CMMC Level 2 and SOC 2 readiness
Cohash engineers the technical controls behind CMMC Level 2 and SOC 2. We draw the scope boundary. We map NIST SP 800-171 requirements and the AICPA Trust Services Criteria to the systems you really run. Then we close the gaps, which usually means missing MFA, access nobody reviewed or thin logging, and automate evidence from identity, PAM and SIEM tools. The assessment is your assessor's or CPA firm's job. Ours is getting the evidence ready.
- 01Scope and data flows
- 02Control mapping
- 03Gap remediation
- 04Evidence automation
- 05Readiness review
The story
Told without the client's name or anything that could identify them.
An aerospace parts supplier's IT team was asked by a prime contractor for its SPRS score and by a commercial customer for a SOC 2 Type 2 report at about the same time. Evidence for access reviews was a folder of old screenshots, and nobody could say which systems held CUI, so the assessment boundary kept growing. We traced where CUI lived across email, file shares, PLM and ERP, and moved what we could into an enclave to narrow the boundary. NIST SP 800-171 requirements and the Trust Services Criteria were mapped once to the systems that implement them, with one owner per control. After closing the MFA, access review and logging gaps, we automated evidence from Entra ID, the IGA platform, PAM and SIEM, ran a mock assessment and handed the evidence index to the compliance owner.
why it was urgentThe DFARS CMMC rule took effect on 10 November 2025. On 13 July 2026 the Department suspended Phase 2 third-party Level 2 assessments pending a review, but self-assessments, SPRS scores and annual affirmations continue. SOC 2 reports use the AICPA 2017 Trust Services Criteria with revised points of focus (2022).
- openA prime contractor asked for your SPRS score and nobody is sure it's right.
- recurringA customer's security questionnaire asks for a SOC 2 Type 2 report you don't have.
- blockedEvidence for access reviews is a folder of screenshots from last year.
- openNobody can say which systems hold CUI. So the assessment boundary keeps getting bigger.
The estate, before and after
Before: controls in spreadsheets, evidence by screenshot
CUI was spread across email, file shares and business systems, so the boundary covered nearly everything. Control status lived in a spreadsheet and evidence was collected by hand as screenshots before each request.
Read the diagram as text
- Email and file shares → Control spreadsheet: assumed in scope
- PLM and ERP → Control spreadsheet: assumed in scope
- Identity provider → Screenshot folder: manual capture
- Control spreadsheet → Prime and customer requests: narrative answers
- Screenshot folder → Prime and customer requests: attachments
After: engineered controls with automated evidence
CUI sits inside a defined enclave, and the systems that implement controls feed a dated evidence index on a schedule. The control map ties each NIST SP 800-171 requirement and Trust Services Criterion to its system and owner.
Read the diagram as text
- CUI enclave → Entra ID or Okta: sign-in
- PLM and ERP → SIEM: audit logs
- Entra ID or Okta → Evidence index: scheduled export
- IGA platform → Evidence index: review results
- PAM → Evidence index: session records
- SIEM → Evidence index: log evidence
- Control map → Evidence index: requirement links
- Evidence index → Assessor or CPA firm: evidence package
How we run it, phase by phase.
5 phases take you from Controls in spreadsheets, evidence by screenshot to Engineered controls with automated evidence. Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Scope and data flows
Find where CUI or in-scope customer data lives across email, file shares, PLM, ERP and SaaS. Draw the boundary and decide what to move into an enclave rather than control everywhere.
- phase 02
Control mapping
Map NIST SP 800-171 requirements and the Trust Services Criteria to the systems that implement them, with one owner per control. Map shared controls once and reuse them for both.
- phase 03
Gap remediation
Close the technical gaps: MFA for privileged and network access, least privilege, access reviews, session controls, logging and retention, and configuration baselines.
- phase 04
Evidence automation
Pull evidence from Entra ID or Okta, the IGA platform, PAM and SIEM on a schedule, so each control has dated records instead of screenshots.
- phase 05
Readiness review
Run a mock assessment against the evidence, fix what an assessor would flag, and hand the SSP, policies and evidence index to your compliance owner.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
A boundary drawn around where CUI really lives
We documented how CUI flows and narrowed the in-scope systems. Sensitive work moved into an enclave, so controls didn't have to cover everything.
- result 02
One control map for both frameworks
We mapped NIST SP 800-171 requirements and the Trust Services Criteria to the same systems. Shared controls were mapped once, and each has a named owner.
- result 03
Evidence is pulled, not screenshotted
We collect identity, IGA, PAM and SIEM evidence on a schedule and file it in a dated evidence index. Over time that becomes the operating history a SOC 2 Type 2 period asks for.
- result 04
The technical gaps are closed
We put MFA on privileged and network access and scheduled the access reviews. Logging and retention meet the requirements now, and configuration baselines are in place.
- result 05
The SPRS score rests on evidence
We rebuilt the self-assessment score from system evidence and a mock assessment. The annual affirmation your counsel reviews now matches what the systems show.
Risks we plan for
-
A boundary that keeps growing
If CUI sits in every mailbox, every system is in scope. Narrowing the boundary early cuts the work more than any tool.
-
Policy without operation
SOC 2 Type 2 tests whether controls worked over a period of time. Turn a control on the week before the window opens and it has no history to show.
-
Treating the suspension as a pause
Phase 2 assessments are suspended, not the underlying DFARS 7012 and NIST SP 800-171 obligations. Primes still ask for them.
-
Inflated self-assessment scores
Posting an SPRS score your systems can't back up is a legal risk. We build the score from evidence, and your counsel reviews the affirmation before anyone signs it.
Where AI helps, and where it needs guardrails
AI tools now appear inside both scopes. Copilots that index SharePoint can surface CUI to the wrong person, so data labels and permissions are fixed first. We use AI agents to draft control narratives and match evidence to requirements, with a person checking every mapping. Agents that touch in-scope systems get their own identities and logs, because assessors will ask about them.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- design01
Scope boundary and CUI data flow diagram
yours to keep - evidence02
Control map covering NIST SP 800-171 and Trust Services Criteria
yours to keep - plan03
Gap remediation plan with owners and dates
yours to keep - evidence04
Automated evidence collection with a dated evidence index
yours to keep - report05
Mock assessment findings and fixes
yours to keep
Platforms and services on this move
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01Do we still need CMMC work after the Phase 2 suspension?
Yes. The suspension paused third-party Level 2 assessments. DFARS 252.204-7012, NIST SP 800-171, self-assessments, SPRS scores and annual affirmations still apply, and we'd plan as if third-party assessment will return.
02Can one program cover CMMC and SOC 2?
A good deal of it. Access control, MFA, logging and change management show up in both. Scope and reporting differ, though, which is why our mapping keeps each framework visible on its own.
03Are you the assessor?
No. CMMC assessments are run by a C3PAO and SOC 2 reports are issued by a CPA firm. We engineer the controls and evidence, and legal interpretation stays with your counsel.
04How long until we're ready?
Scope size and the number of gaps that need engineering drive most of it. With SOC 2 Type 2 you also wait out the observation period, however long your auditor sets it.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyAuth0 Rules and Hooks to Actions before end of life
Rewriting Auth0 Rules and Hooks as Actions before their 18 November 2026 end of life, with token claims compared before and after each change.
read the case study4ace11ae - 01Federal Register: DFARS CMMC final rule, effective 10 Nov 2025federalregister.gov ↗
- 02DoD CIO: Memorandum implementing the suspension of CMMC Phase II (Jul 2026)dodcio.defense.gov ↗
- 03WilmerHale: Pentagon suspends CMMC Phase 2 requirements (20 Jul 2026, secondary source)wilmerhale.com ↗
- 04eCFR: 32 CFR Part 170, CMMC Programecfr.gov ↗
- 05NIST: SP 800-171 Rev. 2, Protecting CUI in Nonfederal Systemscsrc.nist.gov ↗
- 06AICPA: 2017 Trust Services Criteria (with revised points of focus, 2022)aicpa-cima.com ↗
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it