CMMC Level 2 program leadership
A CMMC program that moves from jobsite to jobsite.
Defense construction contractors
CMMC for contractors building on military facilities.
When facility drawings come to you marked CUI, they do not stay in the office. They go to the plan room, the superintendent's tablet, the trailer and every trade on the job, and your obligations go with them. Capital Cyber, based in Leesburg, Virginia, leads CMMC Level 2 work for defense construction contractors and works on-site across Northern Virginia.
For general contractors, design-build firms and specialty trades on military construction and facilities work.
Where does CUI show up?
CUI AND FCIFacility drawings and specifications, when marked
Not every drawing on a military project is CUI, and you should not assume either way. When a drawing set or specification arrives marked, it is. The CUI Registry includes categories for physical security of federal facilities and for DoD critical infrastructure security information, including site-specific information relating to installation security.
Security-related building systems details
Access control layouts, intrusion detection and camera placement, communications room details and the door hardware schedules that go with them. These are the sheets most likely to carry markings, and they are the ones your low-voltage and security trades need most.
Submittals, shop drawings and RFIs
A shop drawing that reproduces a marked detail carries the marking with it. So does an RFI with a marked sheet attached, or a submittal package built from one. CUI multiplies through the submittal process if nobody is watching.
Printed plan sets
DFARS 252.204-7012 defines media to include printouts. A marked plan set on the trailer's layout table is CUI on paper, with the same need for control as the file it was printed from.
Contract and bid information
Non-public contract details, schedules and project information generated for the government are Federal Contract Information even when nothing is marked CUI. That alone brings FAR 52.204-21 and its 15 basic safeguarding requirements.
Where does scoping get hard?
SCOPINGJobsites that exist for a year and then disappear
A temporary trailer with its own internet connection, a plotter and a shared laptop is part of your environment for the life of the project. The SSP has to cover a site that did not exist when the plan was written and will not exist after closeout.
Tablets and superintendents' phones
Field teams view drawings on tablets and phones, often personal ones. AC.L2-3.1.18 asks you to control which mobile devices connect, and AC.L2-3.1.19 asks you to encrypt CUI on them. A personal phone with the plan app logged in is a mobile device holding CUI.
Project management and plan-sharing platforms
Construction runs on cloud platforms for drawings, RFIs and submittals. If marked drawings are uploaded to one, DFARS 252.204-7012 requires that the provider meet security requirements equivalent to the FedRAMP Moderate baseline. Many platforms built for the commercial market have not been checked against that.
Many trades, each with its own systems
Every trade that receives marked drawings is a subcontractor with covered defense information, and the clause flows down to them. Electrical, mechanical, low-voltage and security integrators each have their own laptops, email and printers.
Plotters, printers and the plan room
Large-format printers store jobs, plan rooms hold stacks of sets, and old sets get thrown in a dumpster at closeout. Each step is a media protection question, from marking to storage to disposal.
Are the drawings on a military project CUI?
Some are, many are not, and the marking decides. Under DFARS 252.204-7012, covered defense information includes what DoD marks or identifies in the contract and provides to you, and what you develop or receive in performing it. When a drawing or specification arrives marked CUI, treat every copy and every derivative as CUI. When it arrives unmarked, it may still be Federal Contract Information, which carries its own, smaller set of requirements.
The sheets most often marked are the ones about security: access control, intrusion detection, communications and site details that would help someone defeat the facility's protection. If a set is unclear, ask the contracting officer in writing rather than deciding on the jobsite.
Where do the drawings go after they leave the office?
Everywhere the work goes. Estimators download the set, project managers upload it to the platform, superintendents open it on tablets, foremen print pages in the trailer, and trades pull their sheets into their own systems. Each of those is a place CUI is processed, stored or transmitted.
Scoping a construction contractor means following that path for each project and deciding where CUI is allowed to go. The answer is rarely nowhere, because the people building the facility need the drawings. It is usually fewer places, with controls that work on a jobsite.
What do assessors look for on paper?
The physical side of media protection. Where printed marked sets are kept, who can reach them, whether they carry their markings, how they travel to the site and back, and how they are destroyed when a revision supersedes them or the job closes out.
Sanitizing or destroying media containing contract information before disposal is required even at Level 1. A shred bin in the trailer and a log of destroyed sets is simple evidence that is easy to forget to create.
How does flow-down work with a dozen trades?
DFARS 252.204-7012 requires you to include the clause, without alteration except to identify the parties, in subcontracts that involve covered defense information. Under DFARS 252.204-7021, before awarding a subcontract you are to confirm the sub has a current CMMC status appropriate for the information flowed down.
In practice that means sorting trades by what they receive. A security integrator receiving marked access control drawings is in a different position from a paving sub who only needs the civil sheets. The sorting is worth doing before bids go out, not after award.
Which clauses will you see?
DFARS AND FARFAR 52.204-21
Fifteen basic safeguarding requirements for any of your systems holding non-public contract information, flowed down to subs who will hold it.
DFARS 252.204-7012
NIST SP 800-171 on systems holding marked drawings and other covered defense information, FedRAMP Moderate equivalent for plan-sharing platforms that hold them, 72-hour incident reporting, and flow-down to trades that receive them.
DFARS 252.204-7019 and 252.204-7020
A current NIST SP 800-171 assessment score in SPRS for each covered system relevant to the offer, and access for DoD if it chooses to assess further.
DFARS 252.204-7021
The CMMC clause: the level and assessment type the contract requires, an affirmation by a senior official, and a check that each sub receiving FCI or CUI holds a current status appropriate to what it receives.
What can we do for defense construction contractors?
SCOPED PER CLIENTSystem Security Plan, policy and POA&M
An SSP that covers sites that do not exist yet.
CUI enclave design
A plan room for marked drawings, in one place.
Supply Chain Risk Management
Which trades get the marked sheets, and what they owe.
Fractional CISO
A part-time CISO for a construction company.
CMMC Level 2 gap assessment
Where most of these start: all 110 requirements scored against your environment. $5,000, one time, for most small and mid-sized contractors.
Or let us run it inside an environment we provide: CMMC In A Container™.
Where do we work on-site?
Capital Cyber Compliance is based in Leesburg, Virginia, and works on-site across Northern Virginia, including:
Questions we hear
Is every drawing on a military construction project CUI?
No. Treat drawings as CUI when they are marked or identified as CUI in the contract. Unmarked project information may still be Federal Contract Information, which brings FAR 52.204-21. When markings are unclear, ask the contracting officer in writing.
Does a temporary jobsite trailer have to be in our SSP?
If CUI is viewed, printed or stored there, yes. The trailer's network, laptops, printers and plan storage are part of your environment for the life of the project, and the SSP should describe how temporary sites are set up and closed out.
Can we keep using our plan-sharing platform for marked drawings?
Only if the provider meets security requirements equivalent to the FedRAMP Moderate baseline and the incident reporting obligations in DFARS 252.204-7012. Check the provider's documentation before uploading marked sets, and keep a record of what you found.
Do our trades need their own CMMC assessments?
Trades that receive FCI or CUI carry the flowed-down clauses and assess their own systems. A trade that only receives unmarked, public-facing information may not. Sort subs by what they actually receive.
Can you certify us?
No. We are not an Authorized C3PAO and we do not certify anyone. We help you scope, document and prepare for whichever assessment your contract requires, starting with a gap assessment.
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Ready to see where you actually stand?
A CMMC Level 2 gap assessment scores all 110 requirements against your real environment. Tell us what you make or deliver and we will tell you where to start.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.