Quick Answer: When a CMMC C3PAO conducts your Level 2 assessment, they access sensitive Controlled Unclassified Information (CUI) from your organization. If your C3PAO lacks robust CUI protections—like a dedicated high-security enclave—your data is at risk. Smithers established a high-security enclave specifically to isolate and protect CUI during assessments, meeting the same NIST SP 800-171 standards it evaluates in its clients.
Defense contractors spend months preparing to protect their CUI. They implement access controls, encrypt data flows, and document every policy against the 110 security requirements in NIST SP 800-171. Then they invite a CMMC C3PAO into their environment to verify all of it. Here's the question most organizations never think to ask: what happens to your CUI once it's in your assessor's hands?
The answer matters more than many contractors realize. During a formal CMMC Level 2 assessment, a C3PAO collects evidence, reviews system documentation, and handles sensitive organizational data—including your System Security Plan (SSP) and the CUI that flows through your environment. A C3PAO with weak internal security controls creates a vulnerability at the precise moment you're trying to prove yours don't exist.
Choosing a CMMC C3PAO isn't just a compliance checkbox. It's a decision about who you trust with your most sensitive federal data.
Controlled Unclassified Information (CUI) is government-created or government-owned information that requires safeguarding but does not meet the threshold for classification as confidential, secret, or top-secret. That distinction is important: CUI isn't classified, but it remains highly valuable to adversaries. Procurement details, technical data, trade secrets, and personnel records all fall under the CUI umbrella.
Because CUI is widely disseminated across Defense Industrial Base (DIB) organizations—rather than restricted to a tight circle of personnel—it presents a broader attack surface than classified data. Access requires only a "lawful government purpose" rather than the stricter "need to know" standard applied to classified material. That relative accessibility makes CUI a frequent target for nation-state actors and other threat actors seeking a path into defense supply chains.
Executive Order 13556, issued in November 2010, created a standardized federal framework for identifying, safeguarding, and disseminating CUI. Since then, the DoD has formalized protection requirements for CUI through NIST SP 800-171 and, more recently, through the Cybersecurity Maturity Model Certification program.
CMMC 2.0 is a three-level cybersecurity framework developed by the DoD to protect both Federal Contract Information (FCI) and CUI across the defense supply chain. For most defense contractors handling CUI, CMMC Level 2 is the operative requirement.
Level 2 mandates full implementation of all 110 security requirements across the 14 control families defined in NIST SP 800-171 Revision 2. These requirements span access control, incident response, configuration management, media protection, and system and communications protection—among others. Unlike Level 1, which permits self-assessment, Level 2 certification for most CUI-handling organizations requires a formal third-party assessment conducted by an authorized CMMC C3PAO. Self-assessment is not a permissible path.
That third-party requirement exists for a reason. Independent verification provides the DoD with assurance that contractors have genuinely implemented the required controls—not just attested to them on paper. But it also means defense contractors must share sensitive system and security data with their chosen C3PAO. Which raises a critical question: what security standards govern how the C3PAO handles that data?
Here is the core tension that too few contractors address during C3PAO selection: the organization you hire to assess your CUI security will itself handle your CUI. Assessment activities involve examination of your SSP, interviews with personnel, and testing of implemented controls. Evidence collected during these activities can include detailed information about your systems, your vulnerabilities, and your organizational environment.
A CMMC C3PAO that does not operate within a disciplined security infrastructure creates real risk for its clients. If a C3PAO lacks adequate access controls, data segregation, or secure storage environments, the CUI collected during your assessment could be exposed—defeating the purpose of the entire compliance process.
The Cyber Accreditation Body (Cyber-AB) recognizes this risk. The authorization process for C3PAOs includes an assessment by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), which evaluates whether the C3PAO itself meets the security requirements it will assess in others. Achieving authorized C3PAO status is not a formality. It requires demonstrated compliance with the same NIST SP 800-171 framework that governs your organization's CUI handling.
Smithers achieved authorized CMMC C3PAO status from the Cyber-AB in October 2024 following a rigorous authorization process that included organizational background checks and a DIBCAC assessment. Critically, as part of that process, Smithers established a high-security enclave specifically designed to isolate and protect any CUI requiring segregation and protection during assessments.
That enclave is not incidental to Smithers' assessment capability—it is foundational to it. When Smithers assessors collect evidence from a client's environment, that data enters a controlled, protected space built to meet the same NIST SP 800-171 requirements Smithers evaluates in every engagement. The result is a closed-loop security posture: Smithers practices what it assesses.
Backed by 33 years of accredited third-party assessment experience, Smithers brings a depth of conformity assessment expertise that extends well beyond cybersecurity. The assessment team consists of Certified CMMC Assessors (CCAs) with hands-on technical experience evaluating all 110 controls and 320 assessment objectives defined under NIST SP 800-171 Revision 2.
Not every C3PAO handles CUI with equal rigor. When evaluating your options, ask the following directly:
These are not hypothetical concerns. They reflect the same control categories your organization must implement to earn CMMC certification—and your C3PAO should meet that same bar.
CMMC compliance requires significant organizational investment. The CUI your organization handles represents sensitive national security information—and that sensitivity doesn't pause during an assessment. Choosing a CMMC C3PAO that operates a high-security enclave, undergoes rigorous third-party authorization, and applies the same NIST SP 800-171 principles it evaluates is not optional. It is the standard your defense contracts require.
Smithers brings authorized C3PAO credentials, a dedicated CUI enclave, and more than three decades of third-party assessment experience to every CMMC engagement. Contact Smithers today to request a quote and learn how our certified assessors can support your path to Level 2 certification.
Secure your compliance with confidence—request a quote or contact us today to see how Smithers can help you achieve your CMMC goals efficiently and reliably.
CUI (Controlled Unclassified Information) is government-created or government-owned information that requires safeguarding but is not classified as confidential, secret, or top-secret. Defense contractors must protect CUI to comply with CMMC Level 2 requirements, maintain DoD contract eligibility, and prevent adversaries from exploiting sensitive national security-related data.
During a CMMC Level 2 assessment, a C3PAO accesses sensitive organizational data—including your System Security Plan and other evidence related to your CUI environment. If the C3PAO does not operate a secure internal environment, that data can be exposed. A C3PAO should maintain controls consistent with the NIST SP 800-171 requirements it assesses in its clients.
A high-security CUI enclave is a dedicated, isolated computing environment designed to store and process CUI with strict access controls, data segregation, and protections aligned to NIST SP 800-171. For a CMMC C3PAO, a CUI enclave ensures that client data collected during assessments is protected to the same standard the C3PAO evaluates in defense contractors.
Smithers achieved authorized C3PAO status from the Cyber Accreditation Body (Cyber-AB) in October 2024. The authorization process included a license agreement, organizational background checks, and an assessment by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). As part of that process, Smithers established a high-security enclave for CUI isolation and protection during assessments.
No. Under CMMC 2.0, the majority of defense contractors handling CUI are required to obtain a formal third-party assessment from an authorized CMMC C3PAO to achieve Level 2 certification. Self-assessment is not a permissible path for most organizations in this category.
CMMC Level 2 certification is valid for three years from the date of issuance. Organizations must undergo reassessment at the end of each three-year cycle and maintain continuous compliance with NIST SP 800-171 requirements throughout the certification period.
.jpg?ext=.jpg)
