CMMC Security Controls Small Businesses Often Miss

October 15, 2026 by Kioptrix Labs

CMMC control gaps

Small defense contractors rarely need a giant security stack to improve CMMC readiness. They need a tightly scoped environment, controls that actually work, and evidence showing those controls work repeatedly. The gaps that create trouble are often quieter than an unpatched server: incomplete MFA coverage, logs nobody reviews, undocumented configuration changes, unmanaged removable media, unclear CUI boundaries, weak incident procedures, or cloud providers whose responsibilities were never mapped.

There is also an important 2026 wrinkle. The Department suspended the planned CMMC Phase II rollout on July 13, 2026, so the transition to broader Level 2 third-party certification requirements scheduled for November 10, 2026 is currently paused. Phase I self-assessment requirements remain in place, and contractors handling covered defense information still have underlying DFARS safeguarding obligations. Check the current CMMC program status before acting on an older compliance timeline.

Your best first move is simple: identify exactly where FCI and CUI enter, travel, live, and leave your environment. Then map each applicable requirement to an owner, a technical or procedural implementation, and evidence. That exercise usually reveals more than buying another dashboard.

Table of Contents

CMMC control gaps

What CMMC Requires in September 2026

CMMC is currently paused in Phase I rather than cancelled. Under the Department’s current program description, Level 1 uses an annual self-assessment against the 15 safeguarding requirements associated with FAR 52.204-21. Level 2 self-assessment applies to the 110 requirements drawn from NIST SP 800-171 Revision 2, with the assessment performed every three years and an affirmation submitted annually thereafter.

Situation	Current CMMC Direction	What Matters Most
Environment handles FCI but not CUI	Level 1 self-assessment may apply	Implement all applicable basic safeguarding requirements and maintain annual assessment evidence
Environment processes, stores, or transmits CUI	Level 2 self-assessment may apply during the current Phase I pause	Implement and assess the 110 NIST SP 800-171 Rev. 2 requirements within the defined scope
Contractor was preparing for a Level 2 C3PAO assessment	Phase II transition is suspended	Do not abandon remediation; verify the current solicitation, contract, and CMMC program status

A second source of confusion is the NIST revision number. NIST has superseded SP 800-171 Revision 2 with Revision 3, but the current CMMC program continues to assess against Revision 2 pending future rulemaking. For CMMC preparation, follow the requirement actually incorporated into the current program and contract rather than silently replacing it with the newer publication. NIST’s archived SP 800-171 Revision 2 publication remains useful for that purpose.

The First Control Problem Is Usually the Boundary

Before worrying about individual controls, determine what is actually inside the assessment scope. A company with ten employees can create an unnecessarily large CMMC problem if CUI drifts through ordinary email, personal devices, unmanaged printers, collaboration platforms, file shares, backup systems, and vendor portals.

Conversely, a carefully designed enclave can reduce the number of systems requiring the full Level 2 treatment. The trick is that the boundary must reflect reality, not the diagram you hoped employees would follow.

The official CMMC Level 2 Scoping Guide requires organizations to identify relevant asset categories, maintain an asset inventory, document treatment in the system security plan, and provide a network diagram for the assessment scope. It also makes an easily missed point: security protection assets can enter scope even when they do not themselves process CUI. A SIEM or external security provider handling security protection data is a classic example.

Run a CUI flow check before buying anything

Where does CUI first arrive?
Which users can open, edit, download, print, or forward it?
Which endpoints can process it?
Which servers, storage systems, backups, and SaaS platforms retain it?
Which security products collect logs or configuration data from those systems?
Can CUI reach removable media, printers, personal devices, or ordinary corporate email?
Which subcontractors or service providers receive either CUI or security protection data?

If those questions produce vague answers, fix the boundary before debating expensive compliance software. A smaller environment with a defensible data flow is usually easier to secure, document, assess, and operate.

CMMC Control Gaps That Are Easy to Under-Implement

The following is a practical shortlist, not an official ranking of failed assessments. These areas deserve attention because a control can look present on paper while still failing one or more assessment objectives.

Control Area	Weak Implementation	Better Verification
MFA	MFA enabled for Microsoft 365 but not every applicable privileged or network-access path	Test each applicable access path and account type
Least privilege	Everyone is local admin because it is convenient	Map privileged roles and review actual assignments
Audit logging	Logs exist somewhere	Show collection, review, retention, time synchronization, and follow-up
Configuration management	Systems were hardened once	Maintain baselines and approved change records
Cryptography	Product documentation says “encrypted”	Verify the cryptographic implementation required for CUI protection
Media	USB use is discouraged verbally	Enforce and document media restrictions and sanitization
Incident response	Call the IT person if something happens	Document reporting, preservation, roles, and exercises
External providers	Assume the vendor owns compliance	Map shared responsibilities and evidence

CMMC control gaps

Enabling MFA for the primary cloud productivity account is useful, but that alone does not demonstrate the Level 2 MFA requirement. The applicable requirement covers local and network access to privileged accounts and network access to non-privileged accounts.

The official CMMC Level 2 Assessment Guide breaks MFA into separate assessment objectives, which is why forgotten administrative paths matter.

Domain administrator access
Local administrator accounts
VPN and remote-access gateways
Cloud administration consoles
Privileged infrastructure accounts
Ordinary user network access where the requirement applies
Legacy systems that quietly bypass the normal identity provider

Verification rule: do not ask, “Do we have MFA?” Ask, “Which authentication paths in the CMMC scope can still succeed with one factor?”

2. Privileged access that grew organically

Small companies often accumulate privilege for sensible short-term reasons: the engineer needed to install a driver, the owner needed emergency access, or the bookkeeper inherited an old administrative role. Months later, those exceptions have become the access model.

Least privilege is not demonstrated by having an administrator group. You need to know who has privileged access, why they need it, which systems it applies to, and whether access is removed when the business need ends.

A useful test is to export privileged memberships from the identity platform and compare them with job responsibilities. Every unexplained administrator is either an access-control decision waiting to be documented or a privilege waiting to be removed.

3. Audit logs that are enabled but operationally invisible

Turning logging on is only the first layer. A defensible audit capability also needs to produce useful records, associate activity with users or processes, protect those records, support investigation, and fit the organization’s review process.

A tiny company does not necessarily need an enterprise SOC. It does need an answer to four questions: what events are collected, where the logs go, who checks them, and what happens when something suspicious appears.

Weak evidence: a screenshot showing that logging is enabled.

Stronger evidence: configuration showing relevant sources, sample retained events, documented review responsibility, alerts or review records, and evidence that suspicious activity is followed up.

4. Configuration management without a baseline

A laptop can be securely configured today and drift next month. That is why configuration management is more than initial hardening.

Define what an approved workstation, server, firewall, cloud tenant, and other scoped system should look like. Then maintain a process for approving meaningful changes and identifying unauthorized ones.

Operating-system security settings
Approved software
Administrative services
Firewall rules
Remote-access settings
Endpoint protection configuration
Cloud security settings
Documented exceptions

A spreadsheet can be enough for a small environment if it is accurate and maintained. A sophisticated configuration platform with stale data is simply a more expensive form of uncertainty.

5. “Encryption enabled” without validating the implementation

Encryption is another place where product marketing and compliance evidence can drift apart. NIST SP 800-171 Rev. 2 requirement 3.13.11 calls for FIPS-validated cryptography when cryptography is used to protect the confidentiality of CUI.

That makes “supports AES-256” an incomplete answer. The relevant question is whether the deployed cryptographic module and configuration satisfy the requirement in the way your architecture relies on them.

Check encryption at rest, encryption in transit, VPNs, removable media, endpoint disk encryption, and any application-level protection included in the CUI flow. Record product versions and configurations rather than preserving only a vendor marketing page.

6. Removable media and paper treated as an afterthought

CUI does not stop being sensitive because it moved from a server to a USB device or printer tray. Media protection can quietly widen the operational burden of a supposedly small enclave.

Decide whether removable media is permitted at all.
If permitted, control which media can be used.
Protect CUI stored on authorized media.
Track storage and transport expectations.
Define sanitization or destruction procedures before reuse or disposal.
Include printed material in physical handling procedures.

For very small companies, disabling unnecessary removable-media paths can be easier than building an elaborate exception process around them.

7. Incident response that begins after the incident

An incident plan written only after suspicious activity appears is too late. The people involved need to know who decides whether an event is reportable, who preserves evidence, who contacts leadership, and who handles contractual reporting.

For contracts containing DFARS 252.204-7012, a qualifying cyber incident affecting a covered contractor information system or covered defense information triggers rapid reporting requirements. The clause defines rapid reporting as within 72 hours of discovery and also requires preservation and protection of identified affected system images and relevant monitoring or packet-capture data for at least 90 days after the report. Review the actual DFARS 252.204-7012 clause rather than relying on a generic incident-response template.

A ten-minute tabletop exercise can expose surprising gaps: nobody has access to the reporting account, backups overwrite useful forensic data, log retention is too short, or only one employee knows where the incident procedure lives.

8. External providers without a responsibility map

Outsourcing IT does not outsource accountability. Managed service providers, cloud services, backup vendors, security monitoring platforms, identity systems, and other external services can participate in protecting the assessed environment.

Document which requirements are implemented by the provider, which remain yours, and what evidence demonstrates each side of the boundary. A customer responsibility matrix or equivalent mapping is far more useful than the sentence “our MSP handles security.”

Cloud services require additional care. DFARS 252.204-7012 contains specific conditions when an external cloud service provider stores, processes, or transmits covered defense information, including security requirements equivalent to FedRAMP Moderate and contractual incident-handling obligations. That is a contract requirement, not a generic recommendation.

Evidence Is Part of the Control

A policy can describe what should happen without proving what does happen. CMMC assessment procedures can involve examining artifacts, interviewing responsible people, and testing mechanisms. Small businesses should therefore build evidence while operating the controls rather than attempting to reconstruct months of activity before an assessment.

Requirement Area	Useful Evidence	Warning Sign
Access control	User and privilege exports, approval records, termination records	Accounts cannot be tied to owners
MFA	Identity configuration plus tested access paths	Only one SaaS screenshot
Logging	Log-source inventory, retained events, reviews, alerts	No owner reviews events
Configuration	Approved baselines and change records	Settings exist only in an administrator’s memory
Media	Policy, technical restrictions, disposal or sanitization records	Untracked USB use
Incident response	Plan, contacts, tabletop record, reporting procedure	No one has tested the process
External services	Contracts, responsibility matrix, provider evidence	“Vendor is compliant” used as the entire explanation

The useful mental model is:

Requirement → implementation → owner → evidence → recurring verification.

If any requirement stops after “implementation,” you have found a documentation or operational risk worth checking.

Do Not Buy Your Way Around a Scope Problem

CMMC does not require a particular compliance platform, SIEM, endpoint product, consultant, or MSP. Tools can reduce labor, but they cannot repair an undefined boundary or decide what evidence your organization cannot explain.

DIY is reasonable when

the environment is genuinely small;
CUI flow is simple and well understood;
internal IT expertise is adequate;
evidence can be maintained manually;
the applicable contractual requirements are clear.

Software starts earning its cost when

evidence collection is becoming repetitive;
endpoint or identity configuration needs continuous checking;
logs are spread across systems;
manual inventories become unreliable;
multiple owners need a shared control and evidence workflow.

Professional help becomes more defensible when

you cannot confidently define the CUI boundary;
an important contract depends on the assessment result;
several controls remain partially implemented;
cloud or external-provider scope is difficult to interpret;
your SSP does not match the real environment;
you need independent readiness validation rather than another self-check.

If you hire outside help, ask for a control-by-control deliverable showing the requirement, current state, evidence reviewed, gap, responsible owner, and remediation action. A colorful maturity score without that mapping is difficult to operate after the consultant leaves.

A Small-Business CMMC Evidence Map

You do not need hundreds of disconnected screenshots. You need evidence that answers a predictable chain of questions.

Scope: What systems, users, facilities, providers, and data flows are included?
Requirement: What exact CMMC or NIST requirement applies?
Implementation: What technical or procedural mechanism satisfies it?
Ownership: Who operates and maintains the mechanism?
Evidence: What artifact demonstrates implementation?
Frequency: What must recur daily, monthly, quarterly, annually, or when an event occurs?
Exception: What happens when the expected control cannot operate normally?

This map is also a useful antidote to compliance theater. If a control cannot be tied to an actual asset, owner, action, or artifact, it may be a paragraph in a policy rather than an operating safeguard.

CMMC control gaps

Frequently Asked Questions

Does the 2026 Phase II suspension mean small businesses can stop CMMC work?

No. The suspension affects the planned transition to Phase II requirements, not every cybersecurity obligation associated with defense contracting. Phase I self-assessment requirements remain, and contracts containing DFARS 252.204-7012 still impose safeguarding obligations. Verify the current solicitation and contract before changing your compliance plan.

Can a small CUI enclave reduce CMMC scope?

Potentially. Keeping CUI inside a deliberately restricted environment can reduce the number of CUI assets, but connections, security protection assets, external providers, printers, backup systems, and other supporting components can still affect scope. The enclave works only if real data flows match its intended boundary.

Can every Level 2 deficiency be placed on a POA&M?

No. CMMC restricts which Level 2 deficiencies can be deferred. Under the current framework, Conditional Level 2 requires the applicable minimum score of 88 out of 110, eligible remaining items must meet the POA&M rules, and the POA&M must be closed within 180 days. Treat a POA&M as limited remediation flexibility rather than permission to postpone core security work.

Does a small company need a CMMC compliance platform?

Not automatically. A well-maintained spreadsheet, document repository, identity platform, endpoint tooling, and existing logging environment may be enough for a tightly scoped organization. Software becomes more valuable when manual evidence collection, asset tracking, control ownership, and recurring verification stop being reliable.

Run This 15-Minute CMMC Check Today

Pick one current defense contract and answer these questions without asking someone to “look into it later.”

Does the contract involve FCI, CUI, or both?
Can you draw the actual CUI data flow from entry to deletion?
Do you have a current inventory of assets inside that boundary?
Can every applicable privileged and network-access path satisfy the MFA requirement?
Can you show who has administrative access and why?
Can you produce recent logs and evidence that someone reviews them?
Can you identify every external provider that handles CUI or security protection data?
Can the person responsible for incidents explain the reporting and evidence-preservation workflow without opening a policy document?
Does the SSP describe the environment you operate today rather than the environment you intended to build?

If two or three answers are uncertain, do not start with another security purchase. Start with the uncertain boundary, assign an owner, gather the missing evidence, and test the control. CMMC becomes far more manageable when each requirement is attached to something concrete instead of floating in a compliance spreadsheet.

Last reviewed: 2026-10