Introduction
A prime contractor sends a cybersecurity questionnaire. Your team scrambles, answers a few items from memory, and submits. Weeks later come follow-up questions, evidence requests, and a stalled onboarding. Incomplete or unsupported answers create real friction.
The Cybersecurity Compliance and Risk Assessment (CCRA) is a supplier-focused process for collecting compliance and risk information. It is not a certification, and not every U.S. contractor must complete one.
The DIB Sector Coordinating Council documented proprietary, outdated questionnaires and inconsistent language across primes as the problem CCRA was built to reduce.
This guide covers applicability, scope, how CCRA differs from CMMC and NIST SP 800-171, evidence, submission, and staying ready.
Key Takeaways
- CCRA looks at both control implementation and residual cyber risk.
- Completing it does not satisfy CMMC, NIST, DFARS, or prime-contract obligations.
- Accurate scope and evidence-backed answers beat a fast submission.
- Treat it as a repeatable governance process, not a one-time form.
What Is CCRA and Why Does It Matter to U.S. Defense Suppliers?
What CCRA is designed to do
CCRA is an industry effort announced on December 14, 2023 by the DIB SCC CCRA Working Group and published through ND-ISAC. Participants include Lockheed Martin, Boeing, RTX, Northrop Grumman, L3Harris, Leidos, BAE Systems, and Rolls Royce.
The goal: a common way for primes to collect supplier information, so suppliers answer once and share results with customers that accept it instead of completing separate proprietary questionnaires.
The assessment is adaptive, with compliance and risk sections:
- A maximum of 60 questions
- 31 controls in the risk section, drawn from NIST SP 800-171 Rev. 2
- Questions that probe whether a control exists, how well it works, and what exposure remains
Who may request a CCRA and when it applies
Applicability depends on the requesting prime or customer, contract terms, the information you handle, your role in the supply chain, and the customer's current process. A CCRA that a specific prime requests is different from obligations that come from federal contracts, CUI handling, or DFARS clauses.
Don't assume a CCRA applies to you. Ask the requester.
ND-ISAC has announced no further updates or support for CCRA, with decommissioning planned after November 24, 2026. Primes may keep using it, so a request can still arrive.
How a CCRA can affect a supplier
Possible outcomes include:
- Follow-up questions
- Remediation requests
- Added evidence requirements
- Supplier risk categorization
- Delayed onboarding
An incomplete response does not automatically disqualify you.
Reuse is the upside. If several customers accept the same output, one well-built response saves repeated effort. But each prime may add requirements or use a different workflow.
CCRA vs. CMMC vs. NIST SP 800-171
The purpose of each framework or assessment
- CCRA: a reciprocal supplier questionnaire gathering compliance and risk information.
- NIST SP 800-171: requirements for protecting CUI on nonfederal systems. Rev. 3 was finalized May 14, 2024, but DoD's class deviation still specifies Rev. 2 under DFARS 252.204-7012.
- CMMC: a DoD assessment, status, and affirmation framework under 32 CFR Part 170.
CMMC timing is in flux. DoD has suspended the Phase 2 transition, so Level 1 and Level 2 self-assessments remain permitted. C3PAO and Level 3 requirements may not be designated. DFARS 252.204-7012 safeguarding duties stay in force.
Verify the current revision, contract language, and timelines before relying on any summary, including this one.
How CCRA draws from related requirements
CCRA's risk section draws on Rev. 2 practices. Alignment is not completion. A CCRA response can expose readiness gaps, but it does not replace a required CMMC assessment, self-assessment, SPRS submission, POA&M, or affirmation.
Practical comparison for suppliers
| Factor | CCRA | CMMC | NIST SP 800-171 |
|---|---|---|---|
| What it shows | Compliance and risk snapshot for a requester | Assessment status and annual affirmation | Requirements and implementation against them |
| Who requests it | A prime or customer | DoD through contract clauses | Agencies through contracts |
| What it doesn't prove | Full compliance or certification | Compliance with other customer demands | Anything without evidence |
Keep separate records for CCRA responses, formal assessments, remediation plans, and evidence. One document will not satisfy every customer or government requirement.
Confirming the applicable obligation
Check with your contracting officer or prime, official DoD and NIST sources, ND-ISAC, Exostar, and your current contract. Don't rely on an old blog post, legacy questionnaire, or third-party summary.
How to Prepare for and Complete a CCRA
Define the assessment scope before answering
Start with the customer request, the supplier relationship, the data types involved, and the systems that create, receive, store, process, or transmit that data. Then pull in the dependencies:
- Cloud services and remote work environments
- Endpoints, applications, and facilities
- Privileged accounts
- Subcontractors and managed service providers
Document the boundary, data flows, included assets, exclusions, assumptions, and owners. DoD's Level 2 Scoping Guide offers a useful model: CUI assets, security protection assets, contractor risk managed assets, and specialized assets. Answers should rest on a defensible scope, not the whole enterprise by default.
Build a control and evidence inventory
Map each question to a policy, process, technical safeguard, owner, and evidence. Mark each control implemented, partially implemented, planned, or not implemented.
Then review the basics:
- Access control, multifactor authentication, and least privilege
- Asset inventory and vulnerability management
- Endpoint protection, logging, and encryption
- Backups, incident response, and awareness training
These matter because DoD OIG audits of 29 contractors repeatedly found gaps in MFA and password enforcement, log review, inactive accounts, vulnerability mitigation, and malware scanning.
Confirm the official format. ND-ISAC links a v1.03 macro-enabled Excel workbook, and Exostar's TPM Cyber Security module offers separate Compliance and conditional Risk forms. Which one you use depends on the requester.
Validate answers before submission
Have security, IT, compliance, contracts, and an executive reviewer check accuracy, consistency, and scope. Look for:
- Policies that contradict technical evidence
- "Fully implemented" answers with no support
- Controls without owners
- Stale documentation
- Controls that exist only in plans
Preserve the submitted version, date, evidence references, results, remediation commitments, and the source instructions.
Submit through the authorized channel
Follow the requesting prime's exact instructions or its approved platform. Never send sensitive information through unofficial forms or links. Afterward, record follow-up requests, deadlines, accepted evidence, and customer-specific requirements.
Evidence, Risk Treatment, and Maintaining Readiness
Evidence that can support a CCRA response
Useful evidence includes:
- Approved policies (drafts don't count)
- System and asset inventories
- Access reviews
- Vulnerability and patch records
- Endpoint or logging reports
- Training records
- Incident-response exercises and backup tests
- Vendor reviews
- Remediation closure records
Good evidence is current, attributable to your organization, tied to a specific question, and stored in a controlled repository with version history and access permissions. DeepSeas's compliance readiness work, for example, focuses on control mapping, evidence collection, and evidence organization for this reason.
Turning findings into a risk treatment plan
NIST defines residual risk as the portion of risk remaining after controls are applied. Track it in a risk register. NIST IR 8286Ar1 suggests fields such as:
- Affected asset and scenario
- Likelihood and impact
- Risk owner
- Response: accept, avoid, transfer, or mitigate
- Remediation action and target date
- Compensating control
- Post-control residual risk and leadership decision
Treat these as good practice rather than confirmed mandatory CCRA fields. Prioritize by impact, exploitability, exposure of sensitive information, operational consequences, and contractual urgency, not by what is easiest to fix. Risk acceptance also doesn't override CMMC limits on conditional status.
Maintaining readiness after submission
Reassess when your environment changes. Common triggers include:
- New systems or cloud services
- Subcontractors and acquisitions
- Personnel changes
- Incidents or contract changes
NIST SP 800-37 lists similar reassessment triggers. Review evidence on a schedule and report to executives so your response reflects operating controls, not a one-time snapshot.
Common CCRA Mistakes and Expert Support
Mistakes that weaken a CCRA response
- Treating CCRA completion as CMMC certification
- Using an outdated form or workflow
- Skipping scope definition
- Answering "yes" without evidence
- Reporting planned controls as implemented
- Copying last year's questionnaire without validating current systems
- Relying on undocumented verbal practices
- Ignoring subcontractor and cloud-provider risk
- Failing to track residual risk after remediation
The stakes are real. Penn State's $1.25 million settlement with DOJ involved alleged misstated implementation dates and a nonqualifying external cloud provider. Aerojet Rocketdyne paid $9 million and Raytheon/Nightwing $8.4 million.
These were resolved allegations, not adjudicated liability. The lesson still holds: represent only what is actually implemented.
A pre-submission readiness check
- Confirm scope and boundary.
- Assign an owner to every control.
- Check that evidence is fresh.
- Test answers for consistency.
- Review unresolved high-risk findings.
- Get executive approval.
- Verify the submission channel and deadline with the requester.
- Archive the final response.
How DeepSeas can support the process
DeepSeas offers practitioner-led governance, risk, and compliance services. Support covers scope definition, NIST-related control reviews, evidence organization, risk assessment, remediation tracking, and board-ready reporting. DeepSeas GRC supports CMMC and NIST, with options from platform-only to advisory-only to fully managed.
DeepSeas GRC specialists hold ISO Lead Auditor certifications and bring NIST, governance, risk, and compliance experience. Your organization remains responsible for its own representations and for any formal certification or government-required assessment.
Frequently Asked Questions
What is CCRA cybersecurity compliance and risk assessment?
It is a supplier-focused process for collecting cybersecurity compliance information and evaluating cyber risk. Whether it applies to you depends on the requesting organization and current requirements.
Is CCRA the same as CMMC?
No. CCRA gathers supplier compliance and risk information for a requester. CMMC is a formal DoD assessment and affirmation framework.
Who needs to complete a CCRA?
The requesting prime, customer, contract, your supplier role, and the data you handle determine it. Confirm directly with the organization asking.
Does CCRA replace NIST SP 800-171 or a CMMC assessment?
No. It may reference related NIST practices and support readiness, but it doesn't replace NIST-based obligations, CMMC assessments, SPRS submissions, or other contract requirements.
What evidence do I need for a CCRA?
Expect policies, inventories, access reviews, vulnerability and patch records, training, incident-response and backup tests, vendor reviews, and remediation records. The requester may specify more.
Where can I find the current CCRA form and instructions?
Ask the requesting prime, and check Exostar or ND-ISAC. Avoid outdated forms, legacy portals, and unofficial downloads, since ND-ISAC has announced CCRA's retirement.
