A defense contractor facing CMMC Level 2 has a decision to make before a single control gets implemented: where will controlled unclassified information (CUI) actually live? There are two broad answers. The company can build a compliant environment of its own, or it can move its CUI handlers into an environment that someone else has already built, secured, and keeps running. Both paths end in the same place, with the 110 requirements of NIST SP 800-171 implemented and provable. They differ a great deal in what they cost, how long they take, and who is responsible for what along the way.
A Note on Dates
At the time of writing, the Department of War has suspended the Phase 2 transition that would have made third-party certification a condition of award, while a review of the program is underway. Self-assessment requirements and the underlying NIST SP 800-171 obligations in defense contracts remain in force, and prime contractors can still ask for evidence. Because policy dates may keep moving, it is safer to plan around the controls, which are not changing, than around any single deadline. Anyone reading this later should confirm current guidance before committing to a schedule.
What Building Actually Involves
Building means the contractor assembles and operates the whole compliant environment. The work typically includes:
- Defining the CUI boundary so the company knows exactly which people, systems, and data are in scope
- Standing up a compliant platform, such as a government-grade cloud tenancy or a hardened on-premises setup
- Configuring identity, access, and multi-factor controls, plus encryption that meets the required standards
- Running continuous logging, monitoring, and incident response, usually around the clock
- Writing policies, the System Security Plan, and a Plan of Action and Milestones
- Collecting evidence, correcting gaps found in a readiness review, and preparing for assessment
None of this is exotic, but it requires skills many small and midsized contractors do not have on staff. Hiring or contracting those skills, buying the tooling, and working through several rounds of remediation is where the time goes. Commonly cited estimates for building from scratch run from six months to well over a year, depending on the starting point and available staff.
What Inheriting Actually Involves
Inheriting means the contractor’s CUI handlers work inside an environment that a provider has already built, secured, and had assessed. Under a CMMC Managed Services arrangement, the contractor migrates its CUI and the relevant users into that environment, onboards to the provider’s tools, and agrees a written matrix that divides each control into what the provider manages, what the contractor manages, and what is shared.
The contractor does not hand off everything. It still owns its policies, its System Security Plan, its self-assessment and score, and the annual affirmation by a company officer. What it avoids is constructing and operating the technical foundation. Providers that offer this model typically quote a timeline of a few months, often in the range of 60 to 120 days, depending on how much preparation is already done.
Comparing Cost: Where the Money Goes
The two options have different cost shapes, which makes a single-year comparison misleading.
| Cost Area | Building | Inheriting |
| Upfront spending | Engineering time, licensing, security tooling, consultants, remediation | Migration, onboarding, and the contractor’s own documentation work |
| Ongoing spending | Staff or a provider to monitor, patch, and keep evidence current | Recurring service fee for users in scope |
| Scope of the controls | Easy to apply broadly, so cost can expand with headcount | Confined to the people and data moved into the environment |
| Cost risks | Rework after a failed assessment, staff turnover, tool sprawl | Dependence on the provider, switching costs if the relationship ends |
The biggest lever is scope. Consider a hypothetical 60-person firm in which 10 people touch CUI. Building a compliant environment for the whole company applies the strictest controls to all 60 users and systems. Confining CUI to a small, well-defined environment, whether built or inherited, limits the strictest controls to those 10. Either route can use this approach, but it is far easier to maintain when the boundary is drawn deliberately at the start.
Over a three-year window, the comparison also needs the recurring items: monitoring, patching, evidence upkeep, training, annual affirmations, and a reassessment cycle. Building front-loads cost into the first year. Inheriting spreads it into steadier monthly payments. Neither is automatically cheaper, and the answer depends heavily on how many users are in scope and whether the company already has qualified security staff.
Comparing Timelines
The difference in timeline mostly reflects what has to happen before evidence exists.
| Stage | Building | Inheriting |
| Scoping the CUI boundary | Required, often takes weeks | Required, usually faster with a provider’s template |
| Environment ready | Months of procurement, configuration, and testing | Already in place, with migration scheduled |
| Evidence collection | Starts after controls are live | Provider evidence available from the first day |
| Remediation | Frequently several cycles | Concentrated on the contractor’s own policies and users |
Building tends to run into the usual project delays, including hiring, procurement, learning curves, and rework. Inheriting compresses the technical stages but not the contractor’s own work, so a company with no documentation still needs time to write it.
What Inheriting Does Not Take Off Your Plate
Moving into a provider’s environment does not transfer accountability. A few responsibilities stay with the contractor:
- Policies, procedures, and the System Security Plan that describe how the company actually operates
- Employee behavior, training, and handling of CUI outside the environment
- Verifying the provider’s status, the scope it covers, and what the shared responsibility matrix actually says
- Flow-down requirements to its own subcontractors
- The annual affirmation, which a company officer signs
A contractor that treats inheritance as a way to stop thinking about compliance is likely to find gaps at the worst moment.
When Each Path Makes More Sense
Building often fits companies with many CUI users, an existing security team, other regulated workloads, or a strong preference for direct control. Inheriting often fits companies with a small CUI population, no dedicated security staff, a near-term bid pipeline, or limited capital for a large first-year project. Many organizations start by inheriting and bring pieces in-house later as they grow.
Questions to Settle Before Choosing
- How many people and systems truly handle CUI?
- Does the company have staff who can run monitoring and keep evidence current?
- What would a delayed or failed assessment cost in lost bids?
- If the provider relationship ended, who would keep the records and configurations?
- Has the comparison been run over three years rather than one?
Compare the Whole Picture
The right choice is rarely the one with the lowest first-year number. It is the one whose three-year cost, timeline, and level of control fit the contracts the company expects to pursue. Whichever route a contractor takes, the controls behind a defensible score do not change, and neither does the need to prove them with evidence. The comparison simply decides who builds the foundation and how soon the evidence starts to exist.
