Northern Virginia has one of the densest concentrations of defense contractors and subcontractors in the country — which means it also has one of the densest concentrations of companies that owe cybersecurity obligations they have not fully mapped. The question “do we need CMMC?” usually unpacks into three smaller ones: what data do you touch, what clauses are in your contracts, and what will your primes demand.
Start with the data: FCI vs. CUI
Federal Contract Information (FCI) is information provided by or generated for the government under contract that is not intended for public release — delivery schedules, performance details, ordinary contract correspondence. If you hold a federal contract that is not purely for off-the-shelf items, you almost certainly handle FCI.
Controlled Unclassified Information (CUI) is the sensitive tier below classified: controlled technical information, engineering drawings, specifications, certain export-controlled data, and similar categories that the government requires safeguarding for. In the DC-metro supply chain CUI shows up constantly in statements of work, technical data packages, and deliverables — often at subcontractors who never signed anything labeled “CUI” but received it in an email attachment from a prime.
The level follows the data
- FCI only → CMMC Level 1: an annual self-assessment against the 15 basic safeguarding requirements of FAR 52.204-21, with an affirmation.
- CUI → CMMC Level 2: all 110 security requirements of NIST SP 800-171 Rev. 2. Depending on the procurement, Level 2 is met by a self-assessment with affirmation or by a third-party C3PAO certification — and many primes are contractually requiring the certified flavor from their subs.
- A small set of programs touching the most sensitive CUI → Level 3, which layers government-led assessment on top of Level 2.
You may already owe this — look at your clauses
CMMC is the verification regime. The underlying obligations are older and, for most readers, already signed. Pull a recent contract or subcontract and look for these:
- FAR 52.204-21 — basic safeguarding of FCI. The Level 1 baseline.
- DFARS 252.204-7012 — the big one: if you handle covered defense information, you are required to implement NIST SP 800-171 now, report cyber incidents within 72 hours, and flow the clause down to your own subs.
- DFARS 252.204-7019/7020 — require a current NIST SP 800-171 self-assessment score posted in SPRS, and give the government the right to a higher-level review.
If 7012 is in your contracts, “waiting to see what happens with CMMC” is not a compliance strategy — the 800-171 obligation is already live, and an inaccurate SPRS score is a False Claims Act problem, not a paperwork problem.
The Northern Virginia reality
Around the Pentagon, Fort Belvoir, Quantico, and the Dulles corridor, the practical trigger is rarely a FAR clause — it is a prime’s supplier questionnaire. Engineering firms, manufacturers, software shops, logistics providers, and specialized consultancies across the region are being asked for their SPRS scores and certification plans as a condition of staying on bid teams. The companies that can answer with evidence are winning the teaming decisions.
Not sure which side of the FCI/CUI line your work falls on? That is a scoping question, and it is exactly where a gap assessment starts — see our CMMC compliance services or the cost breakdown to understand what the path looks like.
Sources & further reading