New System, New Contract, New Subsidiary: When a Change Affects Your CMMC Status
A CMMC status covers an assessment scope, not a company. How a new cloud service, a contract that asks for a higher level, an acquisition or a foreign subsidiary changes what you hold, and who you have to tell.
A CMMC status isn’t a badge your company wears. It covers a specific set of systems. The rule’s preamble says it plainly: “Any CMMC certification granted applies only to the assessed CMMC Assessment Scope” (89 FR 83141). Change the systems, the contract, or the company around them, and the first question is always the same: does what you hold still cover what you’re doing?
Most changes don’t touch your status at all. A few change it completely. This post works through the three that come up most, a new system, a new contract and a new subsidiary, and the one question that sorts them.
Two questions sort almost every change
A Level 2 scope is “the set of all assets in the OSA’s environment that will be assessed” (32 CFR § 170.19(a)(1)), and a contract asks for a level. So a change can affect your status in only two ways: it changes the scope, or it asks for more than the status you hold.
Does a contract now ask for more than you hold?A higher level, or a C3PAO assessment where you have a self-assessment.
Yes: the higher status must be in SPRS before awardDoes the change alter which assets handle CUI, or protect it?Where CUI is processed, stored or transmitted, and the tools that secure it.
- NoUpdate the inventory. Your annual affirmation covers it.
- Inside the boundary, following the SSPUpdate the SSP and inventory. No new assessment.
- A significant architectural or boundary changeA network expansion, an acquisition. The DoD says a new assessment is required.
The middle answer is where judgment lives. The preamble says “a new assessment is required if there are significant architectural or boundary changes,” with “expansions of networks or mergers and acquisitions” as its examples, while changes “within the existing assessment boundary that follow the existing SSP” are “covered by the annual affirmations” (89 FR 83135). Elsewhere it softens to “may be required” (89 FR 83198). Neither the rule nor the preamble defines “significant,” and no threshold exists. We covered everyday cases, like replacing laptops or opening an office, in staying compliant between assessments. Here are the bigger ones.
A new system
A cloud service that will hold CUI. The provider has to meet the FedRAMP requirements in DFARS 252.204-7012: authorized at the FedRAMP Moderate baseline or higher, or meeting equivalent requirements (§ 170.17(c)(5)). That isn’t the end of it. Your own infrastructure that connects to the service “is part of the CMMC Assessment Scope,” and the provider’s customer responsibility matrix “must be documented or referred to in the OSC’s SSP.” A new CUI-bearing service is a change to how CUI moves, which is a scope question, so review it before it goes live, not after.
A service that holds only security data. A new SIEM or endpoint management tool that holds logs and configurations but no CUI is assessed as a Security Protection Asset, against the requirements relevant to what it does (§ 170.19, Table 4). It belongs in the SSP, the inventory and the network diagram.
More people on the same system. Growth inside an assessed system isn’t automatically a scope change. Answering a question about acquisitions, DoD wrote that “adding new users to an existing system does not necessarily change the scope of a CMMC assessment” (90 FR 43569).
Whatever the change, the SSP has to describe “each information system within the CMMC Assessment Scope” (§ 170.24). No rule sets a deadline for updating it, but an SSP that lags the environment is the first thing an assessor, or your Affirming Official, will trip over.
A new contract
The level is set per contract. The contracting officer includes “the CMMC level… required by the program office” in each solicitation (DFARS 204.7503(a)), and you have to “achieve, at time of award, a CMMC status at the CMMC level specified in the solicitation, or higher” (DFARS 204.7502(a)(3)). “Or higher” only works upward. A Level 1 status doesn’t satisfy a Level 2 requirement, and a Level 2 self-assessment doesn’t satisfy a contract that asks for a C3PAO. A Level 2 Conditional status counts at award; Level 1 needs a Final.
CUI has to stay on systems with the right status. The clause limits FCI and CUI to “contractor information systems that have a CMMC status at the CMMC level required” (DFARS 252.204-7021(d)(2)). If a new contract brings CUI to an engineering group whose systems were never assessed, the status you already hold doesn’t follow the data there.
New systems mean new identifiers. Each assessment gets a CMMC Unique Identifier (UID), reflected in SPRS “for each contractor information system.” Offerors list their UIDs in the proposal and update the list “when new CMMC UIDs are generated” (DFARS 252.204-7025(d)), and “for each new information system used to support a DoD contract with FCI or CUI, a new SPRS entry is required” (89 FR 83134).
The same status check happens again before each option is exercised (DFARS 204.7503(c)). We walk through what that means across a contract’s life in the three-year Level 2 cycle.
A new subsidiary, or an acquisition
Here the rule is quieter than people expect. Part 170 says nothing about parents, subsidiaries or legal entities. What it ties a status to is CAGE codes and systems: the results include “all industry CAGE code(s) associated with the information system(s) addressed by the CMMC Assessment Scope” (§ 170.17(a)(1)(i)), and the certificate lists the same (§ 170.9(b)(18)). The CMMC Assessment Process allows that “a single CMMC assessment may cover multiple entities” when more than one CAGE code is associated with one scope (CAP v2.0, P.6).
So the test for an acquisition is scope, not ownership. Asked directly whether an acquired company could be added to an existing certification, DoD didn’t say yes. It pointed to reporting changed UIDs and to scoping (90 FR 43569). That leaves two broad paths:
Your status covers only your assessed scope. If the acquired company will handle FCI or CUI on its own systems, those systems need their own status at the level its contracts require.
The DoD names mergers and acquisitions as a significant boundary change. Expect a new assessment of the combined scope before CUI moves between the networks.
An enclave doesn’t borrow a status from the rest of the company either: it “cannot inherit the enterprise certification” and has to be assessed separately (89 FR 83141). Whichever path you take, decide it before the networks touch.
A foreign subsidiary is handled the same way. “The CMMC process is the same for international and domestic contractors and subcontractors” (89 FR 83148), using NCAGE codes in place of CAGE codes. DoD says recognizing another country’s program “would require a formal government to government international arrangement or agreement” (89 FR 83202). We haven’t found one published, including for Canada’s CPCSC, so plan as if your Canadian or European subsidiary needs its own CMMC status for any DoD work it touches.
A new Affirming Official
People change too. Each affirmation carries the Affirming Official’s “name, title, and contact information” (§ 170.22(a)(2)(i)), and the role belongs to “the senior level representative… responsible for ensuring the OSA’s compliance.” The rule doesn’t say anything about handing the role over. In practice, the new person signs the next affirmation, so brief them on what stands behind it before that date. Our post on what the Affirming Official is actually signing is a good handover document.
Who you have to tell
Less than you might think, and more than nothing. The clause requires you to submit “any changes in the CMMC UIDs generated in SPRS throughout the life of the contract” to the contracting officer (DFARS 252.204-7021(e)(1)(ii)). The proposed rule went further, with a duty to report lapses or changes in certificate status, and that was “removed from the final rule” (90 FR 43562). Cyber incidents are still reported under DFARS 252.204-7012.
But a status only counts while it’s current, and the clause defines current as including “no changes in compliance with the requirements at 32 CFR part 170” since the status date (DFARS 252.204-7021(a)). A change that quietly breaks a requirement doesn’t need a notification to matter. It matters the next time someone signs an affirmation.
Ask before the change, not after
The cheapest scoping review is the one done while a change is still a plan: before the contract is signed, before the cloud service holds data, before the acquired network is connected. That’s why change reviews are part of our CMMC Continuous Compliance (APS) plans, alongside the affirmation and evidence work: CMMC impact reviews for new systems, applications, business processes, contracts and subsidiaries, before they create gaps.
Sources: 32 CFR Part 170, §§ 170.9(b)(18), 170.17(a)(1)(i) and (c)(5), 170.19(a)(1) and Table 4, 170.22(a)(2)(i), 170.24; 89 FR 83092 (October 15, 2024), preamble at 83134, 83135, 83141, 83148, 83198 and 83202; DFARS final rule, 90 FR 43560 (September 10, 2025), at 43562 and 43569; DFARS 204.7502(a)(3), 204.7503(a) and (c), 252.204-7021(a), (d)(2) and (e)(1)(ii), 252.204-7025(d); Cyber AB, CMMC Assessment Process v2.0 (December 2024), P.6.