Level 1 Plus Encryption
Calder Precision is a 45-person job shop. Its DoD work today involves FCI only - purchase orders, delivery schedules, and quality records - so it built its posture around the 17 Level 1 practices and submitted an annual self-assessment with the owner's affirmation. A new RFQ from a prime includes DFARS 252.204-7012 and a draft subcontract requiring CMMC Level 2. Calder will receive CUI: customer CAD files carrying distribution statements and export-controlled test specifications. Calder's IT provider proposes to 'keep the Level 1 controls, add encrypted email and a SharePoint site, and inherit everything else from the Microsoft GCC environment,' arguing this covers most of the 110 requirements and that Level 1 plus encryption is 'effectively Level 2.' The owner wants to bid next month.
1. Is 'Level 1 plus encryption' an adequate basis for meeting a Level 2 requirement? Justify the answer in terms of how the model is structured.
Read the worked answer
No, and the reasoning matters more than the conclusion.
- Levels are cumulative and practice-defined, not risk-equivalent. Level 2 is the full set of NIST SP 800-171 security requirements (110 practices in the Rev 2 baseline currently used by the program). There is no substitution mechanism, no 'equivalent control' credit, and no partial-level status. Meeting 25 practices well is not Level 2 minus some points; it is not Level 2.
- The trigger changed. Once Calder receives CUI, its prior FCI-only rationale disappears. Level 1's 17 practices map to FAR 52.204-21 and were never designed to protect CUI.
- One control is not a category. Encrypted email addresses a transmission-protection concern. Level 2 also demands access control, audit logging and review, configuration baselines, incident response, personnel screening, physical protection, risk assessment, and system security planning - most of which the described plan does not touch.
- The prime's clause, not Calder's convenience, sets the bar. If the subcontract requires Level 2 (and a certification assessment rather than a self-assessment), the only compliant end state is a Level 2 assessment result.
Practical corollary: the IT provider's framing is a common and expensive mistake - it converts a 110-practice gap into a one-month project on paper.
2. Evaluate the inheritance claim: 'we'll inherit everything else from the GCC environment.' What can Calder legitimately inherit, and what must it own?
Read the worked answer
Inheritance is real but narrow and must be documented.
- Mechanism. Cloud controls are inherited through a shared-responsibility model. Calder can claim inherited implementation only for practices the provider actually performs in the configuration Calder uses, evidenced by the provider's authorization (FedRAMP Moderate or equivalent per the applicable DFARS requirement) and the customer responsibility matrix for the specific services.
- Configuration is the catch. A GCC tenant with permissive sharing, no DLP, no retention/audit configuration, and unmanaged devices inherits very little of value. Inherited infrastructure does not cure how Calder configures and uses it.
- What stays with Calder regardless: personnel security and screening, physical protection of its own facility and shop floor, incident response (including its 72-hour reporting obligation under 252.204-7012), awareness and training, risk assessment, configuration management of endpoints and the MES, media protection for paper and removable media, and the SSP that describes all of it.
- Documentation. Every inherited practice needs a written inheritance statement in the SSP tracing to provider evidence. Undocumented inheritance is a finding waiting to happen.
So the honest framing is: Calder inherits a portion of the technical control surface and must implement, operate, and evidence the remainder.
3. The owner wants to bid next month. What planning judgement should you give about assessment route and timeline?
Read the worked answer
Separate three questions that are being collapsed into one.
- What does the solicitation require? A Level 2 certification assessment by a C3PAO versus a Level 2 self-assessment with senior-official affirmation are different obligations with different timelines and different evidence burdens. Only the contract text and the DoD prioritization status of the acquisition settle this.
- What can realistically be true in 30 days? Bidding is not certifying. Calder can bid while its compliance program is in flight, but it cannot compress a 110-practice implementation, an SSP, and a C3PAO engagement into a month. C3PAO scheduling lead time alone commonly exceeds that. If the clause requires certification at award, bidding next month is a bet the owner should make with eyes open - document the assumption and the risk.
- What is the minimum honest posture right now? An accurate SPRS score reflecting current implementation (not aspiration), a defined CUI boundary even if small, a written plan with owners and dates, and a decision on whether to narrow the CUI exposure - for example, having the prime handle CUI-heavy work items - to reduce the practices Calder must implement.
Advice: do not promise the owner a Level 2 certification date you cannot control. Recommend a bid decision that distinguishes 'we can perform this work compliantly if the prime accepts a phased approach' from 'we can be certified by June.'