Apr 14, 2026

Top 5 CMMC Gaps We See in Defense Contractors

If you’re a defense contractor working within the Defense Industrial Base (DIB), you already know that CMMC compliance isn’t optional — it’s the price of doing business with the Department of Defense. What you may not know is just how many organizations are quietly behind the eight ball when it comes to actually meeting those requirements.

At VSO (Virtual Service Operations), our team works alongside defense contractors, aerospace companies, and system integrators every day. We’re a veteran-led Managed IT Services provider, and our cleared, U.S.-based staff brings a mission-first mindset to every engagement. What that means practically is that we’ve seen the inside of a lot of IT environments — and we consistently see the same gaps showing up again and again when it comes to CMMC readiness.

The CMMC 2.0 framework, now codified under 32 CFR Part 170, has been rolling out in phases since November 2025. Phase 2 kicks in November 2026, bringing with it the requirement for Level 2 Certification assessments from accredited Third-Party Assessment Organizations (C3PAOs). If your organization hasn’t already started your readiness journey, the clock is ticking.

Here are the top five CMMC gaps we see most often in defense contractors — and what you can do to get ahead of them.

Gap #1: No System Security Plan (SSP) — or One That’s Completely Out of Date

Of all the CMMC requirements we encounter, the absence of a solid, current System Security Plan (SSP) is perhaps the most consequential. Under CMMC Level 2 (CA.L2-3.15.02), an SSP is not optional — it is a hard requirement that must be in place at the time of assessment. In fact, if your SSP is missing or materially incomplete, an assessor can’t even finish their evaluation. The assessment cannot be completed, and your organization will be found noncompliant with DFARS clause 252.204-7012.

An SSP isn’t just a checkbox document. It’s the foundation that maps your entire security posture. It must describe every information system within your CMMC Assessment Scope, explain your environment of operations, document how each security requirement is implemented, and define your relationships and connections to other networks and systems. It also needs to be reviewed and updated at least annually.

What we typically find at organizations new to CMMC: an SSP that was drafted a few years ago, approved once, and never touched again. The network has changed. New cloud services have been added. Personnel have turned over. The SSP reflects none of it. During a CMMC assessment, those gaps become findings — and those findings can cost you a contract.

The fix starts with treating your SSP as a living document, not a one-time deliverable. VSO helps clients build SSPs that are accurate, auditable, and structured to evolve alongside their environments.

Gap #2: Multi-Factor Authentication (MFA) Gaps and Incomplete Identity Controls

Multi-factor authentication (MFA) is one of the highest-value, highest-visibility CMMC requirements — and it’s also one of the most commonly misconfigured. CMMC Level 2 requirement IA.L2-3.5.3 mandates MFA for all network access to non-privileged accounts, not just remote access or administrator accounts. This is a point of significant confusion for many contractors.

What we see in practice: organizations that have deployed MFA for remote users and IT administrators, but have left internal network access — particularly for standard employee accounts — without a second factor. From a scoring standpoint, this matters. If MFA is only implemented for remote and privileged users, the deduction is three points. If MFA isn’t implemented at all, that’s a five-point deduction — one of the largest single hits available in the CMMC scoring methodology.

Beyond MFA, access control failures extend further. We regularly find contractors who haven’t enforced least-privilege principles, who still have former employees with active credentials, and whose privileged account usage isn’t being monitored. Every one of these is a CMMC finding waiting to happen.

The good news is that for organizations operating in Microsoft 365 environments, enforcing MFA and conditional access policies through Azure Active Directory (Entra ID) and Microsoft Defender is highly achievable. VSO specializes in M365 tenant hardening and Intune endpoint management aligned to CMMC requirements — and we’ve helped dozens of clients close these gaps efficiently.

Gap #3: Undefined or Poorly Scoped CUI Boundaries (and What Happens to Your Supply Chain)

This is one of the sneakiest CMMC gaps — and one that can unravel an entire compliance program if left unaddressed. CMMC compliance is scoped to systems that process, store, or transmit Controlled Unclassified Information (CUI) or Federal Contract Information (FCI). The problem is that many defense contractors haven’t done the disciplined work of defining exactly where CUI lives in their environment.

When CUI boundaries are undefined, one of two things happens: either the entire network gets pulled into scope (making compliance enormously expensive and complex), or contractors unknowingly leave CUI assets outside of their compliance boundary — creating real security risk and potential false representations in their SPRS scores.

Scoping also has significant implications for subcontractors. Under 32 CFR 170.23, CMMC requirements flow down to subcontractors who process, store, or transmit FCI or CUI. If you’re a prime contractor and your subcontractors haven’t addressed their CMMC posture, that’s a risk you own. When CMMC Level 3 is the prime requirement, the minimum flow-down is CMMC Level 2 (C3PAO).

Getting scoping right from the start is one of the highest-leverage things a defense contractor can do in their CMMC journey. VSO approaches every engagement with a formal scoping exercise — mapping data flows, identifying CUI touchpoints, and right-sizing the compliance boundary before any technical work begins.

Gap #4: Incomplete or Non-Existent Incident Response Plans — and Audit Logging Failures

Sub-Gap: Audit Logging

Two areas that consistently show up together in CMMC assessments: incident response (IR) capabilities and audit log management. Under CMMC Level 2, contractors must have functional incident response capabilities (IR.L2-3.6.1 and IR.L2-3.6.2), as well as robust audit logging that captures user activity, system events, and administrative actions (AU.L2-3.3.1 through AU.L2-3.3.5).

What we see most often: incident response plans that exist on paper but have never been tested. No tabletop exercise. No documented roles. No defined communication chain to notify the government within 72 hours of a cyber incident, as required by DFARS 252.204-7012. Alongside this, we regularly find audit logging that is either not enabled, not centralized, or not retained long enough to support forensic investigation.

These aren’t small administrative failures — they’re five-point deductions in the CMMC scoring model. Both basic IR requirements carry significant weight, and underdeveloped audit capabilities compound the problem.

The path forward requires both policy work and technical implementation. VSO helps clients build incident response programs that are practical, documented, and tested — and deploys centralized log management solutions that meet CMMC audit requirements without overwhelming IT teams.

Gap #5: Plans of Action & Milestones (POA&M) That Are Mismanaged or Misunderstood

Perhaps the most misunderstood tool in the CMMC compliance toolkit is the Plan of Action and Milestones (POA&M). Many contractors believe that having a POA&M for an unmet requirement is a “get out of jail free” card. It is not.

Under 32 CFR 170.21, a POA&M can support a Conditional CMMC Status — but only under strict conditions. Your overall score must be at or above 80% of the total points available. No requirement worth more than one point can be placed on a POA&M (with a narrow exception for FIPS-validated encryption). And certain requirements — including your SSP, physical access controls, and external connection management — cannot be placed on a POA&M at all.

If a POA&M is permitted, all items must be remediated and confirmed through a closeout assessment within 180 days. Miss that window, and your Conditional CMMC Status expires — meaning you start the entire assessment process over.

The contractors in the best position are those who treat the POA&M not as a compliance crutch, but as a structured remediation roadmap. VSO helps clients build POA&Ms that are realistic, prioritized by scoring weight, and tied to concrete timelines — so that when an assessment happens, there are no surprises.

Conclusion

CMMC compliance is a journey, not a destination — but the window to start that journey is closing. With Phase 2 implementation bringing Level 2 certification requirements to new DoD solicitations beginning November 2026, defense contractors can’t afford to wait for a contract vehicle to force the conversation.

The five gaps above — missing or outdated SSPs, MFA failures, undefined CUI scope, weak incident response and audit logging, and mismanaged POA&Ms — are exactly the kinds of issues that derail assessments and delay contracts. The silver lining? They’re all fixable with the right expertise and a clear plan.

VSO brings that expertise to every engagement. Our veteran-led team understands both the technical requirements and the mission context behind CMMC. We’ve supported federal agencies, defense contractors, and DIB organizations in building security programs that are audit-ready — and we do it with the discipline, transparency, and accountability that military service instills.

Frequently Asked Questions (FAQ)

What is CMMC 2.0 and who does it apply to?
CMMC 2.0 (Cybersecurity Maturity Model Certification) is the Department of Defense’s framework for verifying that defense contractors adequately protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It applies to all DoD contractors and subcontractors whose information systems process, store, or transmit FCI or CUI during contract performance. CMMC 2.0 is codified under 32 CFR Part 170 and is being phased in across all DoD solicitations through November 2028.

What are the three levels of CMMC 2.0?
CMMC 2.0 includes three certification levels. Level 1 (Foundational) applies to contractors handling only FCI and requires annual self-assessment against 17 basic safeguarding practices from FAR clause 52.204-21. Level 2 (Advanced) applies to contractors handling CUI and aligns to all 110 security requirements in NIST SP 800-171 Rev. 2 — requiring either a self-assessment or a third-party C3PAO certification assessment. Level 3 (Expert) applies to contractors supporting the DoD’s most critical programs and adds 24 requirements from NIST SP 800-172, assessed by the Defense Contract Management Agency’s DIBCAC.

Can a defense contractor still win contracts if they have a POA&M?
Yes, under certain conditions. A contractor can achieve a “Conditional” CMMC Status if their assessment score is at least 80% of the maximum available points, none of the open POA&M items are worth more than one point (with a limited exception for FIPS encryption), and no critical requirements are on the POA&M. All POA&M items must be remediated and verified through a closeout assessment within 180 days. Failing to close out a POA&M on time causes the Conditional Status to expire, requiring the contractor to begin the assessment process again.

Do CMMC requirements apply to subcontractors?
Yes. Under 32 CFR 170.23, CMMC requirements flow down to subcontractors who process, store, or transmit FCI or CUI during contract performance. The required CMMC level for a subcontractor is determined by the type of data they handle — not necessarily the same level as the prime contract. When a prime contract requires CMMC Level 3, the minimum flow-down requirement for subcontractors is CMMC Level 2 (C3PAO), unless the government provides different contractual guidance.

How long does it take to achieve CMMC Level 2 certification?
The timeline varies significantly based on an organization’s current security posture. Contractors who have been maintaining NIST 800-171 compliance and have an up-to-date SSP may be able to move to a C3PAO assessment within a few months. Organizations starting from scratch should expect a readiness and remediation phase of six to eighteen months before pursuing formal certification. VSO recommends beginning with a gap assessment to understand your current SPRS score and prioritize remediation efforts by scoring weight.

What is a System Security Plan (SSP) and why is it required for CMMC?
A System Security Plan (SSP) is a formal document that describes how your organization implements its cybersecurity requirements. Under CMMC Level 2 (CA.L2-3.12.4), the SSP is a mandatory, non-waivable requirement — it must be in place at the time of any CMMC assessment. If an SSP is absent or materially incomplete, the assessment cannot be completed and the organization is found noncompliant. At minimum, an SSP must describe your CMMC Assessment Scope, your operating environment, how each security requirement is implemented, and your system’s connections to other networks. It must be updated at least annually.

🔒 Ready to Know Where You Stand?

Schedule a CMMC Readiness Assessment with VSO today.

Our team will walk through your current environment, identify your highest-risk gaps, and give you a clear remediation roadmap — before an assessor does it for you.

👉 Contact VSO → | 📞 (888) 805-0510 | 🌐 vso-inc.com

VSO is a veteran-led, U.S.-based Managed IT Services provider with deep expertise in CMMC Level 2 compliance, NIST 800-171, GCC/GCC-High environments, and DoD cybersecurity frameworks. Our cleared staff brings mission-first values to every engagement.