What Is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is a framework designed by the US Department of Defense (DoD) to enhance the cybersecurity posture of companies within the Defense Industrial Base (DIB). It establishes security requirements that contractors must meet to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) from cyber threats.
The CMMC framework integrates security standards from NIST SP 800-171, NIST SP 800-53, ISO 27001, DFARS 252.204-7012, and other regulations into a tiered model to ensure defense contractors comply with necessary cybersecurity practices before working with the DoD.
Why CMMC Was Created
CMMC was introduced to address cybersecurity vulnerabilities in the defense supply chain and ensure that all contractors handling sensitive DoD data follow strict cybersecurity protocols. Key reasons for its introduction include:
- The need to strengthen cybersecurity across the DIB against growing cyber threats
- Failure of organizations to properly implement NIST SP 800-171, leading to security gaps
- Desire for improved accountability via third-party verification of cybersecurity readiness
Role of the DoD in Cybersecurity Compliance
The DoD plays a central role in cybersecurity compliance by:
- Defining cybersecurity standards — The DoD establish policies such as CMMC, NIST SP 800-171, and DFARS (Defense Federal Acquisition Regulation Supplement).
- Enforcing compliance — The DoD mandates that all defense contractors meet cybersecurity requirements before they can be awarded contracts.
- Conducting audits & assessments — The DoD partners with CMMC third-party assessment organizations (C3PAOs) to evaluate contractor cybersecurity readiness.
- Providing guidance & resources — The DoD issues cybersecurity guidelines and funds programs to help small and medium-sized businesses comply with CMMC standards.
- Monitoring & responding to cyber threats — The DoD coordinates with agencies such as the NSA, CISA, and FBI to mitigate threats to the defense supply chain.
The Evolution of CMMC: From Concept to CMMC 2.0
Before CMMC, defense contractors were required to follow NIST SP 800-171 security controls. However, there was no independent verification to confirm cybersecurity measures were properly implemented; contractors simply had to self-attest their compliance. As a result, many contractors did not fully implement the required security controls, and cyber breaches in the defense supply chain continued to rise.
To address these issues, the DoD introduced CMMC in 2019. It aimed to better protect sensitive defense data by standardizing cybersecurity practices across all DoD contractors and improve accountability by requiring independent verification of compliance.
Key Changes in CMMC 2.0
In November 2021, the DoD revised the original CMMC to simplify compliance and make it more accessible. The major changes in CMMC 2.0 include:
- Reduction from 5 maturity levels to 3 — The three 0 levels are Level 1 (Foundational), Level 2 (Advanced), and Level 3 (Expert).
- Reintroduction of self-assessments — Some Level 1 and Level 2 organizations can now self-assess annually instead of requiring third-party certification. However, contractors handling high-priority CUI still need third-party assessments.
- Flexibility in remediation — Unlike CMMC 1.0, CMMC 2.0 allows organizations to submit Plans of Action & Milestones (POA&Ms), giving them time to fix deficiencies while still being eligible for contracts.
- Elimination of unique CMMC practices — CMMC 1.0 included extra cybersecurity requirements beyond NIST SP 800-171. CMMC 2.0 eliminates them and aligns with existing federal standards.
- Improved cost-effectiveness and scalability — The streamlined approach reduces costs for small and medium-sized businesses. Companies now have clearer guidelines on what they need to implement.
CMMC Framework and Structure
How CMMC Aligns with NIST Cybersecurity Standards
CMMC closely aligns with existing National Institute of Standards and Technology (NIST) cybersecurity guidelines, particularly:
- NIST Special Publication (SP) 800-171 — A set of 110 security controls that define best practices for protecting CUI
- NIST SP 800-172 — Enhanced security requirements for protecting CUI in high-risk environments
- NIST Cybersecurity Framework (CSF) — A broader framework for improving cybersecurity risk management across industries
The alignment ensures that organizations already following NIST 800-171 will have a smoother transition into CMMC compliance.
Overview of the Three CMMC Maturity Levels
CMMC 2.0 defines three cybersecurity maturity levels:
- Level 1 (Foundational) focuses on basic cyber hygiene practices.
- Level 2 (Advanced) protects CUI by requiring more advanced security practices.
- Level 3 (Expert) targets contractors handling the most sensitive CUI.
CMMC Maturity Levels and Their Requirements
Level 1: Foundational Cybersecurity
CMMC Level 1 (Foundational) serves as the entry point for DoD contractors. Designed for organizations that handle FCI but do not process, store or transmit CUI, it imposes the most basic level of cybersecurity requirements and requires only annual self-assessment (no third-party certification required).
Security Requirements
CMMC Level 1 practices are derived from Federal Acquisition Regulation (FAR) 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems). The 17 security practices fall into 6 domains, each with its own sub-domains:
| Domain | Sub-Domain |
| Access Control (AC) | AC.1.001: Limit system access to authorized users, devices, and processes.AC.1.002: Authenticate or verify the identities of users, processes and devices before granting access.AC.1.003: Restrict information system access to authorized transactions and functions. |
| Identification and Authentication (IA) | IA.1.076: Identify information system users and authenticate their identities before allowing system access. |
| Media Protection (MP) | MP.1.118: Sanitize or destroy FCI before disposal.MP.1.121: Limit physical access to organizational information systems, equipment, and media. |
| Physical Protection (PE) | PE.1.131: Limit physical access to information systems and equipment to authorized individuals.PE.1.132: Escort visitors and monitor visitor activity.PE.1.133: Maintain audit logs of physical access.PE.1.134: Control and manage physical access devices (e.g., keys, cards, badges). |
| System and Communications Protection (SC) | SC.1.175: Monitor, control and protect data transmitted across networks.SC.1.176: Use encryption to protect data in transit where required. |
| System and Information Integrity (SI) | SI.1.210: Identify and correct system flaws in a timely manner.SI.1.211: Provide protection against malicious code (e.g., antivirus software).SI.1.212: Update malware protection mechanisms regularly.SI.1.213: Perform periodic scans of information systems and real-time scans of files downloaded from external sources. |
Who Needs to Comply with CMMC Level 1?
- Organizations that handle FCI but not CUI
- Organizations that work as subcontractors in the DIB but do not deal with sensitive government data
- Organizations that provide non-critical goods or services to the DoD
Assessment Requirements
- Organizations conduct an annual self-assessment and submit results to the DoD.
- No third-party certification is required, but compliance must be documented.
- If chosen for an audit, organizations must provide evidence of implementing the 17 security practices.
Level 2: Advanced Protection for Controlled Unclassified Information
CMMC Level 2 (Advanced) is designed to establish a strong cybersecurity posture to prevent unauthorized access to CUI. It is required for organizations that handle, process, store or transmit CUI.
Security Requirements
The 110 security controls of Level 2 are divided into 14 domains with various sub-domains:
| Domain | Sub-Domain |
| 1. Access Control (AC) | Implement role-based access control (RBAC) to restrict access to CUI.Use multifactor authentication (MFA) for accessing sensitive systems.Limit remote access and session timeouts to reduce risk exposure. |
| 2. Awareness and Training (AT) | Conduct regular security awareness training for employees handling CUI.Provide training on identifying and responding to cyber threats. |
| 3. Audit and Accountability (AU) | Enable detailed logging and monitoring of system activity.Retain audit logs for tracking unauthorized access attempts. |
| 4. Configuration Management (CM) | Enforce secure baseline configurations for systems handling CUI.Monitor and control unauthorized software installation. |
| 5. Identification and Authentication (IA) | Enforce strong passwords and MFA for system access.Manage unique user identities to track system interactions. |
| 6. Incident Response (IR) | Develop and implement a cyber incident response plan.Report and analyze security incidents affecting CUI. |
| 7. Maintenance (MA) | Ensure secure maintenance of IT systems, including updates and patches.Track and document system repairs and changes. |
| 8. Media Protection (MP) | Control physical and digital media containing CUI.Sanitize CUI data before disposal to prevent data leaks. |
| 9. Physical Protection (PE) | Implement secure physical access controls for CUI storage areas.Use visitor monitoring and access logs. |
| 10. Personnel Security (PS) | Screen employees before granting access to CUI.Ensure CUI is removed from departing personnel. |
| 11. Risk Assessment (RA) | Conduct regular risk assessments to identify cybersecurity threats.Implement mitigation strategies to reduce vulnerabilities. |
| 12. Security Assessment (CA) | Perform self-assessments and independent security audits.Document remediation efforts for security gaps. |
| 13. System and Communications Protection (SC) | Encrypt CUI in transit and at rest.Implement firewalls and secure communication protocols. |
| 14. System and Information Integrity (SI) | Monitor network traffic for suspicious activity.Regularly update antivirus and intrusion detection systems. |
Who Needs to Comply with CMMC Level 2?
- Organizations that handle, process, or store CUI under DoD contracts
- Organizations that are part of the DIB supply chain
- Organizations that need to comply with NIST SP 800-171 security requirements
Assessment Requirements
CMMC Level 2 requires contractors to complete one of two assessment types:
- Third-party assessment every 3 years is required for contractors handling critical CUI; certification is required to be eligible for DoD contracts.
- Self-assessment (annual) is allowed for non-prioritized contractors with lower security risks. Results must be reported to the Supplier Performance Risk System (SPRS).
Level 3: Expert-Level Cybersecurity for High-Risk Contractors
CMMC Level 3 (Expert) represents the highest level of cybersecurity maturity in the CMMC 2.0 framework. It is designed for contractors handling the most sensitive CUI in high-risk environments.
Security Requirements
CMMC Level 3 builds on Level 2 (NIST SP 800-171) by introducing additional security controls from NIST SP 800-172. These controls strengthen an organization’s ability to detect, respond to and recover from sophisticated cyber threats, including advanced persistent threats (APTs).
The enhanced security domains in CMMC Level 3 are provided below:
| Domain | Sub-Domain |
| 1. Advanced Access Control (AC) | Implement network segmentation to isolate sensitive data.Enforce least privilege access with dynamic monitoring.Utilize behavior-based authentication and access analytics. |
| 2. Threat Hunting and Incident Response (IR) | Establish proactive threat hunting processes.Implement automated attack detection and response systems.Develop an incident response team (CSIRT) dedicated to cyber threats. |
| 3. Enhanced System and Communications Protection (SC) | Utilize a Zero Trust architecture (ZTA) for continuous verification.Implement multi-layer encryption for CUI at rest and in transit.Use anomaly detection systems to identify potential cyber intrusions. |
| 4. Advanced Security Operations (SI) | Deploy 24/7 security monitoring and logging with security information and event management (SIEM) tools.Conduct real-time network traffic analysis for intrusion detection.Implement automated response mechanisms to neutralize threats in real time. |
| 5. Cyber Threat Intelligence and Risk Management (RA) | Use cyber threat intelligence (CTI) feeds to anticipate and prevent cyberattacks.Conduct continuous security risk assessments and penetration testing.Integrate AI-driven security analytics for threat prediction. |
| 6. Supply Chain Risk Management (SCRM) | Establish secure supply chain protocols to prevent supply chain attacks.Implement vendor risk assessment programs.Require subcontractors to meet CMMC Level 2 or higher. |
Who Needs to Comply with CMMC Level 3?
- Organizations that handle CUI critical to national security
- Organizations that work on high-value DoD contracts requiring maximum protection against nation-state threats
- Organizations that support mission-critical defense programs
Assessment Requirements
Unlike Levels 1 and 2, which involve self-assessments or third-party assessments, CMMC Level 3 requires a government-led assessment every three years. Conducted by the DoD’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), it requires extensive documentation of security controls and includes penetration testing and simulated cyber threat scenarios.
CMMC Compliance: What It Means for Contractors
For contractors, CMMC compliance is a prerequisite for doing business with the DoD. In other words, failure to meet the required cybersecurity maturity level can result in ineligibility for government contracts.
Federal Contract Information vs. Controlled Unclassified Information
Understanding the difference between FCI and CUI is essential to determining the required CMMC compliance level.
| Type | Definition | Who Handles It? | CMMC Level Required |
| FCI | Non-public information provided by the US government under a contract, but no classified data. Examples: Contract performance reportsProject deliverablesProcurement and payment records | All DoD contractors handling basic contract information | CMMC Level 1 (Foundational) |
| CUI | Sensitive but unclassified information that requires safeguards as per NIST SP 800-171. Examples: Technical data on military equipmentEngineering blueprints and schematicsExport-controlled informationPersonally identifiable information (PII) of DoD personnel | Contractors working on defense projects involving sensitive DoD data | CMMC Level 2 (Advanced) or Level 3 (Expert) |
CMMC Assessment Process and Certification Requirements
The CMMC certification process verifies that organizations comply with cybersecurity standards before working with the DoD. Certification is required in order to bid on DoD contracts.
The assessment type depends on the CMMC maturity level required for the contract:
| CMMC Level | Assessment Type |
| Level 1 (Foundational) | Self-assessment (annually) |
| Level 2 (Advanced) | Third-party assessment (C3PAO) every 3 years for critical contractors; self-assessment for others |
| Level 3 (Expert) | Government-led assessment (DIBCAC) every 3 years |
Certified Third-Party Assessment Organizations
Role of C3PAOs
C3PAOs are accredited by the Cybersecurity Maturity Model Certification Accreditation Body (CMMC-AB) to perform formal cybersecurity assessments for companies seeking CMMC Level 2 certification. They evaluate compliance with CMMC security requirements, including technical controls, policies, and documentation. After completing an assessment, C3PAOs submit findings and recommendations to the CMMC-AB for final review. If a company meets the requirements, the CMMC-AB grants the certification, which is valid for three years.
Requirements for C3PAOs
To avoid conflicts of interest,C3PAOs cannot act as consultants and assessors for the same company. C3PAOs undergo regular reviews and audits to retain their accreditation from the CMMC-AB. They must comply with strict cybersecurity standards, including Federal Risk and Authorization Management Program (FedRAMP) requirements if they handle CUI.
Selecting a C3PAO
Companies seeking CMMC Level 2 certification must hire an approved C3PAO from the CMMC Marketplace, a directory of accredited assessment organizations.
Timeline for CMMC Implementation and Compliance Deadlines
The DoD released the Final Rule for CMMC in October 2024, setting the foundation for implementation and compliance in federal contracts. The final CMMC program rule officially became law on December 16, 2024.
To provide contractors with time to adapt and obtain the required certifications before full CMMC enforcement, rollout will occur in 4 phases over 3 years:.
Achieving CMMC Certification
What is CMMC certification?
Steps to becoming CMMC certified
Role of Certified Third-Party Assessment Organizations (C3PAOs)
Timeline for CMMC implementation and compliance deadlines
Preparing for a CMMC Assessment
Preparing for a CMMC assessment is crucial for organizations that want to bid on or work with the DoD. Here’s a breakdown of the key requirements, common challenges, and tools/resources that can help you prepare.
Key Requirements to Meet Before an Audit
Before undergoing a CMMC assessment, organizations should take the following steps:
CMMC Certification Process
- Determine your required CMMC level. If you handle FCI (but no CUI), it is Level 1; if you handle CUI, it is Level 2 or 3.
- Conduct a gap analysis. Compare your current cybersecurity policies against the CMMC requirements for your required level. Identify missing controls and create a remediation plan. Develop documentation for security policies, incident response, and risk management.
- Develop a System Security Plan (SSP). Document how your cybersecurity policies, procedures and controls satisfy the required controls.
- Create a Plan of Action and Milestones (POA&M). If gaps are identified, outline a structured remediation plan with timelines to achieve full compliance.
- Implement required security controls. Apply access controls, encryption, MFA, continuous monitoring and other security measures based on your CMMC level requirements.
- Perform a self-assessment. Utilize the DoD’s CMMC Assessment Guide to check whether all required controls are implemented correctly.
- Ensure compliance documentation is complete. Maintain detailed records of all cybersecurity policies, procedures and system configurations to provide evidence of compliance during the audit.
- Train employees on cybersecurity best practices. Ensure all staff members understand your security policies and compliance obligations under CMMC.
Common Compliance Challenges and How to Overcome Them
Achieving CMMC compliance can be challenging, particularly for small and mid-sized contractors. Below are common obstacles and solutions.
- Incomplete documentation — Be sure to create a comprehensive SSP detailing implemented security controls and an incident response plan that outlines how your organization will identify, respond to and recover from cyber incidents.
- Insufficient access controls — Enforce least privilege using RBAC and implement MFA as part of a Zero Trust framework. Be sure to implement appropriate encryption protocols.
- Lack of continuous monitoring — Watch for threats in real time using automated monitoring and SIEM tools.
- Supply chain security vulnerabilities — Ensure all your vendors and subcontractors meet CMMC requirements. Include cybersecurity clauses in their contracts.
- Budget constraints — To implement required security controls on a tight budget, leverage affordable compliance tools, apply for DoD grants or financial assistance, and prioritize high-risk security gaps.
Tools and Resources for CMMC Readiness
The following resources can help you with key tasks as you prepare for CMMC assessment:
- Gain a deeper understanding CMMC — CMMC workshops and training programs
- Evaluate your organization’s readiness — Self-assessment tools from the CMMC Accreditation Body
- Implement required controls for handling CUI — NIST SP 800-171 Toolkit
- Get end-to-end help — CMMC-accredited consultants can help you navigate the compliance process, conduct a gap analysis and prepare for the audit.
When you’re ready to implement specific security controls, consider tools like the following:
- Compliance management (track progress, implement security measures and generate necessary documentation) — Vanta, Drata, CyberStrong
- Real-time monitoring, alerting and reporting — Sumo Logic, Splunk
- Risk assessment and mitigation — RiskWatch
- Security weakness detection — Tenable, Qualys, Nessus
- Strong authentication — Okta, Microsoft Entra ID
Impact of CMMC on the Defense Industrial Base
Strengthening Cybersecurity Across the Defense Supply Chain
The DIB consists of thousands of contractors handling sensitive DoD information. Weak cybersecurity in even a single company can create vulnerabilities for the entire supply chain.
CMMC requires strong, consistent cybersecurity practices across all DoD suppliers, which helps reduce the risk of data breaches, espionage and intellectual property theft. Organizations with weaker cybersecurity postures, such as smaller businesses, may need to upgrade their security measures to meet CMMC requirements.
Compliance Becomes a Requirement for DoD Contracts
CMMC certification is being integrated into DoD contracts through 2026 and will eventually become mandatory for any company doing business with the DoD. This will have several effects on the DIB:
- Contractors must invest in compliance or risk losing DoD contracts.
- Companies with CMMC certification gain a competitive advantage in securing contracts.
Financial and Operational Impact on Defense Contractors
Achieving CMMC certification often involves a variety of expenses, including the following:
- Cybersecurity consultants to help design and implement security controls
- Investments in technology, such as encryption, MFA and monitoring tools
- Increased IT workload to develop, document and manage security policies and controls
- Training for all personnel
- Assessments: Level 2 and Level 3 assessments by C3PAOs can range from $10,000 to $100,000+, depending on company size and complexity, and are required every three years; Level 1 self-assessment (annual) may be achieved at a lower cost but still requires documentation.
- Fines for non-compliance
- Missed revenue from losing contracts
Key impacts on the DIB will likely include the following:
- Large contractors will adapt quickly while small businesses may struggle to achieve certification.
- Demand for cybersecurity professionals and CMMC consultants will grow.
- Compliance costs may lead to increased consolidation.
Stricter Supply Chain Security & Vendor Management
Under CMMC, prime contractors must ensure that all subcontractors meet the necessary CMMC level requirements — companies must evaluate vendor security before forming partnerships.
The increased demand for CMMC-compliant vendors will give compliant businesses a competitive edge. However, the potential reduction in the number of eligible subcontractors may hurt supply chain flexibility.
Competitive Advantage for Early Adopters
Companies that achieve CMMC certification early will gain a strategic advantage over competitors in securing DoD contracts and partnerships. In fact, early adopters will likely dominate DoD contract opportunities.
Future of CMMC and Cybersecurity Compliance
CMMC will continue to evolve. Future versions of CMMC could introduce:
- More requirements around automation and continuous monitoring
- Mandates to adopt Zero Trust security principles
- Requirements to use secure cloud service providers (e.g., FedRAMP High)
- Applicability to government sectors beyond DoD
To stay ahead, organizations should:
- Monitor updates from the DoD’s Office of the CIO and Cyber AB.
- Join working groups, attend industry days and participate in webinars.
- Maintain flexible cybersecurity programs that can adapt to new requirements.
Think Beyond DoD: Position for Future Regulations
Cybersecurity maturity models like CMMC are quickly gaining relevance well beyond the DoD. Here’s some information on why and where these models are expanding, and what it means for businesses.
Expanding Regulatory Landscape
While CMMC started as a DoD initiative, other federal agencies and sectors are beginning to adopt similar models to manage cyber risk in their supply chains. Agencies that are now referencing NIST SP 800-171 or looking into CMMC-aligned frameworks in their own contracts include:
- GSA (General Services Administration)
- DHS (Department of Homeland Security)
- DOE (Department of Energy)
- NASA (National Aeronautics and Space Administration)
Commercial Sector Is Taking Note
Industries like finance, healthcare, energy and manufacturing are under increasing pressure to secure their digital ecosystems. Factors driving this shift include the following:
- Ransomware and supply chain attacks are rising.
- Clients, investors and insurers are demanding evidence of cyber maturity.
- Regulatory bodies like SEC, HIPAA and NERC are tightening security and reporting rules.
Cyber Maturity as a Competitive Advantage
Organizations that adopt structured maturity models can:
- Win more contracts by proving they are secure and compliant
- Negotiate better cyber insurance premiums
- Build trust with partners and customers
- Respond faster to audits, incidents and regulatory changes
Insurance and Legal Implications
Cyber insurance providers and legal teams are increasingly using cyber maturity levels to:
- Set policy rates
- Evaluate liability and risk exposure
- Handle breach response and litigation
Companies with clear documentation, tested controls and a maturity model in place are far more defensible in the event of a cyber incident.
Toward Global Standards
International alignment is growing too. Countries and alliances like NATO are exploring or adopting CMMC-style models to secure their own defense and critical infrastructure supply chains.
Notable movements include:
- UK’s Cyber Essentials Plus
- EU’s NIS2 Directive
- ISO/IEC 27001 maturity integrations
- Multinational companies are adopting NIST frameworks globally
Conclusion
CMMC is a vital framework because it establishes a standardized, enforceable approach to protecting sensitive government data across the defense supply chain. It shifts cybersecurity from a reactive IT function to a proactive, organization-wide responsibility.
CMMC compliance is no longer optional — it’s a competitive necessity. Organizations across both the public and private sectors that take a proactive stance now will not only meet DoD requirements but also position themselves as trusted, resilient partners.
FAQ
What does CMMC do?
CMMC stands for Cybersecurity Maturity Model Certification. It defines specific cybersecurity practices and maturity levels that DoD contractors must meet, based on the sensitivity of the data they handle. Properly securing Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) enhances the security of the Defense Industrial Base (DIB).
What is the difference between CMMC and NIST?
While CMMC and National Institute of Standards and Technology (NIST) are closely related in the cybersecurity world — especially for defense contractors — they serve different purposes. Here are the key differences.
| Feature | CMMC | NIST |
| Purpose | A certification framework to verify cybersecurity practices for DoD contractors | A government agency that develops standards and guidelines, including cybersecurity controls |
| Focus | Ensures compliance and certification for protecting CUI and FCI in the Defense Industrial Base | Provides technical standards like NIST SP 800-171 for managing cybersecurity risks |
| Mandatory? | Yes, for DoD contracts that require handling of sensitive data (once fully implemented) | Indirectly — NIST SP 800-171 is required by DFARS 7012, but not a certification |
| Assessment Type | Requires self-assessments or third-party certification based on applicable maturity level | No formal certification; organizations implement and self-attest to NIST requirements |
| Structure | Defines 3 maturity levels with increasing cybersecurity rigor | Uses control families (like the 110 controls in NIST SP 800-171) |
What are the 3 CMMC levels?
The three maturity levels defined in CMMC 2.0 are:
| Level 1: Foundational | Focuses on basic safeguarding of FCIBased on 17 practices from FAR 52.204-21Annual self-assessmentRequired for contractors that work with the federal government but do not handle CUI |
| Level 2: Advanced | Focuses on protection of CUIBased on 110 controls from NIST SP 800-171Third-party assessment (every 3 years) for critical national security work; annual self-assessment for lower-risk programsRequired for most defense contractors handling CUI |
| Level 3: Expert | Focuses on protection of CUI in high-priority, critical defense programsBased on NIST SP 800-171 plus a subset of NIST SP 800-172Government-led assessmentRequired for large or critical contractors involved in highly sensitive work |
See the Breakdown of CMMC Levels and Requirements section for a detailed discussion of the three levels.
How can an organization get CMMC certified?
Getting CMMC certified involves a structured process to assess and validate your organization’s cybersecurity practices:
- Determine which level (1, 2 or 3) your contracts or expected work require.
- Compare your current cybersecurity posture against the requirements for your target level to identify missing controls, documentation gaps and process issues.
- Develop a System Security Plan (SSP) and Plan of Action and Milestones (POA&M).
- Implement the required security controls.
- Engage a C3PAO (for Level 2 assessments).
- Undergo the assessment.
See the CMMC Assessment Process and Certification Requirements and Preparing for a CMMC Assessment sections for details.
Is CMMC certification worth it?
Yes, CMMC certification is absolutely worth it for many organizations, especially those working with or seeking to work with the US Department of Defense (DoD) and other federal agencies. Key reasons include the following:
- CMMC is required to bid on and win many DoD contracts.
- CMMC helps you identify and close gaps in your security. As a result, you can reduce the risk of data breaches and downtime from causes like ransomware, phishing and supply chain attacks.
- Being certified sets you apart from competitors who aren’t compliant — even in the private sector.
- CMMC aligns with NIST standards that are being adopted beyond the DoD. Therefore, by becoming CMMC compliant, you will be better positioned for future federal, state and industry regulations.
