What a CMMC Contractor Should Require from Its Hardware Supplier

CMMC assesses your organization, not your suppliers. But the hardware your suppliers deliver becomes your CUI Assets (the systems that hold Controlled Unclassified Information — the drawings, specifications and technical data a contract obliges you to protect), your baseline configurations and your media-protection problem, and several Level 2 requirements are far easier to meet when the supplier has done its part. This page sets out what a contractor is entitled to ask for — and what a serious supplier should already have ready.

1. If a supplier handles CUI for you, the supplier needs CMMC too

DoW contracts require the CMMC clause to be passed on — “flowed down”, in contracting language — to every subcontractor and supplier that stores, processes or transmits CUI. So if a supplier handles CUI in the course of the work (system drawings, configuration data, deployment locations), the supplier needs its own CMMC status at the appropriate level. Ask directly: What is your CMMC level, was it self-assessed or C3PAO-assessed, and when? A supplier with a C3PAO-assessed Level 2 certification simplifies your own flow-down documentation and the due-diligence questions your prime will ask you.

NCS is CMMC Level 2 certified (August 2025).

2. Provenance: where did the hardware actually come from?

Counterfeit and grey-market components are a documented problem in defense electronics, and a system built from parts of unknown provenance undermines every integrity control layered on top of it. Reasonable questions:

• Are components sourced through authorized OEM channels and national distributors, or through brokers?
• Does the supplier hold a recognized supply-chain security registration — ISO 28000 (security management systems for the supply chain) and/or O-TTPS / ISO 20243 (Open Trusted Technology Provider Standard, which specifically targets counterfeit and maliciously tainted products)?
• Is the assembly and integration facility access-controlled and, where the work requires it, ITAR-compliant?

NCS’s integrated management system is registered to ISO 9001, ISO 14001, ISO 28000 and O-TTPS 20243, and its Manassas, Virginia facility is ITAR-compliant with controlled access. Few hardware suppliers in this space hold all four; the combination is what allows NCS to document a chain of custody from component to delivered system.

3. Trade compliance: TAA and country of origin

Most federal hardware purchases require Trade Agreements Act (TAA) compliance: the product must be made or “substantially transformed” in the U.S. or a designated country. This is not a CMMC requirement, but it is asked in the same breath and answered by the same supplier paperwork. Ask for a written country-of-origin and TAA statement for each product line you intend to buy, before award rather than at delivery. A blanket “we are TAA compliant” line is less useful than product-specific documentation, because compliance is determined product by product. NCS provides that documentation for each product when a contract requires it.

4. As-built documentation

Configuration Management (CM.L2-3.4.1) requires baseline configurations and inventories. A supplier that delivers each system with an as-built record — serial numbers, component part numbers, firmware and BIOS versions, BIOS settings applied, image version — has done half of the baseline work for you, and done it accurately. Ask for a sample before you order.

5. Firmware and lifecycle support

Vulnerability remediation (SI.L2-3.14.1) and flaw remediation timelines depend on the supplier continuing to publish firmware and BIOS updates for the life of the system. For rugged and long-life programs — where a system may be fielded for a decade — ask about product lifecycle planning, last-time-buy notification and how the supplier manages OEM end-of-life. NCS’s OEM relationships give it early visibility of lifecycle changes, which is used to plan revisions and spares before they become a program problem.

6. Drive handling and warranty returns

Media Protection (MP.L2-3.8.3) makes drive handling a supplier question. Ask:

• Can drives be retained by the customer on warranty return (keep-your-drive)?
• Does the supplier offer NIST SP 800-88 sanitization with a certificate, or certified destruction?
• Are self-encrypting and FIPS 140-validated drives available as standard options?

NCS answers yes to all three: drives can be retained by the customer on warranty return, NIST SP 800-88 sanitization with a certificate or certified destruction is offered, and self-encrypting and FIPS 140-validated drives are standard options.

7. Cryptographic module validation

If the system’s encryption is part of your CUI protection story, the supplier must be able to identify the FIPS 140 CMVP certificate for the specific module in the specific product. “AES-256 encryption” on a data sheet is not evidence for SC.L2-3.13.11; a certificate number is.

Putting this in your RFQ

Put the seven points above into your RFQ or supplier questionnaire as they stand, and ask each supplier to provide:

1. CMMC status, and whether it was self-assessed or C3PAO-assessed
2. Component provenance, and any ISO 28000 or O-TTPS registration
3. A country-of-origin and TAA statement for each product line
4. A sample as-built configuration record
5. A firmware and lifecycle support commitment
6. Drive retention (keep-your-drive) and sanitization options
7. FIPS 140 CMVP certificate numbers for any encryption relied on

NCS Technologies has supplied and integrated computing hardware for federal and DoW customers since 1996, and holds CMMC Level 2 C3PAO, ISO 9001, ISO 14001, ISO 28000 and O-TTPS 20243 registrations. Talk to our contracts team about supplier documentation for your program.

---

More in this series: What CMMC Level 2 requires of your hardware · Protecting CUI on rugged and tactical systems · NCS and CMMC Level 2