Procright - How Primes and Subs Secure CMMC Across Supply Chains

CMMC Is No Longer a Company-By-Company Problem

For years, many defense contractors treated Cybersecurity Maturity Model Certification (CMMC) as an internal readiness project: define your scope, implement controls, document policies, and prepare for assessment. That framing is no longer sufficient.

The more consequential challenge is now visible across the Defense Industrial Base: Controlled Unclassified Information (CUI) does not stay neatly inside one organization. It moves from prime contractors to subcontractors, across tiers of suppliers, through procurement teams, file-sharing workflows, email, cloud environments, and managed service relationships. Once that happens, compliance stops being a single-enterprise exercise and becomes a supply chain governance problem.

That was the central message of the webinar, How Primes and Subs Secure CMMC Across Supply Chains. The discussion brought together perspectives from assessment, consulting, and secure collaboration to answer a question many organizations are now facing: How do primes and subs protect CUI in ways that are compliant, usable, and realistic for operational teams?

For business leaders, procurement managers, and technical decision-makers, the answer is not to buy more tools reflexively. It is to build a repeatable model for identifying where CUI flows, clarifying obligations, constraining risk, and proving that controls work in practice.

Key Takeaways

CMMC readiness now extends across the supply chain, not just within one contractor’s walls.
Primes retain supply chain risk, even when subcontractors handle the CUI.
Many small and mid-sized suppliers still lack clarity on whether CMMC applies, what level applies, and whether they actually receive CUI.
Scoping is the first critical decision: know what data is CUI, where it resides, who touches it, and which systems are in scope.
A full IT overhaul is not always necessary; a narrower enclave approach can reduce cost and speed readiness.
Documentation must match reality; mismatched policies, procedures, and technical settings are a common failure point.
External sharing is a high-risk area, especially when teams rely on familiar but weak workflows like standard email or unmanaged file sharing.
Assessment readiness requires evidence, not just written policies.
Continuous compliance matters; passing once does not guarantee success at re-assessment.
Action item: if your organization handles defense-related data, start by mapping CUI flows and supplier dependencies before making technology decisions.

Why the Supply Chain Is Now the Real CMMC Battleground

A useful shift in the webinar was its emphasis on CUI movement rather than CMMC paperwork.

Organizations often focus on the 110 security requirements associated with Level 2, but the more practical question is: where does the information go after it enters your business? If a prime sends CUI to a supplier that is unprepared, the exposure is no longer theoretical. It becomes a contractual, operational, and reputational risk.

One speaker summarized the change well: the conversation has moved from "what is CMMC?" to "how do we show we’re ready?"

That distinction matters. Definitions are no longer the bottleneck. Execution is.

What has changed recently?

According to the webinar, contractors are now seeing CMMC move into real contract planning and supplier discussions. That means organizations can no longer wait for a solicitation to force action. By that point, it may be too late to:

determine whether CUI is present
define the assessment boundary
implement missing controls
collect evidence
prepare for a third-party assessment, if required

For procurement and program leaders, this creates a planning issue as much as a cybersecurity one. Supplier readiness can now affect contract eligibility, delivery timelines, and continuity of execution.

The Prime Contractor’s Burden: Ownership Without Total Control

One of the clearest insights from the webinar is that primes do not become assessors of their subcontractors, but they do remain accountable for supply chain risk.

That creates an uncomfortable middle ground.

A prime may not control a subcontractor’s infrastructure, staffing, or readiness timeline. Yet the prime still needs to know:

who receives CUI
why they receive it
how it is protected
whether contractual obligations are understood
whether the supplier can handle the data appropriately

This is a classic governance problem. Responsibility sits higher than direct authority.

What primes should be doing now

The speakers outlined a practical early-stage plan for primes. In strategic terms, it has two phases.

1. Build visibility

Before sending more surveys or issuing more policy statements, primes need a usable map of the supply chain.

That means identifying suppliers that:

receive CUI
generate CUI
store CUI
process CUI
transmit CUI

Then those suppliers should be ranked by factors such as:

sensitivity of shared information
contractual criticality
current maturity
likely difficulty of remediation

This prioritization step is often undervalued. Without it, primes tend to over-communicate to low-risk suppliers and under-manage the suppliers that present the greatest exposure.

2. Communicate expectations clearly

The webinar emphasized three messages primes should convey to suppliers:

What qualifies as CUI
What contractual and security requirements apply
What the supplier must do before receiving the data

That may sound basic, but the discussion made clear that many suppliers still receive sensitive data without fully understanding the obligations attached to it. In mature governance environments, the supplier should never discover those obligations after the fact.

A broader lesson for procurement leaders

This is where procurement operations intersect directly with cybersecurity. If supplier onboarding, bid collaboration, technical exchange, or document transfer happens outside a governed process, then even strong internal controls can be undermined.

In other words: your compliance posture is only as consistent as your least-controlled external workflow.

Why Subcontractors Are Still Struggling

The webinar highlighted several recurring issues among subcontractors, especially small and mid-sized businesses.

These organizations are not necessarily resisting CMMC. More often, they are stuck at the starting line because of uncertainty.

Common sources of confusion

According to the discussion, many subcontractors are still unclear on:

whether CMMC applies to them at all
whether they fall under Level 1 or Level 2
whether they actually receive CUI
whether markings on documents can be trusted
how much of their environment needs to be in scope
whether compliance requires replacing their existing IT stack

This confusion has practical consequences. It delays scoping, pushes out budgeting decisions, and causes organizations to make premature technology purchases.

One of the most useful cautions in the webinar was essentially this: do not start by buying a platform. Start by understanding your data and obligations.

That is sound advice for technical buyers. A rushed platform decision can expand scope unnecessarily and raise long-term operating costs.

The First Step for Subs: Define Reality Before Designing a Solution

The webinar repeatedly returned to one idea: scope before architecture.

That means a subcontractor should first determine:

whether it receives or generates CUI
what kind of CUI it handles
whether other requirements also apply, such as export controls
which users, devices, applications, and processes interact with that data
whether vendors or downstream subcontractors also touch it

Only after that analysis should the organization decide whether it needs:

full-environment remediation
a managed enclave
a segmented collaboration environment
outside consulting or managed support
formal mock assessment support

Why this matters financially

For many smaller firms, the biggest fear is that compliance means rebuilding everything.

The webinar pushed back on that assumption. A recurring theme was that companies do not always need to "rip and replace" their entire environment. A smaller enclave model can narrow the CMMC boundary to only the users and systems that actually handle CUI.

That has major implications for:

licensing cost
documentation burden
administrative overhead
incident response complexity
long-term maintenance

For leaders managing constrained budgets, this may be the most important strategic takeaway of the session. The way you define scope will often determine the affordability of compliance more than the specific tool you choose.

Assessment Readiness Is Not Documentation Readiness

A strong part of the webinar was its realism about what assessors actually look for.

Many organizations think they are progressing because they have policies, procedures, and templates in place. But the speakers made a crucial distinction: documents describe intent; evidence proves execution.

What assessors are really looking for

The discussion framed readiness around three core elements:

scope: can the organization clearly explain its CUI boundary?
implementation: are required controls actually operating?
evidence: can the organization prove those controls are functioning as described?

That last point is where many organizations fail.

A policy may say account lockout occurs after a certain number of failed logins. But if the actual system setting differs, the documentation becomes a liability rather than an asset. Likewise, a visitor policy may require escorts, but if no one enforces it on-site, the control is weak in practice.

This matters because CMMC is not a paper exercise. It is an operational test of whether security behavior is embedded in daily work.

A practical interpretation for technical leaders

This means readiness programs should not treat documentation as the final phase. Documentation should be created after operating practices are defined and validated, not before.

A better sequence is:

define the scope
implement or adjust controls
validate the workflows
train users
document what is actually happening
collect evidence over time

That order reduces the all-too-common problem of "aspirational documentation", where policies describe a mature environment that does not yet exist.

External Sharing Is the Compliance Gap Most Teams Underestimate

If there was a single operational weakness that emerged from the webinar, it was this: many organizations still have not fully solved secure external collaboration.

Internal controls may be solid. But once teams need to send CUI to customers, suppliers, or partners, convenience often takes over.

Why users bypass secure processes

The speakers were direct about human behavior. If the approved process is cumbersome, employees will work around it. That can lead to:

unencrypted email use
personal storage accounts
unmanaged drives
ad hoc file links
standard commercial collaboration tools used outside defined controls

This is not simply a training issue. It is a workflow design issue.

When compliance depends on users abandoning familiar business habits without receiving an equally usable alternative, policy noncompliance becomes predictable.

Why email is especially problematic

The discussion drew a useful contrast between email and managed file sharing.

Email feels easy, but from a control perspective it is often weak:

messages can be forwarded
attachments can be downloaded and re-shared
auditability is limited
access expiration is difficult to enforce
permissions are blunt compared to governed repositories

By contrast, well-designed file-sharing environments can support:

role-based permissions
view-only access
expiration dates
revocable access
activity logging
tighter alignment with supplier onboarding workflows

For technical decision-makers, this suggests an architectural principle: treat external CUI exchange as a governed application workflow, not as a casual communication event.

The Hidden Risk in Procurement Teams

One understated but important webinar point was the role of procurement personnel in sharing sensitive information.

In many organizations, procurement teams handle supplier exchanges involving technical documents, requirements packages, and contract-adjacent information. Yet they may not be operating inside the same disciplined environment as the cybersecurity or engineering teams.

This creates a common blind spot.

If procurement needs to move quickly and lacks a practical secure-sharing process, it can become the place where CUI spills occur first. The webinar referenced cases where data was sent through noncompliant email or other channels simply because it seemed to work.

For leaders, the implication is clear: procurement workflows should be included in CUI boundary design and readiness planning from the start.

Too often, they are considered late in the process, after engineering and IT decisions are already made.

Continuous Compliance Is the Next Big Failure Point

Another strong insight from the discussion is that organizations often prepare intensely for readiness, then relax too much afterward.

That is a serious mistake.

The speakers noted that one of the most frequent issues in mock assessments is not that a company never built the control. It is that the company stopped performing it at the documented frequency.

Examples can include:

reviews that were supposed to happen monthly but stopped
training obligations that lapsed
audit logs that were no longer examined consistently
user access recertifications that fell behind
procedures that existed but were no longer followed

This is the natural weakness of compliance programs launched as one-time projects. CMMC, however, behaves more like an operating system for secure work than a one-off milestone.

What this means organizationally

To sustain compliance, companies need:

recurring ownership
calendared control activities
monitoring discipline
internal accountability
periodic validation before formal reassessment

For executives, this has budgeting implications. If the plan funds certification but not ongoing maintenance, the organization is effectively deferring failure.

Self-Assessment vs. Third-Party Certification: Why Contract Context Matters

The Q&A surfaced an issue many contractors are actively debating: can a company rely on self-assessment, or must it undergo third-party certification?

The webinar’s answer was practical rather than absolute: it depends on the contract and the timing.

Some solicitations currently allow self-assessment and affirmation, while others already require third-party certification. The speakers also noted that certain larger primes are imposing earlier certification expectations on their suppliers, independent of broader timelines.

A decision framework for leaders

If your organization is deciding whether to stop at self-assessment for now, ask:

What do current contracts require?
What are major customers signaling?
Could future work be delayed if certification is not already in process?
Who is signing the affirmation, and what risk are they accepting?

One of the most valuable recommendations in the webinar was that even organizations planning to self-attest should still seek outside validation. Independent mock assessments can reveal blind spots that internal teams routinely miss.

This is especially important because internal scoring tends to be optimistic, particularly when teams are evaluating their own documentation and technical evidence.

A More Mature View of CMMC: Ecosystem, Not Check-the-Box

Perhaps the most useful mindset shift from the webinar is this: CMMC is not just a compliance event; it is an ecosystem coordination challenge.

That affects how leaders should think about the work.

A mature organization will not only ask, "Are we compliant?" It will also ask:

Can we explain how CUI moves through our supplier network?
Do our users have secure workflows they will actually use?
Can our procurement and program teams collaborate without creating spillage risk?
Do our policies match what happens in real life?
Can we sustain these controls over multiple years?

Those are harder questions than simply checking policy existence. But they are closer to the reality assessors, primes, and contracting ecosystems now care about.

A Practical Roadmap for Organizations Starting Now

For readers who need a structured path forward, the webinar content suggests a pragmatic sequence.

Step 1: Clarify contractual obligations

Determine whether your organization handles:

Federal Contract Information (FCI)
Controlled Unclassified Information (CUI)
additional restricted categories, if applicable

Do not rely on assumptions. Review contracts and engage upstream partners where necessary.

Step 2: Map CUI flows

Identify:

who receives the data
where it is stored
how it is transmitted
which systems process it
which external parties access it

This map should include procurement, engineering, IT, and suppliers.

Step 3: Define the boundary

Use the data-flow analysis to decide what must be in scope. Avoid over-scoping if a narrower enclave can support the work.

Step 4: Perform a gap assessment

Evaluate current technical, administrative, and procedural controls against the applicable requirements.

Step 5: Align operations before writing policies

Fix workflows first. Then document the actual state, not the desired future state.

Step 6: Build evidence early

Do not wait until the assessment window to gather proof. Evidence should accumulate as controls operate.

Step 7: Train for behavior, not just awareness

Employees need to know what secure handling looks like in everyday work: visitor control, email handling, document sharing, access requests, and incident reporting.

Step 8: Establish continuous monitoring

Recurring control activities need ownership, schedules, and review. If nobody is responsible for recurring execution, drift is inevitable.

Conclusion

The webinar’s most important contribution is that it reframes CMMC from an isolated certification problem into a shared operational discipline across the defense supply chain.

For primes, that means supplier readiness is no longer peripheral. It is central to risk management.

For subcontractors, it means the path forward starts with clarity: know your obligations, understand your CUI, and avoid overbuilding.

For technical and procurement leaders alike, the lesson is the same: secure collaboration is now part of compliance architecture. If external sharing is uncontrolled, the rest of the program remains fragile.

The organizations best positioned for the next phase of CMMC will not be the ones with the most paperwork. They will be the ones that can show, consistently and credibly, that their people, systems, and suppliers handle sensitive information the way their policies say they do.

Source: "From Prime to Sub: Achieving CMMC Across Your Supply Chain" - PreVeil, YouTube, Jun 8, 2026 - https://www.youtube.com/watch?v=Wb7vcrqFu3U