CMMC Level 2 compliance on AWS: Why control ownership is where organizations struggle

This article explains CMMC Level 2 compliance challenges for defense contractors using AWS, emphasizing that control ownership clarity—not security controls themselves—is the primary struggle.

• CMMC Level 2 compliance requires clear ownership of 110 NIST SP 800-171 Rev 2 controls across providers
• FedRAMP authorization doesn't automatically satisfy CMMC; every control needs documented ownership and evidence
• MSP enclaves on AWS create new authorization boundaries requiring independent FedRAMP Moderate equivalency
• Customer Responsibility Matrices (CRMs) must define who implements each control, where, and what proves it
• Boundary drift—unmanaged expansion of assessment scope—silently erodes compliance over time
• CMMC assessments began January 2025; C3PAO-verified certifications become mandatory by November 2026
• Organizations must request explicit CRMs from every provider and embed continuous boundary validation in change management
• AWS GovCloud (US) required for ITAR/EAR data; commercial regions support standard CUI workloads

CMMC compliance requires disciplined control ownership documentation, rigorous boundary definition, and contractual accountability across all providers—not just cloud hosting location.