Awareness

CMMC Audit Readiness: 9 DFARS Risks Lazarus Alliance Finds

by CyberVisor 0 Comment
CMMC Audit Readiness: 9 DFARS Risks Lazarus Alliance Finds

CMMC audit readiness is not a paperwork exercise; it is an evidence integrity exercise.

Lazarus Alliance repeatedly finds that defense contractors can describe their security program, but struggle to prove that the right controls operate on every system that processes, stores, or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Under DFARS 252.204-7021, contractors must have and maintain the required CMMC status for applicable information systems, complete an annual affirmation of continuous compliance in SPRS for each applicable CMMC UID, and flow down applicable CMMC requirements to subcontractors eCFR, 48 CFR 252.204-7021.

The contrarian reality: most CMMC failures begin long before an assessor reviews a control. They begin when scope is vague, the System Security Plan is not evidence-backed, cloud inheritance is overstated, subcontractor obligations are not verified, or leadership signs an SPRS affirmation without a repeatable evidence basis. This article summarizes nine DFARS compliance and NIST 800-171 evidence risks Lazarus Alliance commonly helps defense contractors resolve before formal assessment activity.

CMMC Audit Readiness Starts With Evidence, Not Intent

CMMC audit readiness means the organization can prove that applicable cybersecurity requirements are implemented, operating, and governed for the systems in scope. The CMMC Program regulations define CMMC levels and assessment requirements for contractors and subcontractors that handle FCI and CUI eCFR, 32 CFR Part 170. DFARS 252.204-7012 requires contractors to provide adequate security for covered contractor information systems and to report cyber incidents affecting covered defense information or the contractor’s ability to provide operationally critical support eCFR, 48 CFR 252.204-7012.

For CUI environments, NIST SP 800-171 provides the core security requirement baseline for protecting controlled unclassified information in nonfederal systems and organizations NIST, SP 800-171 Rev. 3. NIST SP 800-171 is also closely related to NIST SP 800-53 because NIST maps security requirements to broader federal control concepts such as access control, audit and accountability, configuration management, incident response, and risk assessment NIST, SP 800-53 Rev. 5.

Lazarus Alliance’s CMMC audit readiness services and DFARS NIST 800-171 assessments focus on the practical question assessors ask: can the contractor demonstrate that the control is implemented for the assets, users, data flows, vendors, and security processes in scope?

Risk 1: CUI and FCI Scope Is Defined by Assumption Instead of Data Flow

The first DFARS compliance risk is a scope boundary based on organization charts rather than information flow. DFARS 252.204-7021 applies to information systems that process, store, or transmit FCI or CUI when the clause is included in the contract eCFR, 48 CFR 252.204-7021. NIST SP 800-171 applies to nonfederal systems and organizations that protect CUI NIST, SP 800-171 Rev. 3.

In readiness reviews, Lazarus Alliance often sees contractors scope only the engineering enclave while ignoring quoting systems, file-transfer tools, managed service provider access, backup repositories, print services, quality systems, or email workflows that contain CUI attachments. A common example is a manufacturer that stores drawings in a controlled file share but allows production planners to export the same drawings into an ERP work order. The file share is controlled; the ERP is not. The audit risk is not the ERP label; it is the unrecognized CUI path.

Readiness action: build a CUI/FCI data-flow map before finalizing the CMMC boundary. Identify data origin, storage, processing, transmission, privileged access, backup, logging, and disposal points. Tie every in-scope asset to an owner, business function, control inheritance source, and evidence repository.

Risk 2: SPRS Affirmation Is Treated as an Annual Checkbox

DFARS 252.204-7021 requires an annual affirmation of continuous compliance in SPRS for each applicable CMMC UID eCFR, 48 CFR 252.204-7021. DFARS 252.204-7019 requires a current NIST SP 800-171 DoD Assessment score to be posted in SPRS for covered contractor information systems when applicable solicitations or contracts require it eCFR, 48 CFR 252.204-7019. DFARS 252.204-7020 requires contractors to provide the Government access to facilities, systems, and personnel when the Government conducts or verifies an assessment eCFR, 48 CFR 252.204-7020.

The readiness failure occurs when the SPRS affirmation is signed without a contemporaneous evidence file. Leadership may believe that an old score, a remediation spreadsheet, or an unsigned SSP is enough. It is not enough if the contractor cannot show what changed, who approved the changes, which controls were retested, and what residual risk remains.

Readiness action: create an affirmation package that includes the current SSP, CUI boundary diagram, asset inventory, control test results, POA&M status, risk acceptance records, subcontractor status, and executive sign-off. Continuum GRC’s 2026 Audit Readiness Benchmark Report examines audit readiness practices across organizations preparing for evidence-driven compliance reviews.

Risk 3: The SSP Describes the Target State, Not the Operating State

NIST SP 800-171 requires organizations to describe how security requirements are implemented, and the SSP is the primary document that explains the system boundary, operating environment, implemented requirements, and relationships to other systems NIST, SP 800-171 Rev. 3. The CMMC Program regulations also tie assessment activity to the applicable CMMC level and the system environment in scope eCFR, 32 CFR Part 170.

Lazarus Alliance frequently finds SSP language that says, “The organization enforces MFA,” while evidence shows exceptions for service accounts, break-glass accounts, unmanaged VPN users, or legacy applications. Another common issue is inherited cloud control language copied from provider documentation without explaining what the contractor configures, monitors, or reviews. In a CMMC readiness context, inherited control claims must be traced to contracts, shared responsibility matrices, configuration evidence, and monitoring records.

Readiness action: rewrite each SSP control statement in three parts: what is implemented, where it is implemented, and what evidence proves operation. For example, access control should reference identity providers, privileged access groups, joiner-mover-leaver tickets, quarterly access reviews, MFA policies, conditional access rules, and exception approvals.

Risk 4: POA&Ms Are Used to Defer High-Risk Control Failures

A Plan of Action and Milestones is useful only when it is specific, owned, funded, and governed. NIST SP 800-171 includes security requirements across access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment and monitoring, system and communications protection, and system and information integrity NIST, SP 800-171 Rev. 3. DFARS 252.204-7021 requires maintaining the required CMMC status, not merely documenting intentions to improve eCFR, 48 CFR 252.204-7021.

The danger is POA&M inflation. Contractors list missing MFA coverage, incomplete logging, unencrypted backups, unmanaged local administrator accounts, and untested incident response under the same remediation label. Assessors and contracting stakeholders will look for whether remediation is credible and whether open items affect the required status.

Readiness action: rank POA&M items by CUI exposure, exploitability, dependency, and assessment impact. A strong remediation record includes the requirement, gap description, affected assets, root cause, compensating controls, owner, budget, milestone dates, validation method, and closure evidence.

Risk 5: Access Control Evidence Does Not Match the Identity Reality

Access control is one of the most evidence-intensive NIST 800-171 domains because it connects users, devices, sessions, applications, administrators, service accounts, and external providers. NIST SP 800-171 includes requirements for limiting system access to authorized users, processes acting on behalf of authorized users, and devices NIST, SP 800-171 Rev. 3. NIST SP 800-53 AC-2 addresses account management concepts such as account creation, modification, disabling, and review, which are commonly used to understand access governance expectations in federal control environments NIST, SP 800-53 Rev. 5.

Typical gaps include shared administrator accounts, stale contractor identities, orphaned accounts after terminations, unmanaged local admin membership, privileged accounts without stronger monitoring, and service accounts with interactive logon rights. In one readiness walkthrough, a contractor had documented quarterly access reviews, but the review population excluded engineering SaaS users who handled CUI exports. The control was operating, but not across the full CUI environment.

Readiness action: reconcile HR rosters, identity provider exports, privileged groups, VPN users, SaaS administrators, local administrators, and service accounts. Evidence should show provisioning approval, MFA enforcement, role-based authorization, periodic review, timely deprovisioning, and exception handling.

Risk 6: Audit Logs Exist, but Detection and Retention Are Unclear

NIST SP 800-171 includes audit and accountability requirements for creating, protecting, reviewing, and retaining system audit records to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity NIST, SP 800-171 Rev. 3. NIST SP 800-53 AU controls provide additional federal control context for audit event generation, review, protection, and retention NIST, SP 800-53 Rev. 5.

The most common misconception is that “we have logs” equals “we meet the requirement.” Lazarus Alliance looks for evidence that logs are generated for meaningful events, forwarded from in-scope systems, protected from unauthorized modification, reviewed according to risk, correlated for suspicious activity, and retained consistently. Contractors often have endpoint logs but no centralized evidence that VPN, identity provider, firewall, privileged access, cloud storage, EDR, and CUI application events are collected and reviewed.

Readiness action: define a minimum audit event standard for in-scope systems. Map each log source to owner, event types, collection method, alert use case, retention period, review cadence, and sample evidence. Test whether a disabled user, failed privileged login, mass file download, and denied firewall connection appear in monitoring evidence.

Risk 7: Configuration and Vulnerability Management Are Not Audit-Ready

NIST SP 800-171 includes configuration management and risk assessment requirements that support baseline configurations, change control, vulnerability identification, and remediation NIST, SP 800-171 Rev. 3. NIST SP 800-53 CM and RA controls provide federal control context for configuration baselines, configuration change control, flaw remediation, vulnerability monitoring, and risk response NIST, SP 800-53 Rev. 5.

Audit readiness breaks down when vulnerability scans are performed but not scoped to all CUI assets, when high-risk findings lack remediation evidence, or when exceptions are approved informally. A common scenario is a contractor that scans servers monthly but not engineering workstations because production downtime is feared. If those workstations process CUI, the gap is material.

Readiness action: maintain hardened build baselines for servers, workstations, network devices, cloud services, and security tools. Tie vulnerability findings to tickets, risk ratings, due dates, patch records, rescans, and documented exceptions. Use change records to prove that secure configurations are not overwritten during upgrades.

Risk 8: Incident Response Is Documented but Untested for DFARS Timelines

DFARS 252.204-7012 requires contractors to rapidly report cyber incidents to DoD when a cyber incident affects a covered contractor information system, covered defense information, or the contractor’s ability to provide operationally critical support eCFR, 48 CFR 252.204-7012. NIST SP 800-171 includes incident response requirements for establishing operational incident-handling capability, tracking incidents, reporting incidents, and testing the incident response capability NIST, SP 800-171 Rev. 3.

The readiness gap is rarely the absence of an incident response plan. It is the absence of proof that the plan works for CUI, DFARS reporting, forensic preservation, legal review, customer notification, cloud provider coordination, and subcontractor escalation. Tabletop exercises that discuss ransomware generically may not test whether the team can identify covered defense information, preserve images, collect logs, determine reporting obligations, and notify the right government portal contacts.

Readiness action: run a CUI-specific tabletop exercise. Include legal, contracts, IT, security, operations, executive leadership, communications, and subcontractor management. Capture scenario injects, decisions, timestamps, evidence requests, reporting analysis, lessons learned, and remediation actions.

Risk 9: Subcontractor Flow-Down Is Contractual, Not Verified

DFARS 252.204-7021 requires contractors to flow down applicable CMMC requirements to subcontractors when subcontractor systems process, store, or transmit FCI or CUI eCFR, 48 CFR 252.204-7021. DFARS 252.204-7012 also includes safeguarding and cyber incident reporting obligations that must be understood across the supply chain when covered defense information is involved eCFR, 48 CFR 252.204-7012.

Lazarus Alliance finds that many primes and higher-tier subcontractors have contract clauses in place but no operational verification. They cannot show which suppliers receive CUI, which systems those suppliers use, whether those suppliers have current assessment status, or whether incident notification obligations are tested. Supplier risk is also a cross-framework issue: NIST SP 800-53 includes supply chain risk management controls in the SR family, and those controls help organizations structure supplier oversight beyond contract language NIST, SP 800-53 Rev. 5.

Readiness action: maintain a CUI supplier register. For each subcontractor, record CUI/FCI access, contract clause applicability, CMMC level requirement, assessment status, SPRS-related evidence when applicable, data exchange method, incident notification contact, and annual review result. Continuum GRC’s Third-Party & Vendor Risk capabilities support structured supplier risk workflows and evidence tracking.

A Lazarus Alliance Evidence-Readiness Matrix for Defense Contractors

For practical CMMC audit readiness, Lazarus Alliance recommends a four-layer evidence-readiness matrix. First, scope evidence proves what is in and out of the CUI environment: contracts, data-flow diagrams, asset inventories, network diagrams, cloud services, users, and subcontractors. Second, implementation evidence proves the control exists: policies, procedures, configurations, screenshots, tickets, access rules, baselines, and tool exports. Third, operating evidence proves the control works over time: access reviews, log reviews, vulnerability rescans, incident exercises, backup tests, change approvals, and monitoring alerts. Fourth, governance evidence proves accountability: risk decisions, POA&M oversight, management review, internal audit results, supplier reviews, and SPRS affirmation records.

This matrix also helps organizations align CMMC with adjacent obligations. NIST 800-53 / FISMA assessments use federal control families and assessment procedures for information systems supporting federal programs Lazarus Alliance, NIST 800-53 / FISMA Audit Services. SOC 1 and SOC 2 reports focus on service organization control design and operating effectiveness for user-entity assurance Lazarus Alliance, SOC 1 & SOC 2 Services. PCI DSS applies to cardholder data environments, HIPAA applies to regulated electronic protected health information, CJIS applies to criminal justice information, IRS 1075 applies to federal tax information, and ISO 27001 provides an information security management system model; each framework has different scope rules, but all require reliable evidence management.

How to Prepare for a CMMC or DFARS NIST 800-171 Readiness Assessment

Start with a pre-assessment that tests evidence before the formal assessment clock creates pressure. A practical walkthrough should include the following steps:

  • Confirm contract drivers: identify DFARS clauses, CMMC level expectations, FCI/CUI handling, and subcontractor obligations using contract language and program guidance eCFR, 48 CFR 252.204-7021.
  • Validate the CUI boundary: trace CUI from receipt through storage, processing, transmission, backup, archive, and destruction.
  • Review the SSP: compare written control descriptions to actual configurations, tickets, logs, and operational practices.
  • Test evidence samples: select users, systems, incidents, vulnerabilities, changes, and suppliers to verify that evidence is complete and repeatable.
  • Challenge inherited controls: require shared responsibility documentation, tenant configuration evidence, and monitoring records for cloud and managed services.
  • Prepare leadership for affirmation: ensure executives understand the evidence basis for SPRS affirmation and residual risk.

The best readiness programs do not wait for a single assessment event. They operate as continuous compliance programs with control owners, evidence calendars, automated collection where appropriate, exception governance, and management review. The Continuum GRC platform supports IT and cybersecurity risk management workflows that help organizations centralize risks, controls, evidence, and remediation activity Continuum GRC, IT & Cybersecurity Risk.

Bottom Line: DFARS Compliance Requires Defensible Evidence

Defense contractors preparing for CMMC should not ask, “Do we have a policy?” The better question is, “Can we prove this control operates for every relevant CUI and FCI path, including subcontractors and inherited services?” DFARS compliance, NIST 800-171 implementation, SPRS affirmation, cybersecurity audits, compliance assessments, and risk management all converge on the same outcome: defensible evidence that withstands scrutiny.

Lazarus Alliance helps organizations identify control gaps, strengthen evidence, rationalize multi-framework obligations, prepare leadership for formal assertions, and build a sustainable readiness program before assessment pressure peaks.

Sources and References

About Lazarus Alliance

To learn more about how Lazarus Alliance can help, contact us.

Download our company brochure.

CyberVisor

Website: