CMMC compliance for defense subcontractors in San Diego usually breaks down in the same place: not the firewall, not the policy binder, but the everyday cloud tools the team already uses. Email, file sharing, ticketing, backup, and the managed service provider with admin access all touch Controlled Unclassified Information, or CUI. If those tools cannot prove how they protect that information, your company carries the gap into the assessment, no matter how good the rest of your program looks.
That surprises a lot of small defense firms. Buying a well-known cloud product does not settle the question. Under CMMC 2.0 requirements, you remain responsible for CUI wherever it goes. A vendor’s marketing page is not evidence. An assessor will ask what the tool is authorized to do, what you configured, what the vendor does, and what is left to you. If nobody can answer in writing, that system is a finding waiting to happen.
Start with where CUI actually lives in your cloud tools
Make a plain inventory before you debate products. List every external service that can store, process, or transmit CUI, or that can affect the security of a system that does. For most subcontractors that list is longer than expected: Microsoft 365 or Google Workspace, a file-sharing link sent to a prime, the help-desk ticketing system where an engineer pasted a drawing number, the backup platform, the tool your IT provider uses for remote access, and the security tools that collect logs.
For each service, write down what CUI goes there, who can access it (including vendor support and your IT provider), and how you would get the data out if you changed vendors. That inventory is the backbone of your scoping work under NIST 800-171 compliance. You cannot protect a flow you have never mapped.
Pay close attention to the casual paths: a personal email forward, a file shared with “anyone with the link,” or a ticket attachment nobody deleted. If CUI can reach a tool, that tool is in scope until you block the path or bring it up to standard.
The FedRAMP equivalency question you cannot dodge
For CMMC Level 2, cloud service providers that handle CUI need to meet security requirements equivalent to FedRAMP Moderate. That is the standard your assessor will apply. A provider saying it is “FedRAMP ready,” “FedRAMP aligned,” or “built on a FedRAMP platform” is not the same thing.
Ask for the actual proof and file it. Is the specific service you use FedRAMP authorized at Moderate, or does the provider show equivalency for the exact service you are buying? Product names matter: the authorized version is not always the commercial version a small business bought on a credit card. The high-compliance version often has different controls and a different price for a reason.
Do not let this become a last-minute discovery. During CMMC assessment preparation, primes in San Diego already ask which cloud tenancy you run and whether it qualifies. If it is the wrong tenancy, migration takes time. Finding that out now is a project plan. Finding it out a month before assessment is expensive.
If a provider cannot produce clear documentation, treat that as your answer: move CUI out, replace the tool, or keep it outside your boundary and prove CUI cannot reach it.
A shared responsibility matrix is not paperwork for its own sake
Every cloud tool splits the work. The provider secures its platform. You secure your accounts, your configuration, your data, and who you let in. The failures happen in the gap, where each side assumed the other side was handling it.
Get the provider’s shared responsibility matrix and mark it up for your environment. Who enforces multi-factor authentication. Who reviews admin accounts. Who configures external sharing. Who watches audit logs, how long are they kept, and who is alerted when a new admin appears or a mailbox rule starts forwarding mail outside the company. Who handles backup and restore, and who tests it.
Those answers plug directly into your System Security Plan. “The vendor handles security” will not satisfy an assessor. “The vendor provides the logging feature, we turn it on, we retain logs for our required period, and our team reviews these specific reports” is a control someone can test. That distinction is the core of NIST 800-171 compliance work: not buying a feature, but showing it is configured, owned, and reviewed.
Your managed IT provider belongs on this matrix too. If an outside firm has admin rights to your CUI systems, it is an external service provider in your assessment story. Its access should be named, limited, logged, and covered by contract. Standing admin access for every technician, with no individual accountability, is hard to defend.
Configuration is where good tools still fail assessments
A qualifying platform configured badly still fails. A few settings decide most of the risk in a small subcontractor’s cloud tenancy, and they are worth reviewing this quarter, not the week before the C3PAO arrives.
Turn off open external sharing and require a named recipient for CUI files. Enforce multi-factor authentication for every user, with a stronger standard for admins. Separate admin accounts from daily email accounts. Set audit logging on before you need it, because logs you did not collect cannot be produced later. Review third-party apps connected to email and files; each one is another path into the data.
Then keep evidence as you go. Export sharing settings, the MFA report, the admin list, and log retention settings on a schedule, and store that evidence outside the tenancy. Assessors test a period of time, not a single morning when everyone cleaned up. That habit is what turns CMMC assessment preparation from a scramble into a review.
What to ask every vendor this month
Send the same questions to each provider that touches CUI and save the replies in one folder. Are you FedRAMP Moderate authorized or equivalent for the exact service we use, and where is that documented? What is your shared responsibility matrix? How fast do you notify us of an incident? What logs do we get, how long do you keep them, and can we export them? If we leave, how do we retrieve our data and confirm deletion?
A good provider answers plainly and points to documents. Slogans tell you what an assessor will find.
FIT Solutions is a San Diego managed IT and cybersecurity provider, with 24/7 monitoring, a Security Operations Center in California, and 300+ 5-star Google reviews. Our services include Managed IT, Enterprise IT, Cybersecurity, Cloud Services, and Healthcare IT. For defense firms working through CMMC 2.0 requirements on a real deadline, the cloud inventory, the equivalency proof, and the responsibility matrix are a practical place to start, and they are far easier to fix before a prime or an assessor asks for them.
Our vision is helping 6,000 businesses. We would rather help you find a cloud gap in a quiet review than watch a prime find it in a supplier audit.
If your cloud tools touch CUI and nobody can show you the proof in writing, get that review on the calendar now.
Call FIT Solutions at (888) 339-5694.
