By Melissa McCoy, Chief Information & Security Officer – CISSP-ISSAP, CCSP, RP
Questions for Your Primes on CMMC Preparedness
Understanding Expectations for CUI Handling
When working with a prime contractor, it’s essential to understand their expectations for handling controlled unclassified information (CUI). Primes must ensure that their subcontractors meet the appropriate Cybersecurity Maturity Model Certification (CMMC) requirements–Level 1 for basic safeguarding and Level 2 when CUI will be shared.
Reviewing Prime Questionnaires
When you receive a questionnaire from a prime, review each question in the context of the specific contract(s) you support to ensure that your responses accurately reflect your responsibilities.
Key Questions to Ask Your Prime
- CUI Scope
- What CUI will we handle, and what CUI will be shared with us? Is there a CUI Designation Table for this contract?
- CMMC Level Requirements
- If CUI will be shared, is a Level 2 Self‑Assessment acceptable, or is a third‑party Level 2 Certification Assessment required?
- Points of Contact
- Who is the designated point of contact within your organization for CUI‑related questions or concerns?
Why These Questions Matter
Asking these questions clarifies roles and expectations, reduces ambiguity, and demonstrates your organization’s commitment to protecting CUI. This approach fosters stronger collaboration and supports a transparent working relationship with the prime contractor.
Melissa McCoy of Kaizen Approach, Inc. shares biweekly insights to help your organization take a smarter, more confident path toward CMMC compliance. Like and share the CISO Perspectives blog to help us continue improving the IC’s security posture.
Contact us for a free consultation to discuss your CMMC needs today!
