CMMC for a 5-Person Company vs. an Enterprise: Scoping

“We’re only five people. Surely it’s different for us.” It’s a fair question for a small defense contractor to ask, and the honest answer is: the requirements aren’t different at all. The scope is. And for a small company, scope is where most of the work, and most of the savings, actually sit.

The requirements don’t shrink

The CMMC rule is unusually direct on this. “The requirements necessary to protect a single document are the same as to protect many documents,” and they apply “regardless of the number of computers or components” (89 FR 83152). DoD says it “must enforce CMMC requirements uniformly for all defense contractors and subcontractors, regardless of size” (89 FR 83118), and it “declined to implement a small entity specific ‘phased compliance’” (89 FR 83151).

So a five-person machine shop with CUI drawings and a prime with thousands of employees answer the same 110 requirements of NIST SP 800-171 Revision 2. What the rule does give smaller firms is choice about the assessment: Level 1 is always a self-assessment, and DoD expected that “many contracts with CUI will only require a Level 2 self-assessment” (89 FR 83151). During the current Phase 2 pause, that’s every new contract.

What does shrink is the scope

The requirements apply to your CMMC Assessment Scope, which “must be specified prior to assessment” (32 CFR § 170.19(a)(1)), and the assessment team’s Lead CCA then has to validate it before the assessment moves on (CMMC Assessment Process v2.0, 1.3–1.4). The rule sorts every asset into CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, or out of scope; we walk through those categories in enclave vs. enterprise.

Size changes how those categories fill up, and who’s accountable for each. Here’s the same set of questions answered by two illustrative organizations:

The five-person company

Its scope can be genuinely small. A small firm that keeps CUI in one cloud service can end up with a compact boundary: the tenant, the devices that reach it, and the tools that protect them. The cloud provider has to meet the FedRAMP Moderate baseline or equivalent under DFARS 252.204-7012, and its customer responsibility matrix has to be documented or referred to in your SSP (§ 170.17(c)(5)).

But the cloud doesn’t make it compliant. Your own infrastructure that connects to the service “is part of the CMMC Assessment Scope” (§ 170.17(c)(5)(ii)). Assessors check that the specific service in your SSP is listed on the FedRAMP Marketplace, and they “should also employ the examine and test methods when evaluating the inheritance claims” in the responsibility matrix (CAP 2.18, 2.20). Inheriting a control means showing that the part you’re responsible for is done.

The MSP is in the picture. DoD’s cost model assumes “small entities are likely to outsource IT and cybersecurity to an External Service Provider” (89 FR 83179). If yours manages your security tools, its services sit in your scope, which we cover in Is my MSP CMMC compliant?.

Some requirements feel built for bigger companies, and still apply. Separation of duties (AC.L2-3.1.4) is NIST’s example of “ensuring that security personnel administering access control functions do not also administer audit functions,” and there’s no headcount below which it stops applying. With five people, the work is showing how duties are divided among the people you have, and the provider where it runs functions for you. Physical protection works the same way: NIST’s discussion of alternate work sites (PE.L2-3.10.6) notes they “may include… the private residences of employees,” and lets you define different requirements by type of site. If anyone handles CUI from home, home offices belong in your plan.

The paperwork doesn’t shrink either

A small scope means fewer assets, not lighter documentation. For every in-scope category, the rule asks you to record the asset in the asset inventory, in the SSP and on the network diagram (§ 170.19, Table 3). Contractor Risk Managed Assets aren’t assessed against the other requirements if they’re “sufficiently documented,” though an assessor can still do a limited check. Specialized Assets, such as test equipment or a CNC controller on the shop floor, have to be shown to be “managed using the contractor’s risk-based security policies.” And for anything you call out of scope, you have to be prepared to justify why it can’t process, store or transmit CUI.

In a five-person company, the asset inventory might fit on a page. It still has to exist, match the SSP, and match what an assessor sees on the network.

The enterprise

Its choice is enterprise or enclave. DoD lets a contractor certify “its entire enterprise network or an enclave(s)” (89 FR 83167), and even “structure its environment to meet differing CMMC requirements” across contracts (89 FR 83118). An enclave narrows what’s assessed, but it pulls in the shared services that protect it.

Inheritance needs care. “There is no established metric for inherited implementations from an enterprise to any defined enclaves,” and if anything inside the enclave “would invalidate an implementation at the Enterprise level, that requirement cannot be inherited” (89 FR 83141). For example, a group-wide password policy can be inherited only if no system in the enclave overrides it.

More systems mean more records. One assessment can cover several CAGE codes when they share one scope (CAP P.6), but “for each new information system used to support a DoD contract with FCI or CUI, a new SPRS entry is required” (89 FR 83134). A large organization can end up managing several scopes, each with its own dates.

What DoD’s own numbers say about size

When DoD estimated the cost of Level 2 assessments, size made less difference than people expect. For a C3PAO assessment over three years, including the affirmations, its estimates were:

Two caveats keep those numbers honest. They cover the assessment and affirmations, not the work of meeting the requirements. And the small-entity figure assumes one assessment per entity, while the larger figure is per information system, so an enterprise with several scopes multiplies it. DoD’s explanation of the difference is the useful part: small entities “are likely to have a less complex, less expansive operating environment” (89 FR 83179), and cost is driven by “the size and complexity of the enterprise or enclave under assessment” (89 FR 83175). Complexity, not headcount. The self-assessment estimates are in Level 1 vs. Level 2.

Scope is the first decision

For a small company, a tight, well-documented scope is the difference between a manageable project and an impossible one. For an enterprise, it’s the difference between one assessment and several. Either way, it’s the decision everything else depends on, and the one a Lead CCA validates first. Scope validation is part of our readiness and advisory work, done before a C3PAO ever sees your boundary.

Sources: 32 CFR Part 170, § 170.17(c)(5) and § 170.19(a)(1) and (c); 89 FR 83092 (October 15, 2024), preamble and regulatory impact analysis at 83118, 83134, 83141, 83151, 83152, 83167, 83175, 83179 and 83185; NIST SP 800-171 Revision 2, discussion for 3.1.4 and 3.10.6; Cyber AB, CMMC Assessment Process v2.0 (December 2024), P.6, 1.3, 1.4, 2.18 and 2.20; DFARS 252.204-7012.