CMMC

CMMC (Cybersecurity Maturity Model Certification) is a DoD requirement for defense contractors that combines cybersecurity standards and third-party assessment to protect Controlled Unclassified Information (CUI).

CMMC is a unified standard for implementing cybersecurity across the Defense Industrial Base (DIB). It was created to ensure contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

CMMC 2.0 has three levels: - Level 1 (Foundational): 17 practices for FCI protection, self-assessment - Level 2 (Advanced): 110 practices aligned with NIST 800-171 for CUI, third-party assessment - Level 3 (Expert): 110+ practices with additional controls, government-led assessment

Key CMMC requirements: - Based on NIST SP 800-171 controls - Requires third-party assessment for Level 2+ (C3PAO) - Contractors must maintain certification for contract eligibility - Flows down to subcontractors handling CUI

Implementation timeline: - Required for new DoD contracts progressively starting 2025 - Full implementation expected by 2028

Why It Matters

For defense contractors, CMMC is becoming a hard requirement for contract eligibility. Without certification, organizations will be locked out of DoD contracts—a $400+ billion annual market. The certification requirement flows down to subcontractors, meaning even small companies in the defense supply chain must achieve CMMC compliance to continue doing business.

Key Points

Required for DoD contractors handling CUI

3 levels with increasing control requirements

Level 2 requires third-party assessment

Based on NIST 800-171 framework

Subcontractors must also comply

Applicable Compliance Frameworks

NIST CSF

Related Terms

FedRAMP

FedRAMP (Federal Risk and Authorization Management Program) is a US government program that provides a standardized approach to security assessment for cloud products and services used by federal agencies.