CMMC Definition
CMMC (Cybersecurity Maturity Model Certification) is a U.S. Department of Defense program that verifies whether defense contractors and subcontractors are adequately protecting sensitive government information. It applies to any organization in the Defense Industrial Base (DIB) that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).
CMMC exists because contractors previously self-attested to meeting cybersecurity requirements, with no mechanism to verify those claims — leaving the defense supply chain exposed to data theft. The current version, CMMC 2.0, replaced the original five-tier model with three levels mapped to established NIST standards, and made certification a condition of contract award rather than a self-declaration.
What are the three CMMC levels?
CMMC 2.0 has three levels, and the level required is determined by the type of data you handle, not your company size. Level 1 (Foundational) applies to contractors handling only Federal Contract Information and requires 15 basic safeguarding practices from FAR 52.204-21, verified through annual self-assessment. Level 2 (Advanced) applies to organizations that create, store, process, or transmit Controlled Unclassified Information and requires all 110 controls from NIST SP 800-171 — this covers the majority of DoD contractors, assessed on a three-year cycle by either self-assessment or a Certified Third-Party Assessment Organization (C3PAO), depending on the contract. Level 3 (Expert) adds 24 enhanced requirements from NIST SP 800-172 for 134 total, is reserved for the highest-priority national security programs, and requires a government-led assessment by DIBCAC.
Who needs CMMC certification?
CMMC applies to any organization in the Defense Industrial Base that handles FCI or CUI under a DoD contract — including prime contractors, subcontractors, suppliers, and service providers at every tier. Requirements flow down the supply chain, so a small subcontractor handling CUI can face the same Level 2 obligations as a prime with thousands of employees. Primes, rather than government contracting officers, are typically responsible for verifying their suppliers comply, which is why much of the enforcement pressure comes from within the supply chain. Managed service providers and cloud providers handling CUI on a contractor's behalf are also in scope. The main exception is companies that solely supply commercial off-the-shelf (COTS) products and never touch FCI or CUI.
How do you achieve CMMC compliance?
Compliance starts with scoping: identifying exactly where FCI and CUI live across your systems, since CMMC applies to every environment that processes, stores, or transmits that data. From there, conduct a gap assessment against the relevant NIST control set, then remediate the gaps, which typically means implementing access controls, encryption, logging, and incident response capabilities, and documenting the processes behind them. Level 1 and some Level 2 contracts are satisfied by an annual self-assessment submitted to the Supplier Performance Risk System (SPRS) with an affirming official's attestation, which carries legal weight under the False Claims Act. Most Level 2 contracts require a C3PAO third-party assessment. Because certification commonly takes 12–18 months, early preparation is critical.