Is Peraton CMMC and FedRAMP Compliant? How to Verify Any Prime

Is Peraton CMMC and FedRAMP Compliant? How to Verify Any Prime

If you are here, you are probably about to team with, subcontract to, or subcontract under a large defense prime, and someone has asked you to confirm their cybersecurity compliance posture. This page will not give you a verdict on Peraton or any other named company, because no source outside DoD and that company is in a position to issue one. What it gives you is the thing that actually closes your diligence: what the regulations require the other party to have, what you are entitled to ask for, and how to read the answer.

The short answer: there is no public record to check

There is no public register of CMMC statuses, and no public register of NIST SP 800-171 scores. Summary-level assessment scores posted in the Supplier Performance Risk System (SPRS) are available to DoD personnel, and to authorized representatives of the contractor that was assessed — and to nobody else. That rule is printed in the clause itself, at DFARS 252.204-7020(f)(1)-(2). Any page that appears to publish another company's score is inferring it, and an inference is not diligence.

What the clauses actually require of a prime handling CUI

Three obligations are worth knowing before you send a single email, because each one creates an artifact you can ask for. Under DFARS 252.204-7021(d), a contractor must have and maintain a current CMMC status at the level written into the contract for every information system that processes, stores, or transmits FCI or CUI, and must complete an annual affirmation of continuous compliance in SPRS. Under DFARS 252.204-7019(b), an offeror must already have a current assessment — not more than three years old — for each covered system relevant to the offer. And under DFARS 252.204-7012(b)(2)(ii)(D), if covered defense information goes to an external cloud service provider, that provider must meet security requirements equivalent to the FedRAMP Moderate baseline. Note the word: equivalent, not authorized.

Which direction the diligence actually runs

The clause burden sits on whoever awards the subcontract. Before awarding a subcontract that will process, store, or transmit FCI or CUI, the awarding party must ensure the subcontractor holds a current CMMC status at the level appropriate to what is being flowed down (DFARS 252.204-7021(f)(2), applying the flowdown rules at 32 CFR 170.23). Separately, a subcontract subject to NIST SP 800-171 implementation may not be awarded unless the subcontractor has completed at least a Basic Assessment within the last three years (DFARS 252.204-7020(g)(2)). In practice this means the smaller party is the one being assessed. If you are vetting a large prime as a prospective teammate, expect the same questions to come back at you, in writing, before award.

FedRAMP: what a Marketplace listing does and does not mean

FedRAMP authorizes cloud service offerings, not companies. The FedRAMP Marketplace is the authoritative list and it is searchable by product name. A systems integrator that deploys inside a customer's already-authorized boundary will not have a listing of its own, and that absence is not a compliance finding — but it does mean the authorization being relied on belongs to somebody else, and you should find out whose. The question that resolves this is not "are you FedRAMP authorized?" but "which cloud service offering will my data reside in, and is it authorized or asserted as FedRAMP Moderate equivalent?"

What this page will not tell you

It will not tell you whether Peraton — or any other named contractor — is compliant, holds a particular CMMC level, or is better or worse prepared than its peers. Earlier versions of this page did make claims of that kind. They were not traceable to any primary source, they were not knowable from outside the company, and they have been removed. A compliance claim about a third party that you cannot cite is not information; it is a liability you would be forwarding to a contracts officer.

How to verify: 11 steps, each with the clause behind it

The checklist below is the working method. Each step states an obligation printed in a regulation, links the clause or CFR section it comes from, and names the specific artifact to request — a CMMC Unique Identifier, a status date and an affirmation date, the SPRS assessment fields, the cloud service offering your data will actually live in. Work it top to bottom and you will end with answers you can put in a subcontract, which is the only place they are worth anything.