If you handle Controlled Unclassified Information (CUI) for the Department of Defense, two acronyms dominate your compliance roadmap: CMMC and FedRAMP. They sound like they do the same thing. They do not, and assuming one covers the other leaves requirements nobody has implemented.
CMMC Phase 2, which was to add Level 2 (C3PAO) requirements to applicable DoD solicitations (32 CFR 170.3(e)(2)), has been suspended since July 13, 2026. The requirements of DFARS 252.204-7012 remain in effect (DoW CMMC Procedures memo, Attachment 1, July 13, 2026), so the time to understand how these two frameworks interact is still now.
What Are CMMC and FedRAMP?
CMMC (Cybersecurity Maturity Model Certification) is the DoD's cybersecurity framework for the defense supply chain. It verifies that contractors have implemented the security requirements that protect Federal Contract Information and CUI (89 FR 83092). The program rule took effect December 16, 2024; on July 13, 2026 the Department of War suspended its phased implementation schedule, and during the suspension solicitations may name only Level 1 (Self) or Level 2 (Self).
FedRAMP (Federal Risk and Authorization Management Program) is a federal authorization program for cloud service providers (CSPs). It gives the government one authorization process for cloud offerings.
They serve different audiences but intersect at one critical point: cloud compliance for CUI.
How CMMC and FedRAMP Are Connected
The connection is regulatory, not optional. Under DFARS clause 252.204-7012, a contractor must confirm that any cloud service provider it uses to store, process or transmit CUI meets the FedRAMP Moderate baseline or its equivalent (89 FR 83094). CMMC Level 2 scoping points back to that clause: a cloud service provider that processes, stores or transmits CUI shall meet the FedRAMP requirements in DFARS 252.204-7012 (32 CFR 170.19(c)(2), Table 4). The Level 2 requirements themselves are the NIST SP 800-171 requirements, which NIST derived from FIPS 200 and the moderate control baseline in NIST SP 800-53 (NIST SP 800-171 Rev. 2). The final rule describes the FedRAMP Moderate baseline as also based on NIST standards (89 FR 83106).
What counts as equivalent is set by a separate DoD CIO policy memo on FedRAMP Moderate equivalency, not by the CMMC rule (89 FR 83106). Read that memo, and your provider's own documentation, before you rely on an equivalency claim.
The bottom line: FedRAMP authorization is about the cloud service provider. CMMC is about you, the contractor. If the cloud holds your CUI, both apply, and neither substitutes for the other.
Key Differences Between CMMC and FedRAMP
Who Is Assessed
FedRAMP: The cloud service provider. CSPs go through authorization so their cloud offerings can be used by federal agencies and contractors.
CMMC: The defense contractor. The organization bidding on DoD contracts must hold its own CMMC status regardless of which cloud platform it uses.
Control Frameworks
FedRAMP Moderate: The baseline a cloud service provider is assessed against (89 FR 83157), which the final rule describes as based on NIST standards (89 FR 83106).
CMMC Level 2: Based on NIST SP 800-171 Rev. 2, with 110 security requirements across 14 families (32 CFR 170.14(c)(3)). NIST derived them from FIPS 200 and the NIST SP 800-53 moderate baseline, focused on protecting CUI in nonfederal systems (NIST SP 800-171 Rev. 2).
Assessment Process
FedRAMP: Third-party assessment organizations (3PAOs) assess the cloud offering as part of its FedRAMP authorization.
CMMC: Level 1 and Level 2 (Self) are self-assessments. Authorized or accredited CMMC Third-Party Assessment Organizations (C3PAOs) conduct Level 2 (C3PAO) certification assessments, and DCMA DIBCAC conducts Level 3 assessments (32 CFR 170.15 to 170.18). During the Phase 2 suspension, solicitations may name only Level 1 (Self) or Level 2 (Self).
Scope
FedRAMP: Covers the cloud system boundary, meaning the CSP's infrastructure, platform, and services within the defined authorization boundary.
CMMC: Covers your CMMC Assessment Scope: the assets that process, store or transmit CUI and the assets that protect them, on-premises or in the cloud, not just the cloud piece (32 CFR 170.19).
The Cloud Compliance Mistake to Avoid
The mistake to avoid: selecting a FedRAMP-authorized cloud environment and assuming it covers your CMMC requirements. It does not.
Using a FedRAMP-authorized cloud does not make you CMMC compliant. FedRAMP covers what the cloud service provider controls. CMMC covers what you control. The gap between those two is where requirements go unimplemented.
The shared responsibility model defines this split:
- Inherited controls: security controls the CSP implements on your behalf, such as physical security of data centers and infrastructure patching.
- Customer-responsible controls: controls you must implement yourself, such as access management, encryption policy, incident response, security awareness training, and configuration management.
- Shared controls: controls where responsibility is split. Patch management is a common example: the CSP patches the infrastructure, you patch your applications and operating systems.
Without clear documentation of which requirements fall where, your assessment becomes a fire drill. When you use an External Service Provider, including a cloud provider, its services and the responsibility split belong in your SSP and a customer responsibility matrix (32 CFR 170.19(c)(2)).
FedRAMP Moderate, FedRAMP High, and GCC High
Not all FedRAMP authorizations are equal, and picking the wrong tier can either leave you short of the requirement or spend budget on a tier you do not need.
FedRAMP Moderate, or its equivalent, is the level DFARS 252.204-7012 names for a cloud service that stores, processes or transmits CUI (89 FR 83094).
FedRAMP High is a larger baseline intended for high-impact systems.
GCC High is one of Microsoft's government cloud offerings. Whether you need it, or a commercial or other government tier, depends on your provider's FedRAMP status, the DoD equivalency policy, and any other obligations in your contract, such as export controls. Confirm with the provider's own documentation and your contracting officer.
Price the tier you actually need before you commit, and get the provider's quote in writing.
What an AaaS Platform Does Here, and Does Not
Your cloud provider carries the FedRAMP work; your job is NIST SP 800-171 and the record of who does what. This is where an Agent-as-a-Service (AaaS) provider gives your team operational leverage, within clear limits.
- One control set, measured: the platform measures the read-only configuration of the commercial AWS, Azure, Microsoft 365, Google Workspace, Okta and CrowdStrike tenants you connect against NIST SP 800-171 for CMMC. It does not check NIST 800-53 or FedRAMP, and it does not connect to GCC High, GovCloud or Azure Government tenants.
- Shared responsibility documentation: on a readiness subscription, the platform builds a Customer Responsibility Matrix over every requirement. Each requirement is yours by default until you record inheritance from a named provider; the matrix never assumes a provider covers a requirement, and it flags a cloud provider you record as handling CUI without FedRAMP authorization or equivalency.
- Scheduled re-measurement: NIST SP 800-171 asks you to monitor security controls on an ongoing basis (3.12.3). The platform re-scans connected sources about every seven days against NIST SP 800-171 and records the configuration drift it can observe.
The leverage: one CMMC evidence record, with the provider responsibilities you record set out in the matrix. Your team stays focused on the business while the system handles evidence management and gap detection against NIST SP 800-171. Your people keep accountability, authorization and professional judgment: the platform files nothing, and your Affirming Official decides what is affirmed in SPRS.
If you also hold or are pursuing other certifications, see CMMC vs ISO 27001 for how that overlap works, or compare traditional compliance software against an AI compliance platform.
See Where Your Environment Stands
If you are still tracking CMMC requirements and provider responsibilities in spreadsheets, see where your environment stands first, then decide.