--- title: Seven things to require from your hardware supplier under CMMC description: The same 110 CMMC requirements apply to a mission computer in a vehicle as to a data-center server. How scoping, hardware and zeroization close the gap. image: https://blog.ncst.com/hubfs/ruggedserver418/btn-choose.png --- [![myncsbutton](https://blog.ncst.com/hs-fs/hub/424090/file-2068907142.png)](https://my.ncst.com/ncsapp/ssl/CustSignIn.aspx) [![NCS-Blue-Logo-400](https://blog.ncst.com/hs-fs/hubfs/NCS-Blue-Logo-400.png?width=205&height=85&name=NCS-Blue-Logo-400.png)](http://www.ncst.com/)   - [About NCS](https://www.ncst.com/about/) - [Leadership](https://www.ncst.com/leadership/) - [Careers](https://www.ncst.com/careers/) - [Corporate Commitments](https://www.ncst.com/corporate-commitments/) - [Upcoming Events](https://www.ncst.com/upcoming-events/) - [In the News](https://www.ncst.com/in-the-news/) - [Document Library](https://www.ncst.com/document-library/) - [Contact Information](https://www.ncst.com/contact-information/) - [Solutions](https://www.ncst.com/solutions/) - [Client and Printer Integration](https://www.ncst.com/solutions/client-and-printer-integration/) - [Mobile Client and Printer Integration](https://www.ncst.com/solutions/client-and-printer-integration/) - [Mission Rugged Systems](https://www.ncst.com/rugged-servers-special-mission-systems/) - [Rack-Scale Integration](https://www.ncst.com/solutions/rack-scale-integration/) - [OEM Appliance Development](https://www.ncst.com/solutions/oem-server-appliance/) - [Additive Manufacturing/3D print](https://www.ncst.com/solutions/additive-manufacturing/) - [Why Source From NCS](https://www.ncst.com/solutions/why-source-from-ncs/) - [Products](https://www.ncst.com/products/) - [Enterprise Products](https://www.ncst.com/products/enterprise-products/) - [Client Products](https://www.ncst.com/products/client-products/) - [Additive Manufacturing / 3D Products](https://www.ncst.com/products/additive-manufacturing-products/) - [Peripheral Products](https://www.ncst.com/products/peripherals-products/) - [Technology Building Blocks](https://www.ncst.com/products/technology-building-blocks/) - [Why Buy From NCS](https://www.ncst.com/products/why-buy-from-ncs/) - [Customers](https://www.ncst.com/customers/) - [Contracts](https://www.ncst.com/contracts/) # The View From NCS Technologies ## [Seven things to require from your hardware supplier under CMMC](https://blog.ncst.com/seven-things-to-require-from-your-hardware-supplier-under-cmmc) Posted by [Mike Turicchi](https://blog.ncst.com/author/mike-turicchi) on Sep 28, 2026, 8:59:59 AM - [Tweet](https://twitter.com/share) ![leadphoto](https://blog.ncst.com/hs-fs/hubfs/leadphoto.jpg?width=380&height=240&name=leadphoto.jpg) CMMC Level 2 is an assessment of your organization, not your servers. But when an assessor walks through the 110 requirements of NIST SP 800-171, a surprising number of them land on hardware decisions made months earlier, at purchase time. CMMC assesses you, not your suppliers. But the hardware a supplier delivers becomes your CUI Assets, your configuration baselines and your media-protection problem, and several Level 2 requirements are far easier to meet when the supplier has done its part. Our third guide sets out seven things you are entitled to ask any hardware supplier for: their own CMMC status and whether it was assessed by a C3PAO; component provenance and supply-chain registrations such as ISO 28000 and O-TTPS; country-of-origin and TAA documentation for each product line; a sample as-built configuration record; a firmware and lifecycle support commitment; drive retention and sanitization options; and FIPS 140 CMVP certificate numbers for any encryption you rely on. Each comes with the evidence a serious supplier should already have ready. For our part, we are CMMC Level 2 C3PAO certified, registered to ISO 9001, ISO 14001, ISO 28000 and O-TTPS 20243, and we answer all seven for our own systems. To make it practical, the guide includes a fillable two-page checklist you can send with your RFQ and use, one copy per supplier, to track what was received and where it is filed. **Read the guide and download the checklist:** [What a CMMC contractor should require from its hardware supplier](https://www.ncst.com/cmmc/hardware-supply-chain/) Topics: [security](https://blog.ncst.com/topic/security), [cybersecurity](https://blog.ncst.com/topic/cybersecurity), [U.S. Government](https://blog.ncst.com/topic/u-s-government), [DoD](https://blog.ncst.com/topic/dod), [CMMC](https://blog.ncst.com/topic/cmmc) ## Your Technology Resource   ### Subscribe to Email Updates ### Recent Posts ### Posts by Topic - [military (342)](https://blog.ncst.com/topic/military) - [VDI (275)](https://blog.ncst.com/topic/vdi) - [rugged (264)](https://blog.ncst.com/topic/rugged) - [virtualization (203)](https://blog.ncst.com/topic/virtualization) - [PCoIP (189)](https://blog.ncst.com/topic/pcoip) - [Healthcare (186)](https://blog.ncst.com/topic/healthcare) - [U.S. Government (171)](https://blog.ncst.com/topic/u-s-government) - [Servers & Appliances (106)](https://blog.ncst.com/topic/servers-appliances) - [software (105)](https://blog.ncst.com/topic/software) - [hospitals (95)](https://blog.ncst.com/topic/hospitals) - [3Dprinting (93)](https://blog.ncst.com/topic/3dprinting) - [endpoints (93)](https://blog.ncst.com/topic/endpoints) - [additive (91)](https://blog.ncst.com/topic/additive) - [federal (91)](https://blog.ncst.com/topic/federal) - [HP (86)](https://blog.ncst.com/topic/hp) - [government (83)](https://blog.ncst.com/topic/government) - [teradici (83)](https://blog.ncst.com/topic/teradici) - [manufacturing (70)](https://blog.ncst.com/topic/manufacturing) - [U.S. Air Force (64)](https://blog.ncst.com/topic/u-s-air-force) - [computers (63)](https://blog.ncst.com/topic/computers) - [vmware (59)](https://blog.ncst.com/topic/vmware) - [commercial (56)](https://blog.ncst.com/topic/commercial) - [tablets (53)](https://blog.ncst.com/topic/tablets) - [U.S. Navy (51)](https://blog.ncst.com/topic/u-s-navy) - [NCS3Dprinting (49)](https://blog.ncst.com/topic/ncs3dprinting) - [zeroclients (30)](https://blog.ncst.com/topic/zeroclients) - [navy (22)](https://blog.ncst.com/topic/navy) - [metal (21)](https://blog.ncst.com/topic/metal) - [Getac (18)](https://blog.ncst.com/topic/getac) - [defensemanufacting (16)](https://blog.ncst.com/topic/defensemanufacting) - [cybersecurity (14)](https://blog.ncst.com/topic/cybersecurity) - [security (14)](https://blog.ncst.com/topic/security) - [trumpf (13)](https://blog.ncst.com/topic/trumpf) - [vmworld (12)](https://blog.ncst.com/topic/vmworld) - [army (11)](https://blog.ncst.com/topic/army) - [Financial Sector (9)](https://blog.ncst.com/topic/financial-sector) - [PCs (9)](https://blog.ncst.com/topic/pcs) - [SecureView (9)](https://blog.ncst.com/topic/secureview) - [manageability (9)](https://blog.ncst.com/topic/manageability) - [Servers (7)](https://blog.ncst.com/topic/servers) - [Virtualized Users (7)](https://blog.ncst.com/topic/virtualized-users) - [thinclients (7)](https://blog.ncst.com/topic/thinclients) - [HPE (6)](https://blog.ncst.com/topic/hpe) - [WiFi (6)](https://blog.ncst.com/topic/wifi) - [hpenterprise (6)](https://blog.ncst.com/topic/hpenterprise) - [Air Force (5)](https://blog.ncst.com/topic/air-force) - [infrastructure (4)](https://blog.ncst.com/topic/infrastructure) - [hardware (3)](https://blog.ncst.com/topic/hardware) - [packaging (3)](https://blog.ncst.com/topic/packaging) - [ssds (3)](https://blog.ncst.com/topic/ssds) - [storage (3)](https://blog.ncst.com/topic/storage) - [thinclient (3)](https://blog.ncst.com/topic/thinclient) - [westerndigital (3)](https://blog.ncst.com/topic/westerndigital) - [CMMC (2)](https://blog.ncst.com/topic/cmmc) - [DoD (2)](https://blog.ncst.com/topic/dod) - [HP printing (2)](https://blog.ncst.com/topic/hp-printing) - [airforce (2)](https://blog.ncst.com/topic/airforce) - [roboze (2)](https://blog.ncst.com/topic/roboze) - [workstations (2)](https://blog.ncst.com/topic/workstations) - [Appliances (1)](https://blog.ncst.com/topic/appliances) - [delaware (1)](https://blog.ncst.com/topic/delaware) - [desktop (1)](https://blog.ncst.com/topic/desktop) - [fsae (1)](https://blog.ncst.com/topic/fsae) - [hyperconverged (1)](https://blog.ncst.com/topic/hyperconverged) - [militaryhardware (1)](https://blog.ncst.com/topic/militaryhardware) - [university (1)](https://blog.ncst.com/topic/university) see all ### Follow Me ©2012 NCS Technologies, Inc. All Rights Reserved - [Section 508](http://www.ncst.com/content/section-508) - [Privacy Policy](http://www.ncst.com/content/privacy-statement) - [Terms of Use](http://www.ncst.com/content/terms-use) - [Sitemap](http://www.ncst.com/sitemap)