Most defense suppliers run these as two separate programs. Quality lives with the quality manager, cybersecurity lives with IT, and the two teams meet at the all-hands. Each builds its own document library, its own audit schedule, its own corrective action log.
That separation is expensive, and it is mostly unnecessary.
The two frameworks govern different subject matter — one is about whether your product meets requirements, the other is about whether Controlled Unclassified Information stays protected. But both are evidence-driven: documentation is examined, people are interviewed, and implementation is tested against what the organization says it does. Under CMMC, that assessment may currently be performed by the organization itself, or later by a C3PAO or government assessor depending on the applicable assessment path.
If you already hold ISO 9001 certification, you have spent years building the machinery that produces that kind of proof. This post is about which parts of it carry over to CMMC, which parts do not, and how to stop running two programs that are ninety percent the same shape.
Two Frameworks, One Question
ISO 9001:2026, published September 16, 2026, is the current edition of the international quality management system standard. Many organizations will be transitioning from ISO 9001:2015. The clause numbers cited in this guide are the same in the 2015 and 2026 editions. CMMC, the Cybersecurity Maturity Model Certification, is the Department of Defense framework for verifying protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) where an applicable DoD contract requires a CMMC status, governed by 32 CFR Part 170.
Different subjects. Nearly identical method of proof.
The last row is the one that matters for the rest of this post. Both frameworks depend on objective evidence that implementation matches documented requirements. That is why the management-system disciplines built for ISO 9001 — document control, internal audit, corrective action, management review, and competence records — can be useful infrastructure for CMMC readiness even though the security requirements themselves are different.
Why the Proof Standard Matters More Right Now
On July 13, 2026, DoD announced the immediate suspension of CMMC Phase 2 requirements — the third-party C3PAO assessment milestone that had been scheduled to take effect on November 10, 2026 — along with later implementation milestones. The CMMC Reform Task Force was directed to deliver a final report to the Department CIO within 60 days. No public replacement Phase 2 schedule has been announced; Phase 1 self-assessment requirements remain in effect, and Phase 2 remains suspended. During the suspension, the Department is enforcing NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments. The underlying Level 2 (C3PAO) provisions remain in 32 CFR Part 170; their Phase 2 implementation has been suspended, not eliminated.
Last reviewed: October 22, 2026
Phase 1 has been in effect since November 10, 2025, and remains in place. The Department currently may require Level 1 annual self-assessments and Level 2 (Self) assessments every three years, with the applicable affirmations entered in SPRS. NIST SP 800-171 Rev 2, DFARS 252.204-7012 and its 72-hour incident-reporting clock, and applicable subcontractor flow-down obligations remain in force.
Read that carefully, because it changes who is holding the pen. With third-party assessment paused, the document that carries your legal exposure is the one you fill out yourself.
Recent Justice Department Civil Cyber-Fraud Initiative settlements illustrate the exposure when cybersecurity representations and actual implementation diverge. Honeywell Aerospace agreed to pay $2,042,518 in a settlement announced September 1, 2026. LOGZONE Inc. agreed to pay $507,144 on June 18, 2026 after a government assessment scored its environment at −170. Raytheon and Nightwing agreed to pay $8.4 million in a settlement announced May 1, 2025, resolving allegations involving 29 DoD contracts and subcontracts. The claims resolved by these settlements were allegations; there was no determination of liability.
An SPRS score starts at 110 and generally deducts 5, 3, or 1 point for requirements that are not fully implemented, with a floor of −203. The scoring methodology includes limited partial-credit treatment for specific MFA and FIPS-related requirements, so partial implementation should not be described as universally earning nothing. A 280-point gap between what a contractor claimed and what an assessor found is not a rounding error, and it is not the kind of thing an organization with a functioning internal audit program should discover for the first time from the government.
How CMMC Assessors Actually Decide
This is where quality managers tend to recognize the terrain.
CMMC Level 2 covers all 110 NIST SP 800-171 Rev 2 security requirements across 14 families. But an assessor does not evaluate 110 things. NIST SP 800-171A decomposes those 110 requirements into 320 determination statements — granular, individually testable assertions. Every determination statement under a requirement has to be satisfied before that requirement counts as implemented.
For each one, the assessor applies three methods: examine documents and artifacts, interview the people who do the work, and test the mechanisms themselves. Any auditor who has run an ISO 9001 internal audit has used all three without calling them that.
The evidence then has to clear two separate bars. Adequacy asks whether it is the right evidence — does this artifact actually demonstrate the intent of the requirement. Sufficiency asks whether there is enough of it to cover the full assessment scope. An organization can fail on sufficiency while every individual document is perfectly good, simply because the sample does not reach every system and every group in scope.
For a Level 2 certification assessment, 32 CFR 170.17 requires assessment artifacts used as evidence to be hashed using a NIST-approved algorithm and retained for six years from the CMMC Status Date. That hashing requirement should not be generalized to Phase 1 Level 2 self-assessment evidence.
Version control. Access rules. Retention and disposition. Records kept as proof that something was done. That vocabulary is familiar because ISO 9001 has long required controlled documented information and retained evidence.
What Your QMS Already Gives You
A mature quality management system is not a head start on CMMC’s security controls. It is a head start on the evidence discipline that surrounds them — which, in practice, is where most small and mid-size contractors lose time.
The pattern across all six rows is the same. The habit transfers; the content does not. You are not starting a document control program from zero, you are extending one you already run to a new category of document. You are not standing up an internal audit function, you are adding a scope to an existing calendar and training the auditors on a different checklist.
That distinction can save substantial time. First-time NIST SP 800-171 gap assessments often surface significant implementation gaps. Contractors with a working QMS may not have fewer security gaps, but they already have mature mechanisms for documenting findings, assigning actions, retaining evidence, and verifying closure.
Corrective Action Is the Strongest Bridge
Of everything ISO 9001 asks for, corrective action transfers most directly, and it is the one most contractors overlook.
ISO 9001 requires organizations to react to nonconformities, address causes as appropriate, implement corrective action, review effectiveness, and retain documented information about the issue and response. Corrective action is the engine that turns a finding into a change that holds.
Now read NIST SP 800-171’s requirement 3.12.2: develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities. That is the Plan of Action and Milestones, the POA&M, and it is a corrective action log with a different cover sheet. Requirement 3.11.3 asks you to remediate vulnerabilities in accordance with risk assessments. The 3.6 family asks for incident handling with tracking and reporting. Every one of those is a finding that needs an owner, a cause, a fix, and proof the fix worked.
Two details separate the security version from the quality one. First, when a Level 2 assessment qualifies for Conditional status, eligible POA&M items must be closed within 180 days of the CMMC Status Date. Second, POA&M use is limited: only eligible requirements may be deferred, and several specifically identified requirements cannot be placed on a POA&M at all.
Neither of those is a reason to build a second system. They are fields on the same register. If your quality team already runs root cause analysis competently, the fastest thing you can do for your CMMC program is stop letting IT track security findings in a spreadsheet and route them through the process that already works. We cover the mechanics of that process in detail in the CAPA process step by step, and building it inside Microsoft 365 is a core part of our QMS consulting work.
What ISO 9001 Does Not Give You
Being honest about the limits of the overlap matters more than the overlap itself, because the failure mode here is expensive.
ISO 9001 contains no cybersecurity controls. Not one. It will not tell you to enforce multi-factor authentication, use FIPS-validated cryptography, restrict CUI to authorized users, monitor and control remote access, or protect the boundary of the system that holds your CUI. Those are the substance of the 110 requirements, and a QMS gives you exactly zero of them.
Nor is your ISO 9001 certificate evidence of anything under CMMC. Assessors evaluate implementation of specific requirements against specific determination statements. A registrar’s certificate for a different standard is not an input to that judgment.
The same goes for AS9100. The 9100 standard — SAE AS9100D, the quality management system requirements for aviation, space and defense organizations — contains ISO 9001:2015 in full and adds roughly a hundred aviation, space and defense-specific requirements on top, covering things like configuration management, counterfeit part prevention, product safety, and first article inspection. It is a more demanding quality standard. It is still a quality standard, and it holds no cybersecurity requirements. Contractors who assumed an AS9100 certificate would carry weight in a DoD cybersecurity conversation have found out otherwise, usually at the worst possible moment.
The honest summary: your QMS is scaffolding, not substance. It shortens the documentation and evidence work substantially. It does nothing about the controls themselves. For what those controls actually involve, see our breakdowns of CMMC Level 1 requirements and CMMC Level 2 requirements.
Where ITAR Fits
If you handle ITAR-controlled technical data, there is a third overlap worth naming, because it is frequently misunderstood.
The International Traffic in Arms Regulations sit at 22 CFR Parts 120–130 and are administered by the State Department’s Directorate of Defense Trade Controls. Part 122 covers registration of manufacturers, exporters, temporary importers, and providers of defense services; a manufacturer may have to register even if it does not export. Brokering registration is addressed separately in Part 129. Releasing controlled technical data to a foreign person in the United States can also constitute an export under the ITAR.
ITAR imposes no quality management requirement and offers no certification to achieve. It does impose access and export-control obligations on covered defense articles, services, and technical data. ITAR-controlled technical data can overlap with the Export Controlled (EXPT) category in the CUI Registry, but not every ITAR-controlled item is automatically CUI; CMMC scope still depends on the information and contractual context.
That is a convenient place to consolidate. The document control system your QMS already runs is where those files live; the access controls CMMC requires are what enforce who can open them; and your ITAR obligation is the reason the enforcement has to be provable rather than assumed.
How to Run One Program Instead of Two
Practically, integration comes down to four decisions:
One controlled document-management approach. Quality procedures, security policies, the System Security Plan, and work instructions can use the same governance model for versioning, approval, access, and retention. If the QMS runs in SharePoint, the SSP may use the same platform only if the repository and access model are appropriate for the CMMC scope and the information stored there; do not move CUI into a QMS repository simply to consolidate tooling.
One audit calendar. Your internal audit schedule gains a security scope. Same program, same cadence, same reporting line into management review; different checklist, and auditors trained against the 320 determination statements rather than process conformity.
One corrective action register. Quality nonconformities and security findings enter the same log with the same fields. A “source” column tells you which framework a row answers to, and POA&M reporting becomes a filtered view rather than a parallel document.
One management review. Clause 9.3 already requires leadership to review the system on a planned basis with retained minutes. Add SPRS score, open POA&M items, and incident history to that agenda. This is also the meeting where the senior official who signs the annual SPRS affirmation gets the information that makes the signature defensible.
None of this is exotic. It is the ordinary work of running a management system, pointed at a second body of requirements.
Frequently Asked Questions
Does ISO 9001 certification help with a CMMC assessment?
Yes, but not in the way most people expect. ISO 9001 gives you no security controls — it contributes nothing to the 110 NIST SP 800-171 requirements themselves. What it gives you is the evidence discipline CMMC assessments run on: document control, internal audit, corrective action, management review, and training records. Since assessors evaluate documented evidence for adequacy and sufficiency, an organization that already produces that kind of evidence routinely tends to move through readiness faster than one starting from scratch.
Can I use my ISO 9001 documentation as CMMC evidence?
Quality procedures are not automatically CMMC evidence; they count only when they demonstrate implementation of a relevant CMMC requirement. The document-control system, audit program, corrective-action process, and training-record mechanisms can often be extended to support security evidence. The content is different; much of the management-system machinery can be reused.
Does AS9100 certification satisfy any CMMC requirements?
No. AS9100 contains ISO 9001:2015 in full plus roughly a hundred additional aviation, space and defense requirements, all of them quality requirements. It includes no cybersecurity controls, and a CMMC assessor does not credit certification against a different standard. It does mean your quality system is unusually mature, which helps with the documentation work — but it does not move you a single requirement closer to Level 2.
Is CMMC still required given the Phase 2 suspension?
The suspension pauses Phase 2 and later implementation milestones, not the underlying safeguarding obligations. The Department currently remains in Phase 1, with Level 1 and Level 2 (Self) assessment paths in effect. DFARS 252.204-7012, NIST SP 800-171 Rev 2, applicable affirmations, and subcontractor flow-down obligations remain in force, with enforcement through self-assessments and select government-led assessments.
How does a POA&M differ from a corrective action plan?
Structurally they are similar: a finding, an owner, milestones, target dates, and evidence of closure. For CMMC Level 2, however, POA&M use is permitted only for eligible requirements and only when the assessment qualifies for Conditional status; eligible items must be closed within 180 days of the CMMC Status Date. Several specifically identified requirements are never eligible for a POA&M. If you already run corrective action well, you have useful process infrastructure for managing POA&M work.
Do I need ISO 9001 to get CMMC certified?
No. The two are independent, and plenty of contractors achieve Level 2 with no quality certification at all. The reverse is also true — ISO 9001 certification is not a prerequisite, a shortcut, or a partial credit. The relationship is practical rather than formal: one makes the other easier to evidence.
Build the Bridge Once
If you are carrying both obligations, the worst outcome is two teams building two document libraries, two audit programs, and two corrective action logs that never speak to each other. It costs more, it produces inconsistent answers when someone asks the same question of both systems, and it wastes the discipline you have already paid to build.
Abel Solutions works both sides of this. We build quality management systems inside Microsoft 365 and SharePoint through our QMS consulting and ISO 9001 certification consulting practices, and we run CMMC consulting for defense contractors preparing for assessment. Thirty years of building document and process systems for small and mid-size businesses is what makes the integration argument more than theory. As part of SGS/ATS, a global Testing, Inspection, and Certification organization, we will still be here at your next assessment cycle.
Start with a conversation about what you already have. In most cases it is more than your team thinks.
