CMMC
Cybersecurity Maturity Model Certification
DoD framework ensuring defense contractors protect sensitive defense information.
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is a framework developed by the Department of Defense (DoD) to protect sensitive defense information, particularly Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). CMMC 2.0, announced in 2021, simplified the original five-level model to three levels.
CMMC builds upon existing regulations (DFARS, NIST SP 800-171) and requires third-party assessment for certain certification levels. Starting with new DoD contracts, CMMC certification is becoming a prerequisite for bidding on defense contracts involving CUI.
Who Needs CMMC?
- Defense contractors and subcontractors
- Companies handling Controlled Unclassified Information
- DoD supply chain participants
- Organizations with existing DFARS requirements
- Companies seeking defense contract eligibility
Key Requirements
Core compliance areas for CMMC
Level 1: Foundational
Basic safeguarding of FCI with 17 practices based on FAR 52.204-21.
Level 2: Advanced
Protection of CUI with 110 practices aligned with NIST SP 800-171.
Level 3: Expert
Enhanced protection against APTs with additional practices from NIST SP 800-172.
Assessment Requirements
Self-assessment (Level 1), third-party (Level 2), or government-led (Level 3) assessments.
Plan of Action
Documented plans to address any security gaps with specific timelines.
Benefits of CMMC Compliance
- Eligibility for DoD contracts
- Verified cybersecurity posture
- Protection of sensitive defense information
- Competitive advantage in defense market
- Streamlined security assessment process
- Foundation for handling higher-classification work
Official Resources
Related Frameworks
NIST CSF
Voluntary framework providing standards and best practices for managing cybersecurity risk.
FedRAMP
Standardized approach to security assessment for cloud products used by federal agencies.
ISO 27001
The international standard for information security management systems (ISMS).