The default rule: certification follows the entity that handles CUI
CMMC certification attaches to the legal entity that handles CUI on the contract. If a joint venture (a separate legal entity, typically an LLC) is the prime, the JV needs its own CMMC certification. The fact that its parent companies are certified is irrelevant to the JV's certification status.
Conversely, if a JV partner provides services or processes CUI under the JV's contract, that partner needs its own assessment scope to cover the work it performs — even if the JV itself is certified.
Three structural options
- JV as a thin pass-through. The JV holds the contract but does not store, process, or transmit CUI. All CUI work happens inside the partners' already-certified environments. The JV itself may need a minimal certification (or none, depending on contract structure), but it never touches CUI.
- JV operates its own CUI enclave. The JV stands up its own assessed environment. Partners contribute personnel and IP but not infrastructure. Cleanest from a liability standpoint; most expensive.
- Hybrid with documented inheritance. The JV inherits specific controls from a partner (e.g., the partner provides the M365 GCC High tenant). The inheritance must be explicit in the JV's SSP, with a written services agreement, and the partner's CMMC certification must be in scope for those services. C3PAOs will scrutinize this.
Mentor-protégé and SBA 8(a) JVs
SBA's Mentor-Protégé Program allows a small-business protégé to JV with a mentor to compete for set-aside contracts. CMMC adds a wrinkle: both the mentor and the protégé must individually meet the CMMC level required by the contract if they each handle CUI under it. There is no "protégé inherits mentor's certification" rule.
Practical mitigation: structure the JV so the mentor's already-certified environment handles the CUI-touching work, and the protégé focuses on contract-management and non-CUI deliverables. Document the boundary in the JV agreement and reflect it in the JV's SSP.
Contracting language that prevents disputes
- Explicit CUI-handling allocation. Which entity stores, processes, or transmits CUI under the contract. No ambiguity.
- Flow-down of DFARS 252.204-7012, 7019, 7020, 7021 from the prime to every entity in scope.
- Indemnification for CMMC-related findings. If a partner's environment causes a JV-level finding, who pays for remediation and re-assessment?
- Audit rights between partners. The JV needs the right to verify partner controls, not just rely on a certificate.
- Termination triggers on loss of CMMC certification or material control failures.
- None of this is novel — it's standard subcontract hygiene applied to CMMC. The mistake is leaving it out because "we're partners."