Cybersecurity Maturity Model Certification

What CMMC Is and Why It Exists

The Cybersecurity Maturity Model Certification (CMMC) is a US Department of Defense (DoD) program that verifies defense contractors meet required cybersecurity standards before they can win contracts that involve sensitive information. CMMC builds on existing requirements in NIST SP 800-171 but adds independent assessment so the DoD can trust, rather than merely accept self-attestation, that contractors protect data. The current iteration, CMMC 2.0, took effect through the DoD's final rule in 2025.

CMMC exists because the Defense Industrial Base is a frequent target of espionage. Stolen Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) can erode military advantage.

Who It Applies To

CMMC applies to every organization in the DoD supply chain that handles FCI or CUI, from large prime contractors to small subcontractors. Requirements flow down through contracts, so even firms that never deal directly with the DoD may need certification if they support a prime contractor.

Key Requirements

CMMC 2.0 defines three levels:

• Level 1 (Foundational): 15 basic safeguarding practices for FCI, with annual self-assessment.
• Level 2 (Advanced): the 110 controls of NIST SP 800-171, verified by self-assessment or, for prioritized contracts, a third-party assessment.
• Level 3 (Expert): Level 2 plus a subset of NIST SP 800-172 controls, assessed by the government.

Contractors must implement the required practices, document a System Security Plan, and submit an annual affirmation of compliance by a senior official.

Penalties for Non-Compliance

Without the required certification level, a contractor is ineligible to be awarded covered contracts, the most direct and significant consequence. False affirmations can trigger liability under the False Claims Act, exposing companies and individuals to substantial civil penalties. Loss of certification can also end existing contracts and damage reputation across the Defense Industrial Base.

How to Comply

• Identify whether you handle FCI, CUI, or both, and determine your required CMMC level.
• Implement the corresponding NIST SP 800-171 controls and close gaps tracked in a Plan of Action and Milestones.
• Maintain a current System Security Plan describing your environment and controls.
• Schedule a self-assessment or engage a Certified Third-Party Assessment Organization (C3PAO) as your level requires.
• Flow requirements down to subcontractors and verify their status.
• Submit annual affirmations and keep evidence ready for audit.

Starting early matters: reaching Level 2 maturity often takes many months of remediation.

Common Pitfalls and Readiness

Many contractors underestimate the effort to reach Level 2 because NIST SP 800-171's 110 controls touch nearly every part of an environment, from media handling to incident response. A frequent mistake is treating compliance as a documentation exercise rather than implementing controls technically; assessors verify operating effectiveness, not just written policy. Scoping is also critical: properly segmenting the systems that store or process Controlled Unclassified Information can dramatically reduce the assessment boundary and cost. Contractors that build an accurate asset inventory, enforce least privilege and multi-factor authentication early, and maintain a realistic Plan of Action and Milestones tend to navigate certification far more smoothly than those that defer remediation until an assessment is imminent.