CMMC: Cybersecurity Maturity Model Certification Guide
The Cybersecurity Maturity Model Certification (CMMC) is the U.S. Department of Defense's program for verifying that defense contractors adequately protect sensitive information. CMMC 2.0, finalized in 2024, streamlined the model from five levels to three and aligned directly with existing NIST standards.
What CMMC Covers
CMMC 2.0 defines three certification levels:
Level 1 (Foundational) — 17 basic cyber hygiene practices derived from FAR 52.204-21, protecting Federal Contract Information (FCI). Covers basic access control, identification, media protection, physical protection, system protection, and system integrity.
Level 2 (Advanced) — 110 practices directly mapped to NIST SP 800-171 Rev 2, protecting Controlled Unclassified Information (CUI). This is the most common level required for defense contracts involving CUI.
Level 3 (Expert) — All Level 2 requirements plus additional practices from NIST SP 800-172, protecting CUI against advanced persistent threats. Required for the most sensitive programs.
Who Needs CMMC
Any organization in the Defense Industrial Base (DIB) that handles FCI or CUI will need CMMC certification. This includes prime contractors, subcontractors, and suppliers at every tier of the defense supply chain. An estimated 200,000+ companies will need some level of CMMC certification.
CMMC requirements will be phased into DoD contracts starting in 2025. Organizations without the required CMMC level will be ineligible to bid on or continue performing affected contracts.
Assessment Process
Level 1 — Annual self-assessment with senior official affirmation. Results reported to the Supplier Performance Risk System (SPRS).
Level 2 (Third-Party) — Assessment by a CMMC Third-Party Assessor Organization (C3PAO). The assessor evaluates all 110 practices, and the organization must demonstrate implementation with evidence. Certification is valid for three years.
Level 2 (Self-Assessment) — Permitted for certain contracts with lower CUI sensitivity. Annual self-assessment with SPRS reporting.
Level 3 — Government-led assessment conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
Preparation Steps
- Determine required level — Review current and anticipated contracts for CMMC requirements
- Scope your environment — Identify all systems that process, store, or transmit FCI/CUI
- Conduct gap assessment — Compare current practices against required controls
- Create SSP and POA&M — Document your system security plan and remediation milestones
- Implement controls — Deploy required technical, administrative, and physical safeguards
- Self-assess — Score your implementation using the DoD assessment methodology
- Engage C3PAO — For Level 2 third-party assessment, schedule your certification audit
Common Challenges
The most challenging aspects for small and mid-size defense contractors include defining the CUI boundary, implementing multi-factor authentication across all CUI-handling systems, establishing a security operations capability for monitoring, and managing the cost of compliance relative to contract value.