Cybersecurity Maturity Model Certification (CMMC)
CMMC is the Department of Defense's program for verifying that contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), rather than relying on their claims alone. It keeps the National Institute of Standards and Technology (NIST) SP 800-171 security requirements contractors already attest to and replaces pure self-attestation with tiered, verified assessments.
If you want DoD contracts that involve FCI or CUI, CMMC status at the level named in the solicitation is a condition of award.
Who Needs It
Every defense contractor and subcontractor, at any tier, that processes, stores, or transmits FCI or CUI. That includes small businesses and SBIR/STTR participants, research institutions doing defense work, and managed service and cloud providers supporting contractors' CUI systems. Requirements flow down: a prime with a Level 2 (C3PAO) requirement must ensure its CUI-handling subs hold Level 2 (C3PAO) too.
Requirements are entering solicitations in a four-phase rollout spanning roughly three years, starting with self-assessments and adding third-party (C3PAO) and government (DIBCAC) certification requirements in later phases. If you're in the defense industrial base, the practical question is when a solicitation you care about will carry the clause, rather than whether one will.
The Three Levels
| Level | Protects | Requirements | Assessment | Cadence |
|---|---|---|---|---|
| 1: Foundational | FCI | 15 from Federal Acquisition Regulation (FAR) 52.204-21 | Self-assessment, results in the Supplier Performance Risk System (SPRS) | Annual; no Plan of Action and Milestones (POA&M) allowed |
| 2: Advanced | CUI | 110 from NIST SP 800-171 R2 | Self or certified by a C3PAO (solicitation specifies which) | Every 3 years, annual affirmation |
| 3: Expert | CUI against advanced threats | 24 selected from NIST SP 800-172, on top of Level 2 | Government assessment by the Defense Contract Management Agency (DCMA) DIBCAC; requires Final Level 2 (C3PAO) first | Every 3 years, annual affirmation |
Levels 2 and 3 are scored. Level 2 has a maximum of 110 points and a minimum passing score of 88 (80%); most requirements are worth 1 point, but some critical ones cost 3 or 5 when unmet. A passing-but-imperfect score earns Conditional status: remaining items go on a POA&M and must be closed within 180 days, or the status expires. Certain critical requirements can never sit on a POA&M; they must be met at assessment time.
Scoping
Assessment scope is asset-driven, and getting it right is most of the cost battle. For Level 2, assets that process, store, or transmit CUI, and the security tools protecting them, are fully assessed; contractor risk managed assets and specialized assets (IoT, OT, test equipment) get lighter treatment; assets that never touch FCI or CUI are out of scope entirely. For most small contractors, we recommend an enclave: concentrate CUI in a tightly bounded environment instead of certifying the whole company network.
Two vendor notes: external service providers that don't handle CUI are assessed as part of your scope rather than needing their own certification, and cloud providers holding CUI must meet the FedRAMP Moderate baseline or equivalent under Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012.
Enforcement
CMMC carries no standalone fines. Enforcement is contractual: no valid status means no award, no option exercise, and standard contract remedies if status lapses mid-performance. The larger legal exposure is False Claims Act liability: affirming compliance in SPRS that you don't actually have creates liability with treble damages, and DOJ has pursued such cases under its civil cyber-fraud initiative.
FAQ
How is CMMC different from NIST SP 800-171 compliance we already claim?
The requirements are the same 110. What changes is verification: instead of self-attesting under DFARS 252.204-7012, you're assessed (by yourself under stricter scoring rules, by a C3PAO, or by the government) and the result is recorded and affirmed annually.
Self-assessment or C3PAO for Level 2: who decides?
The solicitation. DoD designates Level 2 (Self) or Level 2 (C3PAO) per procurement based on the sensitivity of the CUI involved. You can't choose the cheaper path if the contract says C3PAO.
What if we can't meet all 110 requirements by assessment time?
You can pass conditionally at 88 points or above with unmet items on a POA&M, closed out within 180 days. Below 88, or with unmet critical requirements, you don't pass. We recommend planning the hard items (multi-factor authentication (MFA), Federal Information Processing Standards (FIPS)-validated encryption, logging) first, because they're the ones that can't be deferred.
Do our subcontractors need the same level we do?
They need the level matching what they handle: Level 1 if they only touch FCI, Level 2 (with the same assessment type as the prime's requirement) if they handle CUI. As the prime, verifying that is your job.