The 14 Control Families Every Subcontractor Must Review Before a CMMC Self-Assessment

Governs who can access CUI, on what systems, under what conditions, and through which pathways - including remote access and mobile devices. This is the most scrutinized family in any assessment because it touches almost every other control area.

Common gap

Least-privilege is documented on paper but not enforced in practice. Users accumulate permissions over time without periodic review, and remote access policies exist but are not technically enforced.

Requires that personnel with CUI access receive security awareness training and that individuals with elevated responsibilities receive role-based training commensurate with their duties.

Common gap

Training happened verbally at onboarding and was never recorded. No documentation of who received what training, when, or what it covered. A small family by requirement count but easy to score zero on without records.

Covers creation, protection, retention, and review of audit logs for systems that process or store CUI. Assessors will ask to see logs, confirm they are tamper-resistant, and verify that someone actually reviews them.

Common gap

Logging is enabled on the firewall and endpoints but logs are never reviewed and have no defined retention period. Log storage is on the same system being audited, which means logs could be altered.

Requires a documented baseline configuration for CUI systems and a process for controlling changes to that baseline. Unauthorized software must be identified and blocked or removed.

Common gap

No formal baseline has been documented. Software is installed by employees without going through an approval process, and there is no inventory of what is running on which system.

Covers unique identification of users and devices, multi-factor authentication for privileged and remote access, and password management. MFA requirements in this family are among the most commonly cited deficiencies across the DIB.

Common gap

MFA is enabled on email but not on the VPN or systems that directly store CUI. Shared service accounts exist. Password complexity rules are set in policy but not enforced by the system.

Requires an incident response capability: a documented plan, a process for handling incidents, and a mechanism for testing that plan. Under DFARS 252.204-7012, contractors must also report certain cyber incidents to DoD within 72 hours.

Common gap

An incident response plan was drafted but has never been tested or updated. The 72-hour DoD reporting requirement is either unknown or not reflected in the plan.

Controls how maintenance is performed on CUI systems, with specific requirements around remote maintenance tools, maintenance personnel who are not employees, and logging of maintenance activities.

Common gap

A third-party IT provider uses remote support tools to access CUI systems, but that access is not logged, is not reviewed after the session ends, and the tools remain persistently installed rather than being used on demand.

Covers protection, transport, and disposal of media that contains CUI - including portable drives, laptops, printed documents, and digital output. Sanitization requirements apply before media is reused, repurposed, or discarded.

Common gap

USB drives travel in and out of the building with no tracking or encryption. Paper documents containing CUI are placed in standard recycling bins rather than shredded, and there is no sanitization process for retired hard drives.

Requires screening individuals before granting access to CUI systems and revoking access upon termination or role change. Small by count, but a clean termination process is an area assessors frequently probe.

Common gap

No formal screening process is documented. More commonly, offboarding is inconsistent: departing employees retain active credentials for days after their last day because there is no termination checklist that ties access revocation to HR notification.

Requires physical access controls for facilities and systems that store or process CUI. This includes managing visitor access and maintaining physical access logs.

Common gap

Servers or workstations that hold CUI sit in an unlocked room accessible to all employees and visitors. There are no visitor logs, no escort requirements, and no record of who accessed the physical space.

Requires periodic risk assessments of CUI systems and regular vulnerability scanning. The output of this family feeds directly into your Plan of Action and Milestones (POA&M) and your SPRS score.

Common gap

No formal risk assessment has been conducted or documented. Vulnerability scans are either not running or their results are never acted on and connected back to a remediation plan.

Requires a System Security Plan (SSP), a plan of action and milestones for deficiencies, and periodic review of security controls. Your SSP is the document that defines the boundary of your CUI environment - without it, you cannot meaningfully self-assess anything else.

Common gap

An SSP was started but is incomplete, outdated, or does not accurately describe the current system boundary. There is no active POA&M that tracks open deficiencies and target remediation dates.

Covers network architecture, segmentation of CUI from other traffic, encryption of data in transit, and controls on external connections. Second only to Access Control in requirement count and scope.

Common gap

CUI flows across the same network as general business traffic with no segmentation. Email containing CUI is sent unencrypted. There is no documented boundary between the CUI environment and other systems or external connections.

Covers malware protection, security alerts, patch management, and monitoring of CUI systems for anomalous behavior. This family ties together several operational security practices that are often present but poorly documented.

Common gap

Antivirus is deployed but centralized monitoring of its status is absent, so infected endpoints go unnoticed. Patch management is informal, meaning critical patches are applied eventually but not within any defined window.