CMMC vs FedRAMP: one checks you, the other your cloud

Published 2026-10-22

CMMC and FedRAMP never check the same party. CMMC checks you, the contractor, against the 110 requirements of NIST SP 800-171 Rev 2 170.14(c)(3). FedRAMP checks a cloud provider against a much larger NIST SP 800-53 baseline, so that federal agencies can buy its service. Holding CUI never means your shop needs FedRAMP for itself, and a provider's FedRAMP status never gives you a CMMC level.

They meet in one paragraph of DFARS 252.204-7012 7012(b)(2)(ii)(D): if a cloud outside your walls holds covered defense information, you must make sure it meets FedRAMP Moderate or its equivalent. That sentence is why FedRAMP shows up in your CMMC assessment at all. If you are not sure the data is CUI, settle that first on FCI vs CUI.

Status as of 2026-10-23

In force today: DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
Suspended: Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
Not yet known: The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23

What still applies while Phase 2 is suspended

Who gets checked

CMMC checks you

Laptops and desktops that open drawings
Your file share and your email tenant settings
The badge reader and the shop door
Your people, policies and the SSP

7012(b)(2)(ii)(D)Where they meet: you must require FedRAMP Moderate or equivalent of any cloud holding your CUI

FedRAMP checks your cloud

The provider's data centers and hypervisors
Its staff, patching and incident response
Encryption it runs on its side
Its annual independent assessment

Mezzotint of a desktop tower beside a tall server rack — The small machine and the big one: your shop's systems next to the provider's racks.

One certification, two baselines

The columns are not rivals. The first is a status your company holds; the other two are statuses a cloud provider holds. Read down a column to see who does the work, and across a row to see why a FedRAMP badge is no substitute for your own assessment.

CMMC next to FedRAMP

CMMC Level 2 compared with FedRAMP Moderate and FedRAMP High
The question	CMMC Level 2Certifies the contractor	FedRAMP ModerateClass C on the Marketplace	FedRAMP HighClass D on the Marketplace
Who and what
Who it applies to32 CFR 170.3(a)–(b)	Defense contractors and subcontractors whose own systems hold FCI or CUI. Not federal systems run on the Government's behalf.	A cloud service offering sold to federal agencies, and any outside cloud a contractor uses for covered defense information.	The same kind of offering, certified at the High impact level.
Control baseline32 CFR 170.14(c)(3); FedRAMP baseline	The 110 security requirements of NIST SP 800-171 Rev 2, in 14 families.	323 controls and enhancements from NIST SP 800-53 Rev 5, in 18 families.	410 controls and enhancements from NIST SP 800-53 Rev 5, in 18 families.
Who checks it
Who assesses32 CFR 170.16–170.17; FRD-ASR	You, for Level 2 (Self). A C3PAO for Level 2 (C3PAO). DCMA DIBCAC may investigate either.	A FedRAMP Recognized independent assessor (the old term is 3PAO); FedRAMP is the final assessor.	The same, against the larger High baseline.
Who says yes32 CFR 170.22; Marketplace guide	A senior official of your company affirms the result in SPRS.	FedRAMP certifies the package; each agency still issues its own authorization to operate.	The same: FedRAMP does not grant ATOs.
How often32 CFR 170.16(a)(1), 170.22	A new assessment every three years; an affirmation every year.	An annual assessment (the Marketplace lists its date) and continuous monitoring in between.	The same cycle.
Where the result livesSPRS; FedRAMP Marketplace	SPRS; a C3PAO result goes through CMMC eMASS first.	The FedRAMP Marketplace on fedramp.gov, public, with the class and the annual assessment date.	The same Marketplace, marked Class D.
In a defense contract
The clause that pulls it inDFARS 252.204-7021; 7012(b)(2)(ii)(D)	DFARS 252.204-7021 names the CMMC status you must hold.	DFARS 252.204-7012(b)(2)(ii)(D): any outside cloud holding covered defense information meets Moderate or its equivalent.	Accepted as "or higher" by 32 CFR 170.16(c)(2); 7012 itself asks no more than Moderate.
Binding todayStatus as of 2026-10-23	Self in force; C3PAO requirement suspended	In force under 7012	Accepted, not required

What the last row means

In force: A clause in force today requires it.
Self in force; C3PAO requirement suspended: The self-assessment route only, while Phase 2 is suspended.
Accepted, not required: Counts toward the rule; the rule does not ask for it.

Where they meet: 7012(b)(2)(ii)(D)

One paragraph of the safeguarding clause decides which clouds may hold your CUI. It puts the duty on you, the contractor, and gives the provider two ways to qualify.

Route 1 Authorized

FedRAMP Moderate or High Authorized

Listed as authorized on the FedRAMP Marketplace at Moderate or higher.
The memo says such an offering "can be leveraged without further assessment".
You still document its Customer Responsibility Matrix in your SSP.

Route 2 Equivalent

FedRAMP Moderate equivalent

100 percent of the latest Moderate baseline, assessed by a FedRAMP-recognized 3PAO.
No open POA&M items from that assessment; the provider hands you the body of evidence.
The memo "does not confer FedRAMP Moderate Authorization": the proof stays with you.

CMMC repeats the same two routes. A Level 2 self-assessment may count a cloud that holds CUI if it is FedRAMP Authorized at Moderate or higher in the Marketplace, or meets equivalent requirements "in accordance with DoD Policy" 170.16(c)(2), and the C3PAO rule says the same 170.17(c)(5). The policy in question is the DoD CIO memo of December 2023, which sends equivalency questions in the CMMC ecosystem to the CMMC Program Management Office. Our guide to FedRAMP Moderate equivalency walks through it item by item; the tool below turns it into a list you can send.

What the memo leaves with you

The equivalency memo is three pages, and the last one is about you. It splits the work like this:

Who carries what

Your job	The provider's job
Require and ensure the provider meets Moderate or its equivalent, before any CUI goes in.	Meet 100 percent of the Moderate baseline, assessed by a FedRAMP-recognized 3PAO.
Read the body of evidence and confirm it meets the memo's standard. The memo puts that onus on you.	Hand you the body of evidence, and repeat a 3PAO assessment every year that validates 7012 and 7020.
Give the Customer Responsibility Matrix to DIBCAC and to any assessor who asks.	Supply the control responsibilities (the CIS and CRM workbook): what it runs, what is shared, what is yours.
Approve the service for your company and confirm the provider has an incident response plan.	Follow that plan and notify you; follow 7012(c) to (g) on incidents, malware and forensic images.
Report a compromise of the service to DoD within 72 hours, through DIBNet. You, not the provider.	Close every finding from its 3PAO assessment; only operational POA&M items may stay open.

Moderate or High: what a small shop needs

DFARS 7012 asks for Moderate or its equivalent, and CMMC accepts "Moderate (or higher)". High is the bigger baseline, 410 controls and enhancements against 323 at Moderate, so a High offering passes the cloud test. Nothing in 7012 or Part 170 makes you buy High.

Shops end up on High for other reasons. The plainest case is Microsoft 365: on the Marketplace, GCC is Class C (Moderate) certified since 2014-11-20 and GCC High is Class D (High) since 2024-12-26. Microsoft says it will only agree to ITAR contract language for GCC High, so a shop with ITAR technical data often lands there for the export rules, not for 7012. The trade-offs are on GCC vs GCC High, and the cheaper ways out on GCC High alternatives.

Both programs are moving at once

CMMC's rollout is paused before Phase 2, and FedRAMP is rewriting itself around certification classes and its 20x process. The clause that joins them has not moved: 7012(b)(2)(ii)(D) still says "FedRAMP Moderate baseline", a Rev5 term.

Two clocks

2023-12-21DoDDoD CIO memo sets what FedRAMP Moderate equivalent means.

2024-12-16CMMC32 CFR Part 170 takes effect.

2025-11-10CMMCPhase 1 begins with the DFARS CMMC rule.

2026-06-24FedRAMPConsolidated Rules for 2026 launch; Rev5 documents become legacy.

2026-07-13CMMCThe Department of War CIO suspends the advance to Phase 2.

2026-07-28FedRAMPFedRAMP Ready goes legacy; no new Ready submissions.

2027-01-01FedRAMPThe 2026 rules become mandatory for every provider.

2027-06-11FedRAMPNo new Rev5 certifications accepted.

Four things small shops get wrong

Common mistake

"Our cloud is FedRAMP, so we are CMMC compliant.": The cloud covers its side only. Your laptops, the network that connects to the service and your people stay in your assessment scope, and the provider's responsibility matrix goes in your SSP.
"The vendor says it is FedRAMP equivalent.": A claim is not evidence. Equivalency means a 3PAO assessment against the whole Moderate baseline and a body of evidence in your hands, and the memo puts the onus of checking it on you.
"In Process is close enough.": In Process and FedRAMP Ready are not Authorized, and Ready stopped taking new submissions on 2026-07-28. Until the Marketplace shows a certification, it is an equivalency claim.
"Our log tool needs FedRAMP too.": Not if it never holds CUI. A cloud that holds only Security Protection Data, such as logs and settings, is assessed with you as a Security Protection Asset instead.

Most of these show up when you draw the boundary. The CMMC scoping worksheet sorts each cloud service into the right asset category before an assessor does.

How we read the rules

Every row on this page comes from the rule text or from the named primary sources below, read on 2026-10-22: rule text is the rule's, and a standards body's, an agency's or a register's words are given as theirs. Where a rule is changing, the status box near the top says what is in force that day, and it is the one place we update when it moves.

Control counts are rows of the FedRAMP baseline workbook, counted by us.

CuiDeck is not a C3PAO, an assessor or a law firm. This page explains the rules; your contract and your contracting officer decide what applies to you.

Questions small shops ask

Questions

Is FedRAMP harder than CMMC?

It is bigger, and it is built for someone else. FedRAMP Moderate is 323 controls and enhancements from NIST SP 800-53 Rev 5; CMMC Level 2 is 110 requirements. The two are related: NIST says the 800-171 requirements are derived from the 800-53 moderate baseline. But a shop holding CUI never chooses between them, because FedRAMP is for the cloud provider and CMMC is for you.

If all our CUI lives in a FedRAMP High cloud, what is left for us?

Your side of the line. The computers and network that connect to the service are in your CMMC assessment scope, the provider's responsibility matrix goes in your SSP, and incident reporting stays with you. A good cloud shrinks the work; it never removes it. The SSP template has a section for the matrix.

Do we need a DoD impact level such as IL4 or IL5?

Only when the cloud is run on the Government's behalf. Then 7012(b)(1)(i) sends you to DFARS 252.239-7010, which applies the DoD Cloud Computing Security Requirements Guide. For a cloud you use for your own work on the contract, 7012(b)(2)(ii)(D) applies: FedRAMP Moderate or equivalent.

Did the CMMC suspension change the FedRAMP rule?

No. The suspension stops third-party CMMC assessments from being added to contracts. DFARS 252.204-7012 still applies, cloud paragraph included, and the deviated text used in new contracts keeps (b)(2)(ii)(D) word for word. What still applies is in CMMC status today.

Where do I check a provider's FedRAMP status?

On the offering's product page in the FedRAMP Marketplace on fedramp.gov. It labels an authorized offering "FedRAMP Certified" with a class: Class C (Moderate) or Class D (High); its status filter calls the same offerings "FedRAMP Authorized". Check the exact service name you are buying, and check again before you sign: the Marketplace's own guide says to verify the status has not changed.

Can our MSP's cloud count?

If it holds CUI, it meets the same test: Moderate Authorized or a full equivalency file. If it holds only logs, settings or admin credentials, it is assessed with you as a Security Protection Asset. How MSPs handle this is on CMMC managed service providers.