Why CMMC Is Harder for General Contractors Than Anyone Wants to Admit

If you’re a general contractor working in the Defense Industrial Base, CMMC isn’t just another compliance requirement. It’s a direct challenge to how your business operates. Most guidance around CMMC assumes a company controls its own environment. Its own systems. Its own people. That’s not how construction works. The Real Problem: You Don’t Do Most […]

CMMC Level 1 Requires 17 Safeguards 15 Controls

The official FAR clause lists 15 safeguards, but CMMC documentation often references 17 practices. Here is why: 

CMMC inherited the DoD’s earlier mapping from the DFARS 252.204-21 “Basic Safeguarding” table, where two of the FAR requirements were split into multiple CMMC practice IDs during modeling. They are not additional requirements—just a structural carryover from the original DoD-to-NIST mapping exercise.