Scenario: Need CMMC L2 and ITAR.

I am aware that by no means can a person say come onsite for any reason and have CUI exposed to that individual unless they are a citizen first and foremost with respect to ITAR. Great.

When it comes to say... The vendor that is installing security hardware, door contacts, etc. I understand the same applies in regards to ITAR, but do they need to be CMMC L2 also? This is further pressed with vendors/resellers in that if this company, which because you can't just buy things direct is simply reselling the service and doing maintenance aspects of the install: running cables, installing hardware (like door contacts), mounting cameras, but will have no access to the footage at all... where do they stand? Do they need to be CMMC L2? Are they considered a SPA?