CMMC Level 2 is an assessment of your organization, not your servers. But when an assessor walks through the 110 requirements of NIST SP 800-171, a surprising number of them land on hardware decisions made months earlier, at purchase time.
CMMC assesses you, not your suppliers. But the hardware a supplier delivers becomes your CUI Assets, your configuration baselines and your media-protection problem, and several Level 2 requirements are far easier to meet when the supplier has done its part.
Our third guide sets out seven things you are entitled to ask any hardware supplier for: their own CMMC status and whether it was assessed by a C3PAO; component provenance and supply-chain registrations such as ISO 28000 and O-TTPS; country-of-origin and TAA documentation for each product line; a sample as-built configuration record; a firmware and lifecycle support commitment; drive retention and sanitization options; and FIPS 140 CMVP certificate numbers for any encryption you rely on.
Each comes with the evidence a serious supplier should already have ready. For our part, we are CMMC Level 2 C3PAO certified, registered to ISO 9001, ISO 14001, ISO 28000 and O-TTPS 20243, and we answer all seven for our own systems.
To make it practical, the guide includes a fillable two-page checklist you can send with your RFQ and use, one copy per supplier, to track what was received and where it is filed.
Read the guide and download the checklist: What a CMMC contractor should require from its hardware supplier