How Do I Properly Handle System Changes While Maintaining CMMC Compliance?

Change Management for CMMC Compliance

Maintaining CMMC compliance isn't a one-time achievement — it requires ongoing vigilance, especially when making changes to your environment. The DoD provides a structured approach.

Step 1: Before Implementation — Evaluate

• Security Impact Analysis (CM.L2-3.4.4): Assess how the change affects your security posture
• CUI Flow Review (AC.L2-3.1.3): Determine if the change affects how CUI is processed, stored, or transmitted
• Change Management Documentation (CM.L2-3.4.3): Record the planned change in your CM process
• Affirming Official Review: Get consensus on whether the change impacts continued compliance

Step 2: During Implementation — Track

• Document the change and any temporary risks in your Operational Plan of Action (OPA) per CA.L2-3.12.2
• Identify responsible personnel
• Track progress to completion

Step 3: After Implementation — Update

• Update your System Security Plan (SSP) per CA.L2-3.12.4
• Modify all affected sections
• Review with Affirming Official before the next annual affirmation

The Bottom Line

If a security impact analysis reveals a new risk not covered in your existing SSP, you likely have a significant change that may require reassessment. When in doubt, document conservatively and consult with your Affirming Official.