# Contractors Clarify CMMC Subcontractor Requirements

A contractor discussion about difficulty obtaining subcontractor bids for work involving utility maps treated as controlled unclassified information (CUI) highlighted uncertainty about finding CMMC-certified firms and determining which requirements apply. Commenters said the discussion identified no public CMMC-certified-contractor directory and pointed to SPRS for contractor assessment scores, while emphasizing that CMMC certification, NIST SP 800-171 compliance, and controlled access to CUI are distinct issues. For procurement teams and primes, the key is to establish the CUI authority and scope and confirm the applicable solicitation and flow-down requirements before deciding which subcontractors can perform the work.

- Contractors should verify the applicable CUI authority and when the information is considered CUI, then confirm current prime-contract and solicitation requirements before soliciting bids.
- SPRS assessment scores may inform contractor assessment, but the discussion does not present SPRS as a directory of CMMC-certified contractors.
- Segregating CUI or providing controlled, logged access may help shape subcontracting arrangements; a hosted desktop does not itself establish a subcontractor’s CMMC Level 2 status or eliminate its obligations.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 01, 2026

### Key Quotes
> We're an even more obscure trade than the electricians or plumbers and we have a division that's CMMC2. When the contracts say we have to be CMMC2 or lose the ability to bid or we lose millions on contracts we bit the bullet and got it done.
> — Commenter (CMMC Level 2 subcontractor)

> A hosted desktop can keep those utility maps off the subs' endpoints and give them expiring, logged access, but it doesn't make the subcontractor CMMC L2 or remove their obligations.
> — Commenter (DaaS provider)

> What CUI authority/category is being used? When does the information actually become CUI? ... There's often a way to segregate the CUI or go to another method.
> — Commenter

### Sources
- [List of CMMC certified contractors](https://www.reddit.com/r/CMMC/comments/1wulz8a/list_of_cmmc_certified_contractors) - reddit-cmmc