Are CMMC Assessments Required for Classified Systems?

CMMC Does Not Apply to Classified Systems

CMMC is exclusively focused on unclassified information systems. If your organization operates classified systems, those are governed by separate security frameworks and oversight mechanisms.

What CMMC Covers vs What It Doesn't

• In scope: Unclassified systems processing FCI or CUI
• Out of scope: Classified systems, classified networks (SIPRNet, JWICS), and systems handling classified data

Separate Compliance Frameworks

Classified systems are governed by:

• NISPOM (32 CFR Part 117) — National Industrial Security Program Operating Manual
• ICD 503 / CNSSI 1253 — Intelligence Community and CNSS security standards
• DCSA oversight — Defense Counterintelligence and Security Agency manages facility clearances

It's important to understand that even if you have classified systems properly secured under NISPOM, you still need CMMC compliance for your unclassified systems that handle FCI or CUI. These are separate obligations.