The Defense Compliance ReportCMMC 2.0 & the Defense Industrial Base
Find My CMMC Path →
DRAFT PREVIEW — NOT PUBLISHED — PUBLICATION DATE PENDING

Free decision tool · No email required

CMMC Three-Gate Test for IT & Cybersecurity Providers

Answer twelve structured questions to map the CMMC paths that may apply to your company and one service line. The paths can stack: your own contract, your service inside a client's scope, your cloud architecture, and your ecosystem role are separate questions. Your dated result is printable and includes source links.

How the test works

  1. Contract: DFARS 252.204-7021 in your executed contract or flow-down is the own-status trigger. DFARS 252.204-7012 alone does not create a CMMC Status.
  2. Data: client CUI on your assets and Security Protection Data (SPD) on your assets produce different service-scope treatment under 32 CFR 170.4 and 170.19.
  3. Architecture: DoD CIO's February 2025 technical guidance distinguishes a client-subscribed cloud tenant from a provider-operated cloud service. CSP duties under DFARS 252.204-7012 depend on the cloud holding client CUI.
  4. Separate fourth door: C3PAO, CCP, or CCA roles carry duties under 32 CFR Part 170 Subpart C.

Limits and privacy

Run the service-level questions again for each service line. An uncertain or contradictory answer becomes a “verify this” item, not a guessed classification. This tool does not review contracts or determine compliance.

Do not submit CUI, drawings, credentials, vulnerability findings, network diagrams, or contract attachments. The tool takes structured answers only.

Gate 1 — Your own contracts

Check executed prime contracts, subcontracts, purchase orders, task orders, incorporated clauses, and amendments; do not rely on an informal request.

1. Does an executed agreement your company holds include DFARS 252.204-7021, including a flowed-down clause?
2. Does an executed agreement your company holds include DFARS 252.204-7012?

Gate 2 — Data on your assets for this service

Answer for one service line. Consider provider-owned ticketing, backups, log archives, and credential vaults, not just the primary platform.

3. Does client CUI get processed, stored, or transmitted on your assets?
4. Do your assets process, store, or transmit security logs or configuration data for the client's assessed environment?
5. Do your assets process, store, or transmit vulnerability-status data or security alerts for that environment?
6. Do your assets process, store, or transmit passwords granting access to that environment?

Gate 3 — Cloud service architecture

Answer the next four architecture details as N/A when this service is not cloud-delivered. A provider-owned tenant subdivided for customers is a signal to verify, not a conclusive determination by itself.

7. Is this service cloud-delivered?
8. Is the cloud tenant subscribed or licensed to the client (even if you resell the service)?
9. Do you contract with a cloud provider and further modify the basic cloud service for this offering?
10. Do you own the cloud tenant and further subdivide it for customer use?
11. Does this cloud service hold client CUI?

Fourth door — CMMC ecosystem role

This is independent of the three gates above.

12. Do you hold a C3PAO authorization or a CCP or CCA certification?

No email, uploads, or free-text answers. Do not enter sensitive information.

Read the full sourced guide to CMMC for cybersecurity companies →