What Lockheed Martin Requires
- CMMC status in Exostar. Every active Lockheed supplier must report its CMMC status (None, Level 1 or Level 2) in Exostar's CCRA. LM supplier news, July 2026
- The right level for your data. FCI only needs Level 1 (Self). CUI needs Level 2 (Self) or higher, or Level 2 (C3PAO) when the prime contract requires it. Your status must be in SPRS before award. LM Supplier Cyber FAQ, June 2026
- DFARS 7012 and 7021. CorpDoc 2A and 3A flow down DFARS 252.204-7012 and 252.204-7021, with the CMMC level set in each contract. CorpDoc 2A, 3A, May 2026
- 110 controls or a plan. Attest that all 110 NIST SP 800-171 controls are in place, or document the gaps in a POA&M inside your SSP. Your SPRS assessment must be under 3 years old. LM Supplier Cyber FAQ, Q5 to Q8
How Lockheed Martin Checks
- A scored questionnaire. The CCRA risk questionnaire scores 31 controls Green, Yellow or Red. LM Supplier Cyber FAQ
- Supplier Validations. Lockheed runs onsite and virtual assessments of critical suppliers. LM supplier cybersecurity page
- Eligibility. Lockheed says a lapse in CMMC status will directly affect your DoD subcontract eligibility. LM supplier news, December 2025
Incidents and Questions
CorpDoc 2A requires you to copy your cyber incident reports to Lockheed. Supplier cyber questions go to lm.supplychaincyber@lmco.com.