By Jason Klein
If you are asking, “Is my website CMMC compliant?”, you probably already know cybersecurity requirements matter to your defense contracts. The harder question is how those standards apply to your public site and hosting. Could a contact form cause problems? What happens when a submission enters email or your CRM? Do plugins, file uploads, administrator accounts, or cloud connections change the answer?
Start with the data, not a list of security features. A public marketing site serves a different purpose from systems built to handle Controlled Unclassified Information (CUI). To understand where your website fits, trace what it collects, where that material travels, which services touch it, and who has access.
At Shift Agency, we focus on the website and hosting side of that equation. Mapping those moving parts removes the unknowns and gives your cybersecurity professionals a documented setup they can evaluate.
The short answer: Making your website CMMC-compliant starts with finding out whether it handles information covered by your organization’s requirements. Secure hosting, HTTPS, multi-factor authentication, software updates, and controlled access all strengthen a site, but no single web feature establishes compliance. Map how data moves through your website and connected services, then use that information to guide the changes your web team needs to make.
About this guide: Shift Agency focuses on web development, hosting, and digital marketing. Qualified cybersecurity and compliance professionals should determine your organization’s CMMC scope, assessment requirements, and certification status.
A public website does not automatically fall within a CMMC assessment boundary because your company has CMMC obligations. Its role depends on what the site handles, how it connects with other systems, and where submitted data travels.
The Department of Defense provides scoping guidance to help organizations identify assets within a CMMC assessment. NIST guidance also covers systems that process, store, or transmit CUI, along with the components that protect it.
For your web team, the practical takeaway is simpler: know what your site does with data before deciding what needs to change.
Consider two defense contractor websites.
One contains public information about capabilities, industries, careers, company credentials, and a basic contact form. Another includes customer accounts, document uploads, protected project details, portals, and connections with operational systems.
Those sites perform very different jobs.
Rather than treating every web property the same way, document your purpose and trace the paths that connect it to the rest of your technology.
Two terms appear frequently in CMMC discussions: Federal Contract Information (FCI) and Controlled Unclassified Information.
FCI generally covers nonpublic information the government provides or generates for a contract. CUI is unclassified material that requires safeguarding or dissemination controls under applicable federal rules.
For someone responsible for a website, the question becomes practical:
Could material requiring protection enter, leave, or pass through this site?
If you’re not sure, don’t guess. Follow the data.
A contact form looks simple to a visitor. Behind the screen, one submission may travel through several platforms before a salesperson ever reads it.
A typical path might look like this:
Website → Form → Email → CRM → Cloud Storage → Employee
At Shift Agency, we recommend tracing that path with five questions:
This process keeps the conversation grounded in the website, not abstract compliance language.
If nobody knows why a plugin is installed, where a form goes, or who owns an old administrator account, the work starts there.
Modern websites rarely operate alone. Forms send messages, CRM connections move leads, plugins exchange data, and cloud services handle tasks behind the scenes.
Each connection should have a known purpose, owner, and data path.
A prospect opens your contact page and types a message. The form asks for basic details, but the visitor decides what goes into the open text field.
Where does that message go next?
It may stay in the website database, reach several inboxes, enter a CRM, or pass through an outside form service. Trace the complete route instead of stopping at the page where the visitor clicked Submit.
Clear instructions can also tell users what not to send through a general inquiry form. Work with the appropriate internal team to establish that language.
Uploads introduce a different issue because the sender controls the document.
A customer, subcontractor, employee, or partner could attach material your marketing website was never intended to receive.
If uploads are necessary, document where files land, how long they remain there, and who can retrieve them. When sensitive documents belong elsewhere, give users an approved path for sending them.
A customer portal deserves its own data map.
Authentication, document access, user permissions, project details, and connections to internal platforms make a portal fundamentally different from a public capabilities page.
Treat the portal based on what it does, not by assuming the security settings on your marketing pages answer every question.
Many submissions spend only seconds on the website before moving elsewhere.
A quote request could reach an inbox, create a CRM record, trigger an automated response, and notify a salesperson. Follow each route, so your team knows exactly which systems receive the entry.
Old plugins often outlive the campaign, employee, or project that introduced them.
Scheduling applications, analytics services, chat software, spam filters, tracking tools, and APIs may all connect with your site. Keep a current inventory and remove technology that no longer earns its place.
For every service you keep, know what it receives and whether it stores data outside your primary setup.
No CMS, hosting package, plugin, or SSL certificate provides a universal yes-or-no answer.
Instead, trace the website from the visitor’s first interaction through storage and employee access.
List every place where someone can provide data:
Consider what visitors could enter, not only what you intended to collect.
For each collection point, map the full route:
Collection → Transmission → Processing → Storage → Access
A quote form, for example, may touch the web host, form software, email platform, CRM, and a salesperson’s account.
Once that route is on paper, your teams can see what was previously hidden behind the page.
Make a list of your host, email provider, CRM, cloud storage, APIs, analytics, scheduling tools, plugins, and other applications tied to the website.
Pay particular attention to older sites. Years of redesigns and marketing campaigns can leave behind integrations nobody remembers adding.
Who can log in today?
Marketing employees, developers, agencies, vendors, and former staff should not all retain administrator privileges indefinitely. Match permissions to current responsibilities, protect privileged accounts, and remove credentials that no longer have a purpose.
A documented website gives the professionals responsible for CMMC something specific to evaluate.
Once they establish how the site and hosting fit within your organization’s requirements, your developers have a defined list of issues to address instead of trying to interpret CMMC on their own.
Use these questions to find the unknowns before making changes.
| Website Feature | What to Ask |
| Public marketing pages | Does the site receive or connect to data that requires protection? |
| Contact forms | What can visitors submit, and where does each entry go? |
| File uploads | Where are documents stored, and who can retrieve them? |
| CRM integration | Which fields move from the website into the CRM? |
| Customer portal | What can authenticated users view, send, or download? |
| Cloud connection | What leaves the web infrastructure and where does it go? |
| Third-party plugin | Does the service process, transmit, or retain submitted data? |
| Administrator accounts | Who has access, and does each person still need it? |
| Backups | Where are copies kept, and who can restore them? |
| Analytics | What does the platform collect and send elsewhere? |
Several unanswered questions don’t necessarily mean you have a compliance problem. They show you where to start looking.
Your host sits underneath the public pages visitors see. Depending on your setup, it may hold site files, databases, form entries, logs, uploaded documents, or backups.
That makes hosting worth examining on its own.
Start with an inventory.
Does the server hold only public web content, or does it retain messages, uploaded files, database records, customer details, logs, or other material?
Be specific. “Our website is in the cloud” tells your security team very little about what is stored there.
List everyone who can access the hosting account, server controls, database, file system, domain settings, or related administrative tools.
Then remove stale credentials and match remaining permissions to each person’s role. Protect privileged accounts with appropriate authentication.
Backups create additional copies of whatever your website retains.
Know where those copies live, how long they remain available, who can retrieve them, and how restoration works. Include database backups, not just site files.
Your hosting architecture may depend on several outside services.
Content delivery networks, DNS, monitoring tools, backup systems, security products, and development platforms can all play a role. Add those relationships to your technology map so they don’t remain invisible.
Don’t choose hosting based only on a badge or a broad security claim.
Document what the site needs to do and what it stores. Your cybersecurity professionals can use those facts to establish the appropriate requirements, while your developers handle the web configuration needed to support them.
Keeping CUI elsewhere doesn’t reduce the need to protect your public site.
A compromised website can expose credentials, interrupt lead generation, change public content, redirect visitors, or affect connected services. Good web management protects both the business and the people using the site.
HTTPS encrypts traffic between the visitor’s browser and your server. Any page collecting data should use it.
However, an SSL/TLS certificate addresses one security function. It cannot establish CMMC compliance on its own.
Administrator credentials provide broad control over pages, users, plugins, and configuration.
Use multi-factor authentication where appropriate and supported. Limit full access to people whose responsibilities require it.
CMS platforms, plugins, themes, frameworks, and server components need routine maintenance.
Before adding another plugin, ask whether its function justifies another dependency. Removing unnecessary software often makes a site easier to maintain.
Logging can help your team trace administrative activity, errors, unusual behavior, and security events.
Set retention and monitoring practices based on your organization’s needs, rather than collecting records nobody checks.
A backup strategy isn’t complete until restoration works.
Maintain appropriate copies of website files and databases, then verify that your team can recover them when needed.
Your public site should excel at marketing your company. It doesn’t need to handle every business interaction.
Where your organization’s architecture calls for separation, sensitive project documents and controlled workflows can use systems designed for that purpose.
If customers or partners need to send sensitive files, provide an approved route and explain how to use it.
That approach is clearer than asking people to decide whether an ordinary contact form is appropriate.
A defense contractor’s website has valuable work to do. It should explain capabilities, establish credibility, support business development, attract qualified employees, and help the right people make contact.
Keeping controlled workflows separate, where appropriate, lets the marketing site stay focused on those goals.
Marketing and sales employees make publishing decisions every day.
They should know what belongs online, which materials need approval, where sensitive files should go, and whom to ask when something falls outside the normal process.
Security is not only about what enters your site. Public content deserves attention too.
A technically secure website can still publish something your company never intended to make public.
Case studies and project pages can demonstrate experience, but contract names, locations, specifications, customer details, and technical material may deserve another set of eyes before publication.
Create a defined approval process rather than asking individual marketers to make those calls alone.
A team photo may also show a computer monitor. A facility video might capture a whiteboard. A screenshot can reveal an internal URL, username, customer name, or system detail.
Inspect the entire frame before publishing.
Capability statements, brochures, presentations, and PDFs can stay online long after the person who uploaded them has moved on.
Check new files before launch, then periodically revisit older downloads to make sure they still belong on the public site.
Use this checklist to bring web, marketing, IT, and cybersecurity stakeholders into the same conversation. It is a website and hosting review tool, not a replacement for a CMMC assessment.
Data and Scope
Hosting and Technology
Public Content
Ongoing Management
You aren’t trying to turn your website into a compliance project. You’re trying to remove the unknowns.
A few recurring web practices deserve attention because responsibility for them often falls between marketing, development, hosting, and cybersecurity.
HTTPS protects traffic between the browser and server. CMMC covers far more than encrypted web traffic.
An open message field lets visitors type whatever they choose. Give people clear directions when certain material belongs elsewhere.
The website may be the first stop, not the last. Follow the entry into email, CRM platforms, storage, and other connected services.
Retired campaigns and past redesigns often leave behind plugins, scripts, and integrations. Remove connections that no longer support the site.
People change roles, employees leave, and vendors finish projects. Website permissions should change with them.
Secure hosting cannot prevent an authorized employee from posting material that should have received another review.
A website changes after launch. New forms, users, integrations, plugins, and campaigns change how the site operates, so maintenance should keep pace.
Sometimes the strongest sign your website needs attention isn’t a known vulnerability. It’s the number of questions nobody can answer.
A professional web review may make sense when:
A web development partner serves a different role from a CMMC assessor or cybersecurity provider.
At Shift Agency, we focus on the web side of the work. We can trace forms and integrations, clean up access, examine hosting architecture, address development issues, and help create a site that’s easier to manage going forward.
Security should support a strong marketing website, not strip it of everything useful.
Defense contractors still need to explain what they do, show relevant experience, establish credibility, attract qualified prospects, and make life easier for procurement professionals.
Prospects should quickly understand your services, industries, strengths, and areas of expertise.
Clear website architecture also helps buyers move from a capability page to supporting credentials, past performance, and an appropriate contact option without searching through unrelated content.
Relevant certifications, codes, contract vehicles, qualifications, and other approved credentials can support buyer research.
Work with the appropriate stakeholders to decide what belongs online, then place that material where visitors can find it naturally.
If your capability statement is approved for public distribution, make it easy to locate.
Replace outdated versions rather than leaving several copies scattered across the website.
Specific examples are more persuasive than broad claims.
Use project information cleared for public release and establish an internal path for approving future additions.
The site still needs to generate business.
A consultation request or contact form gives qualified prospects a simple way to reach your team. Pair that conversion path with clear guidance about what users should send through it.
You don’t need to turn your marketing team into CMMC specialists. Give each group a clear role and start with the website details you can document.
Trace hosting, forms, integrations, administrator accounts, storage, vendors, and data paths.
The objective is simple: know what you have.
Your cybersecurity and compliance professionals can evaluate a documented setup far more effectively than a vague description of “the company website.”
They determine how the site fits within your organization’s CMMC responsibilities.
Now your developers have a defined job.
That might involve changing a form, removing an old integration, tightening permissions, updating software, modifying hosting, separating functionality, or improving maintenance.
Clear responsibilities keep the process moving without asking your marketing agency to act as a CMMC assessor or expecting your cybersecurity team to rebuild the website.
Not every public website automatically falls within the same CMMC assessment scope. Start by tracing what the site processes, stores, or transmits and how it connects with other systems. The Department of Defense provides scoping guidance to determine which assets fall within an assessment boundary. Your qualified cybersecurity or compliance professionals should make the final determination for your organization.
Systems that process, store, or transmit CUI may carry security requirements based on your organization’s applicable scope. Don’t treat a standard marketing form as an approved channel simply because the page uses HTTPS. If customers need to provide protected material, establish the correct method with the people responsible for cybersecurity and give users clear directions.
That depends on what the hosted setup does, which data it handles, and how it fits within your organization’s scope. Document server storage, administrative access, backups, connected services, and data paths so the appropriate professionals can evaluate the architecture.
A CMS name cannot answer the compliance question. A WordPress site may include hosting, databases, plugins, forms, APIs, themes, administrator accounts, and third-party services configured in many ways. Look at the full setup and its data flows rather than expecting the platform itself to provide a compliant or noncompliant label.
No. SSL/TLS protects traffic between the visitor’s browser and the web server. CMMC can involve broader safeguards based on your organization’s requirements and scope, so encryption in transit represents one part of the picture.
Start with what the analytics service collects and where that data travels. Add tracking platforms to your technology inventory, document their connections, and include them in the appropriate technical review if their role is unclear.
Revisit the site after significant changes, such as moving hosts, adding a portal, installing a new form, changing vendors, connecting another service, or granting administrator access. Routine maintenance can also catch outdated software, abandoned accounts, old downloads, and integrations that have outlived their purpose.
Your qualified cybersecurity and compliance professionals should make that determination using current CMMC guidance and the requirements applicable to your organization. Your web team supports that work by documenting hosting, forms, integrations, permissions, and data paths, then addressing website changes identified in the review.
Asking “How do I make my website CMMC compliant?” is a smart place to begin. Once you know where forms go, which services connect to the site, who has access, and what your host stores, CMMC stops being an abstract website question.
Your cybersecurity professionals can evaluate a documented setup, while your developers have a defined list of web issues to address.
Meanwhile, your marketing site can stay focused on what it should do best: explain your capabilities, establish credibility, attract qualified opportunities, and give prospects a clear way to start a conversation. Sensitive material gets its own approved path instead of slipping into systems that were never meant to receive it.
Shift Agency helps businesses build and manage websites around real marketing, development, hosting, and technical needs. If your company is preparing for CMMC and the website still contains unanswered questions, we can work alongside your cybersecurity team to sort out the web-development side.
Schedule a consultation with Shift Agency to review your website, hosting, integrations, access, and the next steps for creating a cleaner, more clearly defined web presence.
