covers every relevant CUI system and proves the required action occurred. Screenshots collected for one assessment can become stale when configurations change. Refresh evidence after significant system or supplier changes, not just before a third-party audit.

Keep framework-specific documents separate

CMMC Level 2 preparation needs a current System Security Plan (SSP) describing the assessed environment, its boundaries and how requirements are implemented. A Plan of Action and Milestones (POA&M) may track eligible unmet requirements, but not every gap qualifies for this treatment. Use the Plan of Action and Milestones to track eligible remediation, and follow defined reporting rules for assessment results and remediation.

ISO 27001 needs its own ISMS records, including risk assessments, treatment decisions and the SoA. An SSP doesn't replace the SoA: one explains the security of a defined CUI environment, while the other explains control applicability within the ISMS.

Review both sets of records together. If a cloud service changes, update the system boundary and supporting evidence, along with the relevant risks and supplier records. The CMMC Level 2 audit guide offers more detail on preparing for assessment activities.

Set a proportionate roadmap for a UK supplier

Define the CUI boundary before buying new tools or expanding an existing ISMS. Include people, devices, cloud services, support access and subcontractors that handle or can affect protected information. Record the boundary in a System Security Plan. CMMC obligations depend on the applicable contract and information, not UK location or defence-supplier status alone.

Next, compare contract requirements with controls already in place. Prioritise gaps that affect multiple practices, such as unclear asset ownership, inconsistent multi-factor authentication or incomplete logging. Give each change an owner, and use a Plan of Action and Milestones for eligible remediation. Retain proof that each change works.

Plan ISO surveillance audits and CMMC evidence reviews on the same calendar. Allow for their different tests and any third-party audit requirements. This keeps the security programme manageable for an SME and avoids treating either assessment as a once-only exercise.

Key takeaways

• Check contract clauses and flow-down terms before deciding whether CMMC applies.

• ISO 27001 certification can support CMMC preparation, but it doesn't replace a required assessment.

• Reuse working controls and evidence only after checking the CUI boundary and assessment criteria.

• Maintain the SSP and any eligible POA&M alongside, rather than instead of, your ISMS records.

Frequently asked questions

Does ISO 27001 certification exempt a UK supplier from CMMC?

No. A valid ISO certificate can demonstrate a mature approach to information security, but it doesn't remove a CMMC requirement in an applicable contract. Check the required level and assessment route with the contracting party.

Does every Level 2 supplier need a third-party assessment?

No. CMMC's model includes both self-assessment and third-party assessment routes for Level 2. The Phase II suspension makes it especially important to verify current requirements rather than rely on an older rollout timetable.

Are all 93 Annex A controls mandatory for ISO certification?

Annex A provides 93 reference controls. An organisation considers them during risk treatment and explains inclusion or exclusion in its SoA. That differs from demonstrating the specified CMMC practices for the required level.

The right starting point

The first decision isn't which certificate to pursue. It's what your contract and information flow require. Once that is clear, an existing ISMS can provide structure, owners and evidence for much of the work.

Keep the assessment boundaries and framework-specific records clear. Shared controls will then reduce duplication without creating a false claim of equivalence.

If you would like to find out more information or require any of our services please Contact Us