What Is CMMC?
CMMC, the Cybersecurity Maturity Model Certification, is the Department of Defense program that checks whether defense contractors actually protect the federal contract information and controlled unclassified information they handle. It's a condition of winning the contract, not a voluntary badge.
Table of Contents
If your company machines parts, writes code, or ships anything that ends up inside a Pentagon program, somebody upstream has probably sent you a questionnaire about CMMC, the defense supply chain's own corner of IT compliance. Sometimes it's the prime contractor's legal team. Sometimes it's a buyer two tiers up who wants a yes or no by Friday.
So what is CMMC, in plain terms? Proof. Defense suppliers were already required to follow a federal list of security controls. They just graded themselves. CMMC swaps that honor system for a score you report, a status a senior official signs off on every year, and, on a growing share of contracts, an outside assessor who checks the work. Unlike a SOC 2 report or an ISO certificate that a customer might ask to see someday, a missing or wrong CMMC status can knock you out of a contract award before anyone opens your proposal.
And 2026 made it confusing. The program went live in November 2025, then its biggest phase was suspended in July 2026. Both are true at once. Neither one lets anybody off the hook.
What does CMMC stand for?
CMMC stands for Cybersecurity Maturity Model Certification. Three of those words still describe the program. One is a leftover.
"Certification" is the part with teeth. It's a status recorded in a government system, and a contracting officer looks it up before awarding the contract.
"Maturity model" is history. The first version, CMMC 1.0, arrived by interim rule in 2020 with five levels that graded how mature your security processes were. DoD scrapped that design in November 2021 and announced CMMC 2.0, with three levels mapped straight onto existing federal standards and self-assessment allowed on some contracts. The maturity grading went away. The name stuck.
You'll still see "CMMC 2.0" almost everywhere, including on this site. The regulation itself, 32 CFR Part 170, simply calls it the CMMC Program. Same thing.
Why did the DoD create CMMC?
Self-grading didn't work. Defense contractors have had to follow NIST security controls since the end of 2017, but they scored themselves, and federal auditors kept finding a gap between the score on file and the systems in the building.
The clearest example came in February 2022. The DoD Inspector General audited 10 contractors handling military research and called self-assessments "not an effective method for determining compliance" with the NIST requirements. Four of the 10 had at least three observed deficiencies each.
Now scale that up. A single prime contractor can have several hundred suppliers below it, each one reporting a self-assessed number that nobody in the government had ever checked, on programs that build missiles, satellites, and aircraft. That's a lot of trust for a supply chain that foreign adversaries are actively probing. CMMC is the government's answer, a way to run assessments at the volume the supply chain requires. There's a separate clause-by-clause look at DFARS 7012 vs CMMC if you want the regulatory detail.
How CMMC fits with DFARS 7012 and NIST 800-171
These three names get used interchangeably, and they shouldn't be. Think of them as layers:
- The contract clause. DFARS 252.204-7012 is language in your defense contract. It requires you to protect covered defense information and to report a cyber incident to DoD within 72 hours.
- The control list. NIST SP 800-171 is the actual to-do list, 110 security requirements written by the National Institute of Standards and Technology. NIST writes standards. It doesn't enforce anything.
- The proof. CMMC is how DoD verifies that the first two are real. It reaches you through a different clause, DFARS 252.204-7021, which took effect November 10, 2025.
If 7012 is the law in your contract and 800-171 is the checklist, CMMC is the inspection.
Your self-assessment score lives in SPRS, the Supplier Performance Risk System, a DoD database contracting officers check before they award. A perfect score is 110. Plenty of real ones start well below that. An honest low score with a dated plan beats an inflated one, though a contract that requires CMMC Level 2 needs at least 88 at award. The NIST 800-171 to CMMC crosswalk maps each requirement to its CMMC practice if you're working from an older 800-171 plan.
What information does CMMC protect?
CMMC protects two kinds of government information. Federal Contract Information (FCI) is non-public information you receive or create under a federal contract. Controlled Unclassified Information (CUI) is more sensitive material, such as technical drawings for a military part, that isn't classified but still requires safeguarding.
FAR 52.204-21 defines FCI as information "not intended for public release" that's provided by or generated for the government under a contract. A non-public delivery schedule counts. Simple payment information doesn't.
CUI is the bigger deal. It was created by Executive Order 13556 in 2010, and the National Archives keeps the official CUI Registry of categories. For a manufacturer, the usual suspects are export-controlled technical data and drawings stamped with a distribution statement, the marking that limits who's allowed to see them.
People picture CUI as a file on a server. Often it's a sheet of paper. In a published Consilien case study, a metal finishing shop that anodizes and plates parts for aerospace programs mapped more than 40 separate moments where CUI got handled, and a lot of them happened on the floor. Travelers, the paperwork that follows each job through the shop, riding along with the parts. Drawings in a toolbox. Temp workers from a staffing agency walking past both. A cloud enclave, a walled-off IT environment just for CUI, does nothing for a clipboard.
So the first question is where the controlled information goes, on screens and on paper. Software comes later. More examples like that one are collected on the CMMC case studies page.
What are the three CMMC levels?
CMMC has three levels. Level 1 covers FCI with 15 basic requirements and a yearly self-assessment. Level 2 covers CUI with the 110 NIST SP 800-171 requirements, assessed every 3 years. Level 3 adds 24 requirements from NIST SP 800-172 and is assessed by the government itself.
A C3PAO is a certified third-party assessment organization, an outside firm authorized by the Cyber AB to run official CMMC assessments. DIBCAC is the Defense Industrial Base Cybersecurity Assessment Center, the government's in-house assessment team.
Level 2 is where nearly all the work and money sit. The rule lets you pass conditionally with at least 80% of the maximum score, which works out to 88 of 110, and put the remaining gaps on a POA&M, a plan of action and milestones, basically a dated fix list. You then get 180 days to close it or the conditional status expires. Level 1 gets no such grace. Every requirement has to be met. Both levels require you to keep assessment evidence for six years.
The 110 Level 2 controls are explained one family at a time in a separate post.
Who needs CMMC?
Any company that handles FCI or CUI on a DoD contract or subcontract needs the CMMC level that contract specifies, at every tier of the supply chain. The main exception is a contract solely for commercially available off-the-shelf (COTS) items.
The head count is bigger than people expect. In the September 2025 DFARS final rule, DoD estimated CMMC would reach 337,968 unique companies, primes and subcontractors combined, and that 229,818 of them, 68%, are small businesses. Its breakdown by level:
- 209,540 companies at Level 1
- 6,759 at Level 2 by self-assessment
- 118,289 needing a Level 2 certification from a C3PAO
- 3,380 at Level 3
Primes have to flow the CMMC clause down to any subcontractor that will process, store, or transmit FCI or CUI. If you machine a bracket from a drawing your customer emailed over, that drawing is very likely CUI, and you're in scope. If you sell the same catalog fastener to every customer on earth, you might not be.
Be careful with COTS. It means a product sold to the general public in substantial quantities and delivered without modification, which rules out a surprising number of parts that suppliers casually describe as "standard" on their quotes. Customize it for a defense program, or take in CUI to build it, and the exemption usually stops applying. Calling a product "commercial" on a quote changes nothing.
No DoD contracts, and no customers who hold them? Then CMMC isn't your problem. Skip it, and look at which cybersecurity compliance standards apply to your business instead.
Is CMMC in effect right now?
Yes, partly. Phase 1 has been live since November 10, 2025, so a contract can require a Level 1 or Level 2 self-assessment today. Phase 2, which would have made third-party Level 2 certification standard starting November 10, 2026, was suspended on July 13, 2026.
The suspension came in two memos from the Department of War, the secondary name the Defense Department has used since 2025. Holland & Knight's attorneys described it as "narrowly scoped to CMMC Phase II's third-party and government-led assessment mandates." Phases 3 and 4 went on hold with it. Analysts at CSIS concluded the impact on small businesses "was the principal reason for the CMMC pause," with the Small Business Administration calling the program an "untenable barrier."
A CMMC Reform Task Force ran a 60-day review. Industry comments were due by August 14 through a formal request for information, and as of late October 2026 the task force's final report still hasn't been published or given a release date by the department. On October 27, Federal News Network reported that a task force summary it obtained says DoD could restart Phase 2 within 90 days "with a narrower population" while it works on longer-term rule changes.
What actually stopped, and what didn't:
The inspection got delayed. The rules it inspects didn't move an inch.
The affirmation is a signed statement to the federal government, and the Justice Department's Civil Cyber-Fraud Initiative exists specifically to use the False Claims Act against contractors whose cybersecurity claims don't match reality. I covered that angle in how CMMC 2.0 affects defense contractors.
What does CMMC cost?
A small company's first Level 2 certification assessment costs about $102,000 by DoD's own estimate, including roughly $31,000 paid to the C3PAO, according to the CSIS analysis. Depends who's counting, though. DoD's number assumes all 110 controls are already in place. The SBA's figure, once remediation and recurring costs are added, runs to about $594,000.
A sixfold spread, on the same program. Nearly all of the difference is fixing what isn't done yet, which is why the cost section of the complete guide to CMMC 2.0 compliance and the broader IT compliance cost breakdown both start from your current gap rather than a price list.
Where to start with CMMC
Start with the information, not the tools. Find every place FCI and CUI come in, sit, and leave, including the email inbox where drawings arrive, the shared drive where engineering saves them, the printer on the floor, and the filing cabinet where old travelers end up.
Then look hard at your documentation. In a second published case study, a Tier-2 aerospace subcontractor already had multifactor authentication, endpoint protection, network segmentation, and backups running. Good controls. Almost none of them were written down, and an assessor can't score a control nobody documented. The fix was a System Security Plan, the document that explains how each of the 110 requirements is met, five incident response playbooks, and operating procedures with named owners for each.
After that, post an honest SPRS score. A low, true number with a dated plan behind it is a starting point. A high number nobody can back up is a liability with your CEO's signature on it.
Manufacturers can work through the CMMC 2.0 compliance checklist for manufacturers, which goes control by control on the shop floor. Consilien also runs CMMC compliance services as a standalone engagement, separate from managed IT, covering gap assessments, SSPs and POA&Ms, and assessment evidence.
If you're holding a supplier questionnaire and can't tell which level applies to you, speak to a CMMC expert.