Cofactr, CMMC Level 2, and FedRAMP

The short answer

Cofactr has completed a CMMC Level 2 self-assessment and is scheduled for a third-party (C3PAO) assessment. When you share CUI with Cofactr to procure, store or kit parts, Cofactr acts as your subcontractor and protects that CUI on its own NIST SP 800-171 compliant systems.

FedRAMP applies to the cloud providers Cofactr uses to host CUI, and every one of them is FedRAMP Moderate authorized or better. Cofactr itself is not a cloud service provider: you engage us for procurement, inventory and logistics services, and the Cofactr portal is how you direct and track that work. So your assessor should evaluate Cofactr as a subcontractor with CMMC Level 2 status, not as a SaaS vendor needing its own FedRAMP authorization.

Common questions

We log into a web portal and upload CUI. Isn't that SaaS? No. You aren't buying software or computing resources from Cofactr. You're buying procurement, quality, warehousing and kitting work that our team performs. The portal is how you send us requests and see status, much like a supplier portal. DoD's guidance looks at what a provider actually does, not how its interface is delivered.

Does Cofactr need FedRAMP Moderate equivalency? No. Under DFARS 252.204-7012, FedRAMP Moderate or equivalent is required of the external cloud providers a contractor uses to hold CUI. Cofactr receives the 7012 flowdown as your subcontractor, and the cloud providers Cofactr uses all meet FedRAMP Moderate or better.

Which CMMC requirement should we flow down to Cofactr? The same CMMC Level 2 requirement and DFARS 252.204-7012 and 252.204-7021 clauses you would flow to any subcontractor that handles CUI.

Has the CMMC Phase 2 suspension changed anything? Not for Cofactr's posture. The Department of War suspended the move to required third-party assessments in July 2026, but Level 2 self-assessments and DFARS 252.204-7012 remain in force. Cofactr is proceeding with its C3PAO assessment regardless.

Do we still need to account for Cofactr in our own assessment? Yes, as a subcontractor that holds your CUI. Your assessor will want to see that you flowed down the right clauses and verified Cofactr's CMMC status.

For your assessor

Cofactr can provide, on request:

• Confirmation of Cofactr's CMMC Level 2 self-assessment status, and our C3PAO certificate once issued

• A customer responsibility summary showing which controls Cofactr owns for the CUI you share

• The FedRAMP authorization status of the cloud providers that host your CUI

The Cofactr Trust Center has a detailed write-up of this position with regulatory citations. For documentation or questions, contact your Cofactr account team.