CMMC Compliance: Requirements and Legacy System Remediation

CMMC compliance is built on control requirements, not a technology mandate. Level 2 — where most defense contractors feel the pressure — aligns to the 110 requirements of NIST SP 800-171 Revision 2 for Controlled Unclassified Information: multi-factor authentication, encryption of CUI, audit logging, access control, and configuration management. None of it names a stack, and all of it can be satisfied on many architectures.

For a defense contractor, the problem is rarely the controls in the abstract. It is the system underneath them — CUI moving through an application a decade old, a file share with no real access control, an environment where “audit log” means whatever someone remembered to turn on. CMMC does not require you to modernize; it requires those controls. But those controls cannot be met by a system that was never built to authenticate, encrypt, or log the way they describe. That is where the pressure — and the cost — actually comes from.

What CMMC compliance actually requires of your systems

CMMC 2.0 has three levels:

• Level 1 — basic safeguarding of Federal Contract Information (FCI); 15 requirements drawn from FAR 52.204-21; self-assessment.
• Level 2 — protection of Controlled Unclassified Information (CUI); the 110 requirements of NIST SP 800-171 Revision 2, organized into 14 control families; self-assessment or third-party certification by a C3PAO, depending on the contract.
• Level 3 — adds requirements from NIST SP 800-172; government assessment.

A status note that matters, because the picture changed recently: both governing rules are now final. The program rule (32 CFR Part 170) took effect December 16, 2024, and the DFARS contract rule (clause 252.204-7021) took effect November 10, 2025 — that DFARS rule is the trigger that actually puts CMMC into contracts. The rollout is phased. Phase 1 began with Level 1 and Level 2 self-assessment in applicable contracts; Phase 2, around November 2026, introduces Level 2 third-party certification; later phases extend to Level 3 and to full implementation across applicable contracts. One more accuracy point: CMMC currently assesses against SP 800-171 Revision 2, not Revision 3 — DoD has not adopted Rev 3 for CMMC.

The 110 requirements are organized into 14 control families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity. Roughly half of those are policy and process families your team can address with documentation and discipline. The handful that a legacy system actually blocks are the technical ones: Access Control, Identification and Authentication, Audit and Accountability, and Configuration Management. That is where MFA, encryption, real audit trails, and patching live, and where an aging platform runs out of road.

How CMMC Level 2 is scored, and why it matters for legacy

CMMC Level 2 self-assessment uses the SPRS scoring method, a 110-point scale where each requirement is worth 1, 3, or 5 points and an unmet requirement subtracts its weight. A well-run environment scores near 110. An estate with real gaps can score negative, because the deductions stack. To reach Conditional CMMC Status you need at least 88 of 110 (80 percent), and the highest-weighted 5-point requirements generally have to be fully met rather than deferred.

This is where legacy systems hurt out of proportion to their footprint. The controls an aging platform tends to fail (MFA, encryption of CUI, audit logging) are frequently the heavily weighted ones, so a small number of unpatchable or un-instrumentable systems can drag the whole score below the line. A Plan of Action and Milestones (POA&M) can carry a limited set of lower-weighted gaps, but every item has to be closed within 180 days or the conditional status lapses. That 180-day window is exactly the shape of a modernization plan: cover the gap with an interim control now, retire the underlying limitation for good before the clock runs out.

Where legacy systems fail the requirement

A legacy system fails CMMC for the same reasons it fails any control-based framework. The failures cluster in the technical control families:

800-171 control family	Representative Level 2 requirement	Where a legacy system falls short
Identification and Authentication	Multi-factor authentication for network and privileged access	MFA is a brittle retrofit an assessor will scrutinize, or impossible on the platform
Access Control	Least privilege, role separation, controlled remote access	Shared accounts and coarse permissions with no fine-grained model
Audit and Accountability	Create, protect, and review audit logs tied to individual users	Accountability requires logging the system was never designed to produce
System and Communications Protection	Encrypt CUI at rest and in transit	Encryption predates the architecture and cannot be applied cleanly
Configuration Management / System Integrity	Remediate flaws, manage configurations, keep the runtime supported	An end-of-life runtime cannot be patched, so flaw remediation fails at the root

The policy families (Awareness and Training, Personnel Security, and the like) are rarely where a legacy system sinks you. The technical families above are.

How we remediate it

We treat a CMMC gap the same way we treat any legacy system: a sequence of small, reversible steps, not a single risky cutover that jeopardizes contract performance.

A strangler facade sits in front of the system so the legacy path and the modernized path run side by side. The part of the system that touches FCI or CUI moves in bounded slices rather than all at once, and before any slice carries live data, we prove it behaves identically to the legacy — same results, same state, reconciled record by record. The modernized slice runs on a supported platform that does MFA, encryption, audit logging, and access control natively, so the 800-171 controls become properties of the system rather than retrofits. Where it helps, we also scope CUI into a smaller, well-segmented enclave so fewer systems fall under the higher level. AI-accelerated discovery reads the application, the data, and the integration surface end to end and captures what the system actually does, including the undocumented logic, under senior-engineer review. Traffic shifts only on green, rollback stays a flag away, and the legacy system handles regulated data only until nothing depends on it. We separate the certification deadline from the durable fix, so a plan-of-action item can be covered while the modernization retires the gap for good.

Sometimes a cheaper control clears it

Not every CMMC gap warrants modernization, and we’ll say so. Many controls can be satisfied on an existing system with a configuration change, an added control, or a documented plan of action — and rebuilding a system to clear a finding a cheaper control would close is rarely the right call. The slice-by-slice approach earns its place when the system handling CUI is unpatchable, when scoping it into an enclave is impractical without re-architecting, or when the same platform is blocking certification and other obligations at once. And we won’t tell you CMMC requires modernization — it doesn’t. It requires controls. Legacy systems are what make those controls expensive, and modernization is the answer when that cost exceeds the fix.

Where to start

The first step is small and bounded: understand which systems touch FCI and CUI, which of the 110 controls they fail, and whether the right move is a configuration fix, an enclave, or remediation. A discovery call scopes your CUI footprint, maps it to the level your contracts require, and tells you where each path is warranted — on evidence, not a sales pitch. Reach the team at sales@modernlift.ai.