CMMC Compliance: 5 Accelerators
- Read time: 4 mins
Even though CMMC Phase 2 is currently on hold, compliance programs should not stop with it. The pause is the perfect time to get moving again without an assessment date bearing down on you.
The Department of War suspended Phase 2 on July 13, 2026 while it reviews the program. No new date has been announced as of the time of publishing this article. DFARS 252.204-7012, NIST SP 800-171 and Phase I self-assessments continue to apply.
We have five accelerators to get you assessment-ready faster: name your owners, map how controlled unclassified information (CUI) moves, prove every in-scope tool, build evidence as you operate and validate on a schedule. Each one starts with a decision.
1. Assign Control Owners and Evidence Owners By Name
Controls get done when one person answers for each. What we have found is that without a name, everyone assumes somebody else is handling the details.
So build an owner roster. Then list every control, the person who owns it and the person who produces its evidence. Finally, hold each person to clear expectations.
It is very wise to bring in operations, engineering and sales too. CMMC often lands on the IT team because it sounds like a computer problem. Operations, engineering and sales all have differing visibility into how work moves through your systems, and a design that skips them often returns less than desirable results.
Owner: Executive sponsor
Procedure: One owner roster with a named person for every control and evidence item
Proof: A signed roster
2. Map How CUI Moves Before You Set the Scope Boundary
| CMMC Accelerator | |
|---|---|
| 1 | Assign control owners and evidence owners by name |
| 2 | Map how CUI moves before you architect the scope boundary |
| 3 | Configure, operate, and prove every tool you own in scope |
| 4 | Build evidence during operations, not before the audit |
| 5 | Run a recurring validation rhythm against the baseline |
Your scope decides how much work you carry and whether your documents stay accurate. It follows CUI, so it covers everywhere you store, process or transmit it.
Leadership rarely sees that flow in full, so you must bring the departments into one room and ask each whether it touches CUI. A shipping team says no until a clerk mentions the drawings that started going into packages a year ago. Then someone in sales admits to downloading an RFQ on a personal device while traveling.
After you’ve done that, look for ways to shrink it. Two salespeople handling CUI create less work than thirty. Decide whether you will defend an enclave or your whole enterprise, since you declare that choice to the assessor and then defend it. Finally, match your paperwork. Every asset on your inventory belongs on your boundary diagram, and things like a file-sharing service outside your environment can break your scope.
Owner: Compliance lead with each department head
Procedure: A department-by-department walkthrough of how CUI enters, where it lives and how it leaves
Proof: A CUI flow diagram and boundary diagram that match your asset inventory
3. Configure, Operate and Prove Every In-Scope Tool You Own
A GCC High subscription gives you a strong start. However, assessors still want proof that you configure it, operate it and control it.
GCC High covers a lot of ground and many teams use a slice of it. The unused parts need engineering time so they often do not become a path to CUI. Each in-scope tool also needs an approved baseline, things like Intune, Defender and your security information and event management (SIEM) tool. CIS benchmarks are a common pick. Record every change against the baseline and give each exception a business case.
Inherited controls need an owner too. Microsoft, for example, handles some settings you just can’t change. You still need to know what they do and keep a shared responsibility matrix that shows where its duties end and yours begin. You’ll need to confirm that any cloud service storing your CUI holds a current FedRAMP authorization as well.
Owner: A named technical manager for each tool
Procedure: An approved baseline plus a change process for every exception
Proof: Baseline documents, change records and a current vendor responsibility matrix
4. Build Evidence During Operations
Assessors work by one rule: what you cannot prove does not exist.
CMMC Level 2 has 110 controls. Assessors score you against 320 assessment objectives and read your system security plan (SSP) with that list beside them. When an objective asks you to define a frequency, they want a number in writing. Write your SSP objective by objective.
Evidence follows the same logic. A screenshot proves a configuration, like a password length setting. A control you say you manage or monitor draws requests for five more, last month’s or last year’s. Logs, exports and maintenance records answer those requests before anyone makes them. Clear evidence also means fewer questions, and unclear evidence stretches an assessment longer.
Our recommendation is to collect these records during daily operations. The format doesn’t really matter, so a ticket, a spreadsheet or a OneNote page all work. Actually doing what your SSP says matters the most.
Owner: Each evidence owner
Procedure: An SSP written by assessment objective and evidence collected during normal operations
Proof: Logs, exports and maintenance records, with screenshots for configuration settings
5. Run a Recurring Validation Rhythm Against the Baseline
Drift tends to catch the teams that did everything right on day one. An exception granted for a short project stays open long after the project wraps. The configuration that made sense two years ago slowly stops fitting how the business runs. And that monthly task in your plan? It hasn’t run in six months. None of it looks wrong in the moment. But if you add it all up, the program no longer matches your paperwork.
Put a monthly or quarterly review on the calendar to check baselines, open exceptions, maintenance records and the SSP. An annual review leaves eleven months when nobody is looking. Choose a pace your team can keep, because the SSP will state that frequency and an assessor will hold you to it.
Make a point of reading the SSP itself during each review. Assessors still find bracketed template text like “enter frequency” sitting in finished plans. A team that can’t explain what its own SSP says should expect a longer and tougher round of questions. Every control has to hold up on paper, in daily practice and in the evidence that proves it.
Owner: Compliance lead
Procedure: A monthly or quarterly review of baselines, exceptions, maintenance records and the SSP
Proof: Dated review records
Contact HBS to get your CMMC readiness work moving.
FAQ:
Is CMMC still required after the Phase 2 suspension?
Parts of it are. Phase I self-assessments, DFARS 252.204-7012, NIST SP 800-171 compliance, SPRS score postings and annual affirmations continue. Review your contract for any CMMC terms that apply to you.
How do you prepare for a CMMC assessment?
Name control and evidence owners, map how CUI moves and set your scope. Configure and document every in-scope tool, collect evidence during daily operations and review it on a schedule. Write your SSP against the 320 assessment objectives.
Does owning GCC High make you CMMC compliant?
No. GCC High gives you a strong platform. You still need an approved baseline for each in-scope tool, a change process for exceptions and a shared responsibility matrix that shows where Microsoft’s duties end and yours begin.
What counts as evidence in a CMMC assessment?
Screenshots work for configuration settings. Controls you manage or monitor need logs, exports and maintenance records that show activity over time. Any format works when the record exists, such as a ticket, a spreadsheet or a OneNote page.
Related Content
Pentagon Suspends CMMC Phase II Rollout
The Department of War suspended CMMC Phase II third-party assessments on July 13, 2026. Here’s what changed, what didn’t, and what defense contractors should do now.
CMMC
Secure your future DoD contracts with HBS’s CMMC certification guidance. Our experienced professionals help you navigate through CMMC requirements efficiently.
CMMC Compliance: An Overview for Your Business
Is your business part of the defense supply chain? Learn what CMMC compliance is, why it matters for contractors and subcontractors, and how to get certified.
