CMMC 2.0 for SaaS Companies: A Practical Primer

CMMC 2.0 is now a contractual reality for organizations in the Defense Industrial Base. If your SaaS company sells to defense contractors or federal agencies — or if your customers do — CMMC compliance may be a condition of contract award, not just a competitive differentiator.

This primer covers what CMMC Level 2 actually requires, how the assessment process works, and what SaaS companies specifically need to understand about scoping and implementation.

Who Needs CMMC and at What Level

CMMC applies to organizations in the Defense Industrial Base (DIB) that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Level 1 applies to organizations handling FCI — 17 basic safeguarding requirements, annual self-assessment. Level 2 applies to organizations handling CUI — all 110 NIST SP 800-171 requirements, triennial third-party assessment for most contracts. Level 3 applies to the most sensitive programs — NIST SP 800-172 requirements, government-led assessment.

For most SaaS companies selling into the defense supply chain, Level 2 is the relevant target. The key question is whether your system processes, stores, or transmits CUI. If it does, Level 2 applies to the systems and personnel that touch that CUI.

Scoping: The Most Important Decision

Scoping is the most important and most underestimated step in CMMC preparation. The scope defines which systems, personnel, and processes are subject to the 110 NIST 800-171 requirements. A well-defined scope that precisely bounds the CUI environment is the difference between a manageable compliance program and an overwhelming one.

For SaaS companies, scoping typically involves identifying the specific product or service that handles CUI, the infrastructure it runs on, the personnel who have access to it, and the supporting systems (identity management, logging, monitoring) that are in scope by virtue of their relationship to the CUI environment. Systems that do not touch CUI are out of scope.

The temptation is to scope broadly — to include everything just to be safe. Resist it. A broader scope means more controls to implement, more evidence to collect, and a more complex assessment. Precise scoping is a risk management decision, not a shortcut.

The 110 Requirements: Where SaaS Companies Typically Struggle

NIST SP 800-171 organizes its 110 requirements across 14 control families. For SaaS companies, the families that most commonly require significant remediation work are: Access Control (AC) — particularly around least privilege and separation of duties in multi-tenant environments; Audit and Accountability (AU) — comprehensive logging of all access to CUI; Configuration Management (CM) — baseline configurations and change control for the CUI environment; and System and Communications Protection (SC) — encryption in transit and at rest, network segmentation.

The Identification and Authentication (IA) family is also frequently a gap: multi-factor authentication is required for all accounts with access to CUI, including privileged accounts and remote access. Many SaaS companies have MFA deployed for some accounts but not all — that is a finding.

The System Security Plan

The System Security Plan (SSP) is the central document of your CMMC compliance program. It describes your CUI environment, the 110 requirements, and how each requirement is implemented in your environment. The SSP must be accurate, current, and detailed enough for an assessor to evaluate your implementation.

Many organizations treat the SSP as a compliance document — something to write once and file away. That is a mistake. The SSP is a living document that must reflect your current environment. An outdated SSP is a finding, and it signals to assessors that your compliance program is not actively managed.

Preparing for a C3PAO Assessment

For Level 2 contracts requiring a third-party assessment, the assessment is conducted by a Certified Third-Party Assessment Organization (C3PAO). The assessment follows a defined process: pre-assessment documentation review, on-site or virtual assessment activities, scoring, and submission to the Supplier Performance Risk System (SPRS).

The most important preparation activity is a rigorous internal readiness assessment before the C3PAO arrives. Identify your gaps, remediate them, and document your remediation. Prepare your evidence package — the documentation that demonstrates each requirement is met. Conduct a tabletop exercise of your incident response plan. The organizations that achieve clean assessments are the ones that find and close their own gaps first.