Defense contractors working within the San Diego region are operating under a compliance deadline that has real contractual consequences. The Cybersecurity Maturity Model Certification, known as CMMC, is no longer a future consideration. It is an active requirement embedded within Department of Defense contracts, and the 2025 timeline has narrowed the window for contractors who have not yet completed or initiated their certification process.
San Diego sits at the center of one of the largest defense industrial bases in the country. The concentration of aerospace, maritime, electronics, and systems integration firms in the region means that CMMC requirements touch a broad and varied population of businesses — from large prime contractors to small subcontractors handling controlled technical data. The compliance burden is real, and the stakes extend beyond regulatory standing. Failing to meet CMMC requirements can disqualify a company from contract awards entirely, regardless of technical capability or past performance.
This checklist is written for operations and compliance leads who need a structured, practical understanding of what CMMC compliance requires in 2025 — not a surface-level overview, but a working framework that maps the certification process to real organizational decisions.
Understanding What CMMC Actually Requires in the Current Rulemaking Cycle
CMMC 2.0 replaced the original model with a streamlined three-level structure. Understanding where your organization sits within that structure is the starting point for every other compliance decision. For most San Diego defense contractors working with Controlled Unclassified Information, Level 2 certification is the operative standard. Level 2 is built directly on the NIST SP 800-171 framework, which outlines 110 security practices across fourteen control families. Contractors seeking guidance on what that looks like in a regional context can review resources focused specifically on cmmc compliance san diego to understand how local implementation requirements are being interpreted and supported.
The distinction between Level 1, Level 2, and Level 3 is not just administrative. It determines whether a contractor can self-attest, requires a third-party assessment conducted by a Certified Third-Party Assessment Organization, or must undergo government-led evaluation. Most contracts handling sensitive but unclassified technical data fall into the Level 2 category, which requires a formal third-party audit conducted by a C3PAO before contract award or renewal.
The Role of Controlled Unclassified Information in Determining Scope
CUI scope is frequently misunderstood, and that misunderstanding drives many compliance failures before the assessment process even begins. CUI is not limited to files marked as sensitive. It includes technical drawings, specifications, design parameters, manufacturing processes, and contract data that fall within categories defined by the National Archives and Records Administration. If your organization touches that information — even incidentally in email threads, shared drives, or cloud-based collaboration tools — those systems fall within the compliance boundary.
For San Diego contractors with hybrid work environments, remote engineering teams, or suppliers with access to internal systems, the CUI boundary can extend well beyond what feels intuitive. A key early step in any CMMC checklist is conducting a CUI inventory and data flow mapping exercise to understand where that information lives, how it moves, and which systems and personnel touch it.
The System Security Plan and Plan of Action
The System Security Plan is the foundational document of CMMC compliance. It describes the organization’s information system boundary, the security controls currently in place, the people responsible for each control, and how the system is configured and maintained. The SSP is not a one-time document. It is a living record that must reflect the actual state of your environment, not an idealized version of it.
Assessors reviewing organizations for CMMC certification will use the SSP as a baseline for their evaluation. If the documented controls do not match what exists in practice, that gap becomes a finding. Incomplete or inaccurate SSPs are among the most common reasons assessments are delayed or failed on the first attempt.
The Plan of Action and Milestones as a Compliance Management Tool
The Plan of Action and Milestones, commonly referred to as the POA&M, documents the security gaps an organization has identified and the specific steps being taken to close them. Under CMMC 2.0 rulemaking, limited use of POA&Ms is permitted, but only for controls that are not considered high-value or high-risk. Certain controls must be fully implemented before assessment — there is no pathway to certification with open findings in those areas.
Treating the POA&M as a compliance roadmap rather than a liability document changes how organizations approach it. Each item should have a realistic resolution date, an assigned owner, and documented progress. Organizations that maintain a disciplined POA&M process tend to move through assessments more efficiently because they have already internalized the gap-to-resolution cycle before the assessor arrives.
Technical Controls That Frequently Create Assessment Risk
Several control families consistently produce findings during CMMC assessments, not because they are technically complex, but because they require coordination across departments that do not always communicate regularly. Access control, configuration management, audit and accountability, and media protection are areas where gaps between policy and practice tend to surface.
Access control failures often come from stale accounts — former employees, contractors, or vendors who retain system access after their relationship with the organization ends. Configuration management issues arise when systems are updated or modified without formal change control documentation. Audit logging failures occur when organizations have logging enabled but have never verified that logs are complete, retained appropriately, and reviewed on a defined schedule.
Incident Response Readiness as a Certification Requirement
Incident response is a required control domain under NIST SP 800-171, and it carries weight in CMMC assessments because it reflects operational maturity. Having a written incident response plan is not sufficient. The plan must be tested, and personnel responsible for executing it must be trained and aware of their roles. Tabletop exercises are the standard method for demonstrating that the plan is functional rather than theoretical.
Defense contractors in San Diego who have not conducted a documented incident response exercise within the past year should treat that as a near-term compliance task. Assessors look for evidence that the organization has actively rehearsed its response to a realistic scenario, not just that a plan document exists in a shared folder.
Vendor and Supply Chain Risk in the CMMC Context
CMMC compliance does not end at the boundary of a prime contractor’s internal systems. If controlled unclassified information is shared with subcontractors, suppliers, or managed service providers, those organizations must also meet the applicable CMMC requirements. This creates a supply chain compliance obligation that many San Diego contractors have not yet fully mapped.
The Office of the Under Secretary of Defense for Acquisition and Sustainment has made clear that CMMC requirements flow down through contracts. Prime contractors are responsible for ensuring their subcontractors meet the appropriate certification level before sharing CUI with them. That obligation requires prime contractors to ask for evidence of compliance, not simply rely on written assurances.
Managing Managed Service Providers Within the Compliance Boundary
Managed service providers present a particular challenge in CMMC compliance because they often sit inside the system boundary without being formally treated as part of it. If an MSP has privileged access to systems that process or store CUI, that MSP’s practices directly affect the contractor’s compliance posture. Their access controls, patching practices, logging configurations, and personnel screening all become relevant to the assessment.
Organizations working with external IT providers should review those relationships carefully before initiating their CMMC assessment. This includes reviewing contracts for security obligations, confirming that the MSP has implemented relevant controls, and ensuring that their access is logged and monitored. Where the MSP cannot demonstrate compliance, the contractor must either bring those controls in-house or select a provider capable of meeting the requirement.
Preparing for the Formal Third-Party Assessment
The C3PAO assessment is not an audit in the traditional financial sense. It is an operational evaluation of whether the organization’s security practices meet the NIST SP 800-171 requirements at the time of assessment. Preparation is practical, not procedural. The goal is to ensure that every required control is implemented, documented, and demonstrable before the assessor arrives.
Organizations that approach the assessment with incomplete documentation, undocumented configurations, or staff who cannot explain the security processes they are responsible for tend to generate findings that delay certification. Internal readiness reviews, sometimes called mock assessments or gap assessments, are a reliable way to identify and resolve those issues before the formal process begins.
• Confirm that all 110 NIST SP 800-171 controls have been assessed against the current environment and documented in the SSP
• Verify that high-priority controls identified as must-implement items are fully operational, not in a POA&M status
• Conduct a tabletop incident response exercise and retain documentation of the exercise and outcomes
• Review user access lists across all in-scope systems and remove or disable accounts that are no longer active or necessary
• Confirm that audit logging is enabled, retained for the required duration, and reviewed on a defined schedule
• Validate that subcontractors and MSPs with CUI access have documented compliance or that their access has been restricted pending resolution
• Ensure that all staff with access to CUI systems have completed security awareness training within the required timeframe
Closing Observations for San Diego Contractors in 2025
The CMMC program represents a structural shift in how the Department of Defense manages cybersecurity risk across its contractor base. The flexibility of self-assessment that existed in earlier frameworks is narrowing, and the documentation and third-party verification requirements are becoming a standard feature of contract qualification rather than an exceptional requirement.
For defense contractors in San Diego, the practical implication is that compliance preparation is a business continuity issue. Organizations that wait for contract language to force the issue will find themselves in compressed timelines, often with limited assessor availability and elevated costs for remediation work completed under deadline pressure.
The checklist outlined in this article is not exhaustive, but it reflects the areas where preparation gaps most commonly affect assessment outcomes. Organizations that have addressed their SSP quality, CUI boundary accuracy, technical control implementation, vendor obligations, and readiness for formal assessment are in a fundamentally stronger position — both for contract continuity and for the long-term security posture that the certification process is designed to establish.
CMMC compliance in 2025 is not a checkbox exercise. It is a documentation of how an organization actually manages the information it is entrusted with. That distinction matters, and it should inform how San Diego contractors approach every step of the process.
