What Triggers a New CMMC Certification? Understanding "Significant Change"

Suppose you've already gone through the process of obtaining your Cybersecurity Maturity Model Certification (CMMC). In that case, you might wonder: What could trigger the need for a new assessment before your three-year certification expires? 

According to 32 CFR, the answer is this: A "significant change" to your environment will require a new CMMC assessment. 

But what exactly is a significant change? 

Let's break down what that means and what you should watch for. 

What Is a "Significant Change" Under CMMC? 

While "significant change" may seem vague, it's a cornerstone of determining whether your current certification still holds up. Suppose your organization undergoes a substantial shift in its IT environment, systems, or business processes that could affect how Controlled Unclassified Information (CUI) is protected. In that case, you might need to reassess your compliance. 

Common examples of significant changes could include: 

• Migrating to a new cloud service provider 
• Major expansion to your network architecture 
• Mergers, acquisitions, or structural reorganization 

Remember: The assessment is based on the environment that was certified. If that environment changes materially, you must evaluate whether your security posture has changed too. 

Who Decides What's a "Significant Change"? You Do Or the DoD Will 

Ultimately, it's your responsibility as an organization to determine what qualifies as a significant change in your environment. If you don't, the Department of Defense (DoD) will answer you, and likely their interpretation will be far more rigid. The DoD relies on NIST standards to evaluate security controls, which means their threshold for what counts as significant is typically much stricter. This can lead to more frequent assessments and added compliance burdens. The bottom line: define "significant change" yourself thoughtfully and defensibly. Because if you ask the DoD to decide for you, you may get more scrutiny than you bargained for. Use NIST 800-37 Rev 2 as your rubric; it's a solid framework for assessing whether a change affects your security posture enough to warrant a reassessment. 

Why It Matters Within the Three-Year Window 

CMMC certifications are valid for three years, but that doesn't mean you're in the clear for the full duration. If a significant change occurs, a reassessment may be necessary even if your certification hasn't expired. 

This protects not just your contract eligibility, but also the integrity of your systems and data. The Department of Defense (DoD) and other federal entities expect defense contractors to maintain a compliant cybersecurity environment throughout the certification period. 

How to Know If You Need a Reassessment 

Start by asking: 

• Has our CUI boundary changed? 
• Do we still meet our new environment's 110 NIST SP 800-171 requirements? 
• Would this change impact our original System Security Plan (SSP)? 
• Would a reasonable assessor agree that this is the same previously certified environment? 

If the answer to any of these is "no" or "I'm not sure," it's worth a deeper look and possibly reaching out to a C3PAO or consultant. 

Final Thoughts: Keep It Simple, Stay Compliant 

• CMMC certifications last for three years unless a significant change occurs. 
• Significant change = anything that materially alters your certified environment. 
• When in doubt, consult your documentation and consider reassessment. 

Need Help Navigating CMMC? 

Whether you're preparing for your first assessment or managing changes in a certified environment, we're here to help. Reach out to our team for expert guidance and practical tools that keep your CMMC compliance on track no matter what changes come your way.