CMMC applies to companies in the US Department of Defense supply chain — primes and subcontractors handling FCI or CUI. Purely commercial companies do not need it, but suppliers of parts, software, logistics, research or services that touch DoD contracts often do without realising it.
Commonly surprised companies
- Machine shops and electronics manufacturers supplying a defense prime
- SaaS and engineering firms whose product ends up in a DoD program
- Universities and labs with defense research grants
- Non-US suppliers to US primes — CMMC flows across borders
If a customer contract references DFARS 252.204-7012, 7019, 7020 or 7021, you are in scope. Check what applies to you with the free CMMC planner or our compliance readiness team.