Yes. CMMC has no citizenship or location requirement for the company itself — any business in the DoD supply chain that handles FCI or CUI can be assessed and certified, whether it sits in Japan, Australia, the Gulf or Europe.
What changes outside the US is the data architecture. If you touch ITAR/EAR-controlled or CUI-Specified data, US-persons restrictions apply and a GCC High enclave with US-based handling is typically required. CUI Basic can live in FedRAMP Moderate services accessible internationally.
What non-US contractors actually need
- A defined enclave so CUI never leaks into your general IT estate
- NIST SP 800-171 implementation and an SPRS score
- A C3PAO assessment (remote-friendly evidence collection is common)
- A partner covering your timezone — assessments and remediation stall when every question waits overnight
ITSecOps runs CMMC readiness for contractors in Japan, Australia, the UAE, Qatar, Germany and Italy — see our international CMMC services or check eligibility instantly in the free CMMC planner.
Flow-down carries the liability too: subcontractors and non-US suppliers certify the same DFARS clauses, and the False Claims Act reaches every invoice submitted under a misrepresented score. See our CMMC False Claims Act briefing.