Learn about CMMC applicability to foreign-owned or internationally based contractors, security breach during a C3PAO assessment, failed certifications, and more, through the Frequently Asked Questions (FAQs) below. If you are looking for certified CMMC Professionals and a customized solution for your organization, please schedule a free consultation.
Table of Contents
How does CMMC certification apply to companies that only have one or two DoD contracts?
Summary: Defense contractors with only one or two DoD contracts are subject to the same CMMC requirements as larger contractors, the obligation is determined by whether their specific contracts include a CMMC level requirement under DFARS 252.204-7021, not by the number of contracts they hold.
For a small contractor with one or two DoD contracts, the practical implications are significant: the compliance cost is not amortized across a large portfolio of government work. A single DoD contract worth $300,000 annually may not justify $100,000 or more in CMMC Level 2 certification investment. Such contractors must evaluate whether their defense business is worth the compliance investment, and if not, whether they can restructure their scope to exclude CUI handling, find a prime contractor willing to absorb CUI into their own systems, or exit the DoD market.
For contractors whose single contract is with a prime rather than directly with the DoD, the CMMC level required flows from the prime, the contractor should contact the prime to understand whether CUI will be flowed to them and at what CMMC level. Some single-contract small businesses find that engaging with an MSP providing a managed CMMC-compliant enclave as a service is the most cost-effective path, as it converts certification investment into a predictable monthly subscription cost.
How does CMMC certification apply to foreign-owned or internationally based contractors?
Summary: Foreign-owned and internationally based defense contractors performing under DoD contracts are subject to CMMC certification requirements under DFARS 252.204-7021 if their systems process, store, or transmit FCI or CUI, there is no geographic or nationality exemption from CMMC, and foreign contractors must achieve the same certification level as domestic contractors.
The Cyber AB has confirmed that foreign contractors may work with either U.S.-based or foreign-based C3PAOs holding current Cyber AB authorization. As of early 2026, the Cyber AB is developing guidance for international certification pathways, but the fundamental certification requirements are identical.
Foreign contractors face additional considerations: Foreign Ownership, Control, or Influence (FOCI) reviews may affect how their IT systems can be configured to meet CMMC requirements, particularly for highly sensitive CUI categories. Some foreign contractors with significant DoD business have established U.S.-based subsidiaries with segregated IT environments specifically to contain their CMMC compliance scope to the U.S. entity. ITAR and export control restrictions may also affect which personnel, regardless of nationality, can access CUI in the contractor’s environment. Foreign contractors subject to CMMC should engage legal counsel familiar with both CMMC and export control regulations, as the intersection of FOCI, ITAR, and CMMC creates compliance complexity requiring expert guidance.
What should an organization do if a security breach or incident is discovered during an active C3PAO assessment?
Summary: If a security breach or cyber incident involving CUI is discovered during an active C3PAO assessment, the organization must immediately initiate its incident response plan, containing the incident, preserving evidence, and notifying the DoD within 72 hours via DIBNet as required under its DoD contract, while also notifying the C3PAO assessment team of the situation.
The discovery of an active incident during assessment creates a dual obligation: the contractual cyber incident reporting requirement does not pause for an assessment in progress, and the 72-hour reporting clock begins from the moment of discovery regardless of whether a C3PAO is on-site. The C3PAO must be informed because an active incident may affect the integrity of the assessment, systems under active compromise cannot be assessed as fully implemented, and the C3PAO has an obligation to reflect the actual security state in their findings.
In most cases, the C3PAO will pause assessment activities for affected systems until the incident is contained and the environment is verified clean. The incident will almost certainly generate NOT MET findings for the Incident Response domain if the contractor’s response reveals gaps in the IR plan or detection capabilities. Following containment and recovery, the assessment can typically resume, though the C3PAO may require additional evidence of recovery and control restoration for affected systems. The contractor’s incident response documentation from the event itself becomes evidence for IR domain assessment objectives.
What happens if a C3PAO assessment results in a failed certification, can you appeal or engage a different C3PAO?
Summary: If a CMMC Level 2 C3PAO assessment results in a failed certification, because one or more 3-point or 5-point controls are NOT MET, or the total SPRS score falls below 88, the organization can remediate all identified deficiencies and undergo a new complete assessment, which may be conducted by the same C3PAO or by a different authorized C3PAO.
There is no formal appeal mechanism within the CMMC program for contesting C3PAO assessment findings on technical grounds, if the C3PAO documents evidence based NOT MET determinations, those findings stand. However, if an organization believes a finding was made in error, based on misapplication of the assessment methodology, failure to credit evidence that was provided, or procedural error, they can raise the concern with the C3PAO for reconsideration during the findings reconciliation process before the Final Findings Briefing. If the concern is not resolved, the organization can raise it with the Cyber AB if there is evidence of assessment methodology violation or conduct issue.
Engaging a different C3PAO for a reassessment is permitted, there is no requirement to use the same C3PAO. The organization must fully implement and verify all previously failed controls before scheduling any reassessment, as a new C3PAO conducts a fresh evaluation of all 320 assessment objectives. Assessment fees for a failed assessment are typically non-refundable.
How does CMMC certification interact with existing DCAA or DCMA audit requirements?
Summary: CMMC certification and DCAA (Defense Contract Audit Agency) or DCMA (Defense Contract Management Agency) audit requirements are parallel, non-duplicative compliance obligations, achieving CMMC certification does not satisfy DCAA financial audit requirements, and DCAA audit approval does not satisfy CMMC cybersecurity requirements.
DCAA audits focus on accounting system adequacy, cost allowability, and contract cost compliance, they evaluate financial controls and cost accounting practices, not cybersecurity posture. DCMA oversight focuses on contract performance, quality assurance, and supply chain management. Neither agency conducts or validates CMMC certification.
There are practical intersections: DCAA auditors evaluating contract costs may examine whether CMMC-related costs are properly classified and documented as allowable; DCMA’s DIBCAC conducts the CMMC Level 3 government assessments; and DCMA contracting officers are responsible for including CMMC clauses in applicable contracts and verifying contractor CMMC status in SPRS before awarding contracts or approving option period exercises. Organizations subject to all three compliance requirements should maintain clear documentation that separates each compliance domain while ensuring their accounting system properly captures CMMC costs for both FAR Part 31 allowability purposes and contract pricing transparency.
Explore Blogs, Webinars and other Resources
Trusted by Reputed Companies
Accreditations and Associations
* Disclaimer: This list of accreditations is held by our team of employees and consultants.
What Our Clients Say
We used databrackets (formerly EHR 2.0) in our small medical practice for our risk analysis assessment to be in compliance with meaningful use. Their response was fast, the final report is detailed but simple and easy to follow. They were always available to answer our questions.
E. Compres
Pulmonary and Sleep Center of the Valley
I never miss the opportunity to learn something new …that’s why I am always registering to all free seminars offered on the web. databrackets (formerly EHR 2.0) happened to be the friendliest, comprehensive and up-to- date source of HIPAA Privacy and Security updates.
Alexandra V.
Community Healthcare Network
Today’s presentation was great! Thank you for sending the slides. My only feedback is that it would be fabulous to have the slides ahead of time so I could print them and take notes on the slides.Thanks for your time and knowledge today!
T.B., PM
Community Health Network
Particularly interesting was the flow chart on Administrative Simplification. I utilize all of the Security subcategories you list under the Security tile and appreciate knowing that I am hitting all of the relevant topics during my employee training.
Jessica B.
JD, CHC
I have re-worked our original risk assessment….We are using databrackets' (formerly EHR 2.0) Meaningful Use Security Risk Analysis Toolkit and it meets our needs. It was easy to use and I believe that it very beneficial to our meeting meaningful use.
Bill Curtis
Neurosurgical Associates Of Texarkana, TX
Information (webinars) presented by databrackets (formerly EHR 2.0) highlights some of today’s most demanding healthcare topics. The webinars help to direct those operating in today’s rapidly changing environment in the right direction.
Candace M.
Privacy and Security Officer, Springhill Medical Center
Our Growing List of Credentials
0
+
Assessments
0
+
Clients
0
+
Assessment Libraries
0
+
Years of Experience
0
+
No. of Staff Trained
0
+
HIPAA
0
+
SOC 2 Readiness
0
+
Pen Testing
0
+
ISO 27001 Certifications
0
+
Dollars Saved in Compliance Penalties