What is CMMC?

Definition

CMMC is a US Department of Defense certification program that verifies whether a company in the defense supply chain has the cybersecurity practices needed to protect sensitive but unclassified government information.

Background

CMMC applies to the defense industrial base: contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). CMMC 2.0 defines its levels as follows: Level 1 (Foundational) covers basic safeguarding of FCI; Level 2 (Advanced) aligns with the 100+ security requirements of NIST SP 800-171 for protecting CUI; and Level 3 (Expert) adds a subset of NIST SP 800-172 for the highest-priority programs. Depending on level, a company either self-assesses or undergoes a third-party assessment. The program rule is codified at 32 CFR part 170, and a DFARS clause puts the required CMMC level into individual contracts. What people call CMMC controls the rule calls security requirements. Level 1 takes its requirements from the basic safeguarding clause, FAR 52.204-21. For Level 2, 32 CFR 170.14(c)(3) makes the requirements identical to NIST SP 800-171 Revision 2, which groups them into families such as access control, identification and authentication, audit and accountability, and system and communications protection. NIST has since published Revision 3, but the CMMC rule incorporates Revision 2.

Why it matters

For defense contractors, CMMC is becoming a condition of doing business: without the required level, you can’t be awarded or keep the relevant contracts. Because much of it maps to NIST SP 800-171, the work also strengthens your general security posture. The assessment type depends on the level and the contract. Level 1 is an annual self-assessment. Level 2 is either a self-assessment or a certification assessment by an authorized third-party assessment organization (C3PAO), as the contract specifies. Level 3 requires a Level 2 certification first, and its assessment is conducted by the government, through the Defense Contract Management Agency’s DIBCAC. At every level a senior official affirms compliance, and results are recorded in the Supplier Performance Risk System (SPRS).

Step by step

1. Determine whether you handle FCI, CUI, or both, and which CMMC level your contracts require.
2. Scope the systems that store, process, or transmit that information.
3. Assess against the required practices (NIST SP 800-171 for Level 2) and identify gaps.
4. Remediate gaps and document a System Security Plan and Plan of Action & Milestones.
5. Complete the required self-assessment or third-party assessment for your level.
6. Record the results and the affirmation in SPRS, and renew the affirmation every year while the requirement applies.
7. Maintain the controls and re-assess on the required cadence.
8. Confirm the CMMC level of each subcontractor before FCI or CUI flows to it.

Examples

• A small parts manufacturer handling CUI targets CMMC Level 2 and works through the NIST SP 800-171 controls.
• A supplier that only receives FCI scopes to Level 1 and completes an annual self-assessment.
• A machine shop that receives CUI drawings moves them into a separate enclave, so its Level 2 assessment scope covers a few systems instead of the whole company.

Common mistakes

• Assuming CMMC doesn’t apply to subcontractors; it flows down the supply chain.
• Under-scoping where CUI actually lives, which understates the work required.
• Treating the System Security Plan and POA&M as paperwork rather than a live program.
• Counting on a Plan of Action & Milestones to defer requirements. The rule allows a POA&M only for certain requirements, and open items have to be closed within 180 days, or the conditional status expires.

FAQ