CMMC

Introduction: The Cybersecurity Maturity Model Certification (CMMC)

The Cybersecurity Maturity Model Certification (CMMC) is the United States Department of Defense's (DoD) unified standard for protecting sensitive but unclassified information across the Defense Industrial Base (DIB). It transforms cybersecurity from a self-attested contractual promise into a verifiable, certified state of assurance. Rather than inventing an entirely new control catalogue, CMMC operationalises long-standing federal requirements — principally the Federal Acquisition Regulation (FAR) clause 52.204-21 and National Institute of Standards and Technology (NIST) Special Publication 800-171 Revision 2 — and, at its highest level, a subset of NIST SP 800-172. The programme's defining innovation is the requirement for independent, third-party assessment for most contractors that handle Controlled Unclassified Information (CUI), replacing the prior honour-system of self-scoring.

This guide is written for chief information security officers, compliance leads, contract managers and technical implementers within organisations that supply — directly or indirectly — to the DoD. It provides an auditor-grade walkthrough of the CMMC 2.0 model as codified in the final programme rule (32 CFR Part 170, effective 16 December 2024) and the acquisition rule (48 CFR / DFARS 252.204-7021). It covers what CMMC is, who must comply, its structure across levels and domains, a master assessment checklist enumerating every control family, scoping guidance, a phased implementation approach, the scoring model, the assessment lifecycle, evidence expectations, roles, key performance indicators, readiness checks, common gaps and mappings to adjacent frameworks.

What is CMMC?

CMMC is a certification framework that verifies whether a defence contractor has implemented the cybersecurity practices necessary to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) resident on or transiting through the contractor's non-federal information systems. It answers a simple but consequential question that the DoD could not previously answer with confidence: are the companies entrusted with sensitive defence data actually doing what they claimed?

Under the original CMMC 1.0 model announced in 2020, there were five maturity levels and process-maturity requirements layered on top of practices. Following an extensive internal review, the DoD released CMMC 2.0 in November 2021, streamlining the model to three levels, eliminating the standalone maturity-process requirements, and aligning practices directly to established NIST standards. The final 32 CFR Part 170 rule made CMMC 2.0 legally binding, with a phased rollout of contractual requirements beginning in 2025.

Two categories of protected data drive the model. Federal Contract Information (FCI) is information provided by or generated for the Government under a contract that is not intended for public release; it is protected by the fifteen basic safeguarding requirements of FAR 52.204-21. Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation or Government-wide policy requires to be safeguarded; it demands the 110 security requirements of NIST SP 800-171 Rev 2, and at the highest maturity level a subset of NIST SP 800-172's enhanced requirements to counter advanced persistent threats.

• CMMC does not create new controls at Levels 1 and 2 — it enforces and verifies existing FAR and NIST requirements.
• Certification is scoped to the specific information systems that store, process or transmit FCI or CUI, not necessarily the entire enterprise.
• Assessments are conducted by CMMC Third-Party Assessment Organisations (C3PAOs) accredited by the Cyber AB (formerly the CMMC Accreditation Body) for Level 2 certification, and by the Defense Contract Management Agency's DIBCAC for Level 3.
• Certification results are recorded in the Supplier Performance Risk System (SPRS) and are valid for three years, subject to an annual affirmation by a senior company official.
• CMMC embeds the concept of the flow-down: prime contractors must ensure subcontractors handling the same information type hold the appropriate certification level.

Who Must Comply

CMMC applies to every organisation in the Defence Industrial Base that will process, store or transmit FCI or CUI on contractor-owned information systems in the course of performing a DoD contract or subcontract. This encompasses primes, subcontractors at all tiers, and suppliers of products and services — but explicitly excludes contractors that provide only Commercial Off-The-Shelf (COTS) items. The required level is determined by the type of information handled and is specified by the contracting officer in the solicitation.

• The contract's DFARS 252.204-7021 clause states the required CMMC level; performing without a current certification at award is prohibited once the clause applies.
• Foreign suppliers to the DoD are equally subject; there is no geographic exemption for the underlying obligation.
• Universities, research institutions and non-profits performing DoD work that involves CUI are in scope.
• External Service Providers (ESPs), including cloud service providers, that handle CUI or Security Protection Data must meet defined conditions; CSPs storing CUI must satisfy FedRAMP Moderate equivalency.

Structure of CMMC

CMMC 2.0 is organised into three cumulative certification levels. Each higher level subsumes the requirements of the levels beneath it. The practices are grouped into fourteen control families (referred to as domains) inherited from NIST SP 800-171, plus the fifteen basic safeguards of FAR 52.204-21 that constitute Level 1. Level 3 adds selected enhanced requirements drawn from NIST SP 800-172. The table below summarises the model's architecture.

The fourteen NIST SP 800-171 domains, which structure Levels 2 and 3, are enumerated below with their two-letter identifiers. Requirement numbers throughout CMMC follow the NIST 800-171 convention (family.category.number, e.g., 3.1.1) and are cross-referenced in SPRS scoring.

Master Assessment Checklist

This is the core section of the guide. It enumerates every CMMC control family together with the essential requirements within each, expressed as verification statements an assessor would test. For each family a table lists 'What to verify' against 'Typical evidence'. Level 1 (FCI) is covered first because it forms the foundation of every higher level, followed by the fourteen NIST 800-171 domains that comprise Level 2, and finally the enhanced 800-172 requirements introduced at Level 3. No control area is omitted.

Level 1 Foundational — FAR 52.204-21 Basic Safeguarding (FCI)

Level 1 comprises fifteen basic safeguarding requirements mapped to seventeen practice objectives across six domains (AC, IA, MP, PE, SC, SI). These protect Federal Contract Information and are the non-negotiable floor for any DoD contractor.

Access Control (AC) — Level 2

Awareness and Training (AT) — Level 2

Audit and Accountability (AU) — Level 2

Configuration Management (CM) — Level 2

Identification and Authentication (IA) — Level 2

Incident Response (IR) — Level 2

Maintenance (MA) — Level 2

Media Protection (MP) — Level 2

Personnel Security (PS) — Level 2

Physical Protection (PE) — Level 2

Risk Assessment (RA) — Level 2

Security Assessment (CA) — Level 2

System and Communications Protection (SC) — Level 2

System and Information Integrity (SI) — Level 2

Level 3 Enhanced Requirements — NIST SP 800-172 Subset

Level 3 layers a selected subset of NIST SP 800-172 enhanced security requirements on top of the full 110 requirements of Level 2. These target advanced persistent threats and demand penetration-resistant architecture, damage-limiting operations and heightened detection. Level 3 is assessed by the Government's DIBCAC, not by a commercial C3PAO.

Scoping

Scoping determines which assets fall within the CMMC assessment boundary and, therefore, which controls apply to them. Correct scoping is the single most consequential planning decision in a CMMC engagement: an overly broad scope inflates cost and assessment burden, while an overly narrow scope invites a failed assessment or, worse, a false attestation. The DoD publishes dedicated Scoping Guides for Level 1 and Level 2. The methodology categorises every asset in the environment into defined types.

• Segmentation is the primary lever for reducing scope — an enclave dedicated to CUI can dramatically shrink the boundary versus a flat network.
• External Service Providers, including cloud, must be accounted for; CSPs storing CUI require FedRAMP Moderate authorisation or equivalency.
• The System Security Plan and an accurate, current network diagram are mandatory scoping artefacts and are the first documents an assessor examines.
• People, facilities and processes that touch CUI are in scope, not merely technology assets.
• Every asset must be inventoried and categorised; unlabelled or 'shadow' assets are a frequent cause of assessment findings.

Implementation Approach

A defensible CMMC programme is delivered in phases. The following five-phase roadmap moves an organisation from ambiguity to a sustained, certifiable state. Each phase lists its key activities and the deliverables that evidence completion.

Phase 1 — Discovery and Scoping

• Activities: identify all FCI and CUI flows; interview data owners; classify contracts and required levels; inventory assets; draft the CUI data-flow map; categorise assets per the scoping guide.
• Deliverables: CUI data-flow diagram, asset inventory, preliminary scope statement, target CMMC level confirmation, stakeholder RACI.

Phase 2 — Gap Assessment

• Activities: assess current state against all applicable requirements; score against the SPRS methodology; identify deficiencies and dependencies; estimate remediation effort and cost.
• Deliverables: gap-analysis report, current SPRS score, prioritised remediation backlog, draft Plan of Action and Milestones (POA&M).

Phase 3 — Remediation and Control Implementation

• Activities: implement or reconfigure technical controls (MFA, encryption, logging, segmentation); write and ratify policies and procedures; deploy security tooling; deliver training; establish continuous monitoring.
• Deliverables: implemented controls, policy and procedure library, configuration baselines, training completion records, closed POA&M items.

Phase 4 — Documentation and Pre-Assessment

• Activities: finalise the System Security Plan; assemble the evidence library mapped to each requirement; conduct a mock/readiness assessment; remediate residual gaps.
• Deliverables: complete and current SSP, evidence matrix, readiness-assessment report, updated SPRS score meeting the required threshold.

Phase 5 — Certification and Sustainment

• Activities: engage a C3PAO (Level 2) or coordinate with DIBCAC (Level 3); support the assessment; close conditional POA&M items within 180 days; submit the annual affirmation; operate continuous monitoring.
• Deliverables: CMMC certificate recorded in SPRS, annual affirmation, continuous-monitoring metrics, three-year sustainment plan.

Scoring Model

For Level 2, CMMC uses the NIST SP 800-171 DoD Assessment Methodology to derive an SPRS score. The maximum score is 110, one point per satisfied requirement. Unmet requirements deduct weighted points — most subtract 1 point, but certain high-impact controls subtract 3 or 5 points, meaning a low score can quickly fall below zero. A perfect implementation yields 110; the minimum floor for score reporting is -203. To achieve certification, an organisation must meet all requirements, though a limited set may be deferred via a conditional POA&M.

Assessment and Audit Approach

The CMMC assessment lifecycle follows a structured, evidence-driven sequence. Whether self-performed (Level 1) or conducted by a C3PAO (Level 2) or DIBCAC (Level 3), the underlying methodology mirrors the NIST SP 800-171A assessment objectives, using the examine, interview and test methods.

1. Define and confirm the assessment scope, including the CUI boundary, asset categories and the System Security Plan.
2. Engage the appropriate assessor — a certified C3PAO for Level 2 or coordinate the DIBCAC assessment for Level 3 — and agree the assessment plan and timeline.
3. Conduct a readiness or pre-assessment review to identify and close residual gaps before the formal assessment begins.
4. Perform the assessment using three methods: examine documents and configurations, interview responsible personnel, and test control operation directly.
5. Evaluate each of the assessment objectives underlying every requirement, scoring MET, NOT MET or NOT APPLICABLE with supporting rationale.
6. Document findings, including any deficiencies eligible for a conditional POA&M, and calculate the resulting SPRS score.
7. Issue the assessment result; a conditional certification is granted where eligible POA&M items exist, converting to final upon closure within 180 days.
8. Record the certification and score in SPRS, and submit the senior-official annual affirmation attesting to continued compliance.
9. Sustain compliance through continuous monitoring, re-affirming annually, and re-assessing on the three-year cycle.

Evidence Request List

Assessors expect a curated evidence library mapped requirement-by-requirement. Evidence is typically grouped into the following categories.

• Governance and policy: information security policy, acceptable-use policy, access-control policy, incident-response plan, media-protection policy, configuration-management plan, risk-management policy.
• System documentation: System Security Plan (SSP), current network and data-flow diagrams, asset inventory with categorisation, hardware/software baselines, CUI marking guide.
• Identity and access: user/privileged account inventories, RBAC/entitlement matrices, joiner-mover-leaver records, MFA enrolment reports, access-review evidence.
• Technical configuration: firewall and IDS/IPS rulesets, encryption (FIPS-validated) configuration, patch-management reports, hardening checklists, DLP and endpoint policies.
• Logging and monitoring: SIEM configuration, log retention settings, audit-review records, alert triage tickets, NTP/time-sync evidence.
• Operational records: change-management tickets, vulnerability scan and remediation reports, penetration test reports (Level 3), backup and recovery test results.
• Training and personnel: security-awareness completion records, role-based training rosters, insider-threat training, background-screening confirmations, offboarding checklists.
• Third-party and cloud: ESP/MSP agreements, CSP FedRAMP Moderate authorisation or equivalency letters, subcontractor flow-down and certification verification.
• Assessment artefacts: prior gap-analysis and readiness reports, POA&M with milestones, SPRS score record, annual affirmation records.

Roles and Responsibilities

KPIs to Track

• SPRS assessment score against the 110 maximum and its trend over time.
• Percentage of applicable requirements fully met, partially met and not met.
• Number of open POA&M items and mean time to closure against the 180-day limit.
• Mean time to detect (MTTD) and mean time to respond (MTTR) to security incidents.
• Patch and vulnerability remediation SLA compliance rate, by severity.
• Multi-factor authentication coverage across privileged and remote access.
• Percentage of assets inventoried, categorised and mapped to the SSP.
• Security-awareness and role-based training completion rates.
• Phishing-simulation failure rate and trend.
• Percentage of subcontractors with verified flow-down certification.
• Log coverage — proportion of in-scope assets forwarding audit logs to the SIEM.
• Days remaining until certification expiry and next annual affirmation due date.

Readiness Checklist

• CUI and FCI data flows have been identified, documented and mapped.
• The required CMMC level for each relevant contract has been confirmed.
• A complete asset inventory exists with every asset categorised per the scoping guide.
• A current, accurate network and data-flow diagram is maintained.
• A System Security Plan covering all applicable requirements is complete and up to date.
• Multi-factor authentication is enforced for privileged and remote/network access.
• FIPS-validated cryptography protects CUI in transit and at rest.
• Centralised logging and monitoring capture in-scope assets with defined retention.
• Security-awareness and role-based training are delivered and evidenced.
• An incident-response plan exists and has been tested within the review period.
• Vulnerability scanning and timely remediation are operational.
• A gap assessment has been completed and the SPRS score calculated.
• A POA&M exists for any eligible open items with realistic milestones.
• An evidence library is assembled and mapped requirement-by-requirement.
• Cloud/ESP providers meet FedRAMP Moderate equivalency where CUI is involved.
• Subcontractor flow-down certification has been verified.
• A senior official is prepared to submit the annual affirmation in SPRS.

Common Gaps

• Incomplete or outdated System Security Plan that fails to describe every applicable requirement — the most frequently cited deficiency.
• Missing or partial multi-factor authentication, a high-weighted (-5) control that alone can sink an SPRS score.
• Use of non-FIPS-validated cryptography for protecting CUI, which does not satisfy the requirement despite encryption being present.
• Poor scoping and asset categorisation, leaving 'shadow' assets or an over-broad boundary.
• Cloud services storing CUI without FedRAMP Moderate authorisation or documented equivalency.
• Inadequate audit logging — logs not centralised, not retained long enough, or not reviewed.
• Treating requirements as policy-only without evidencing operational implementation and testing.
• No tested incident-response capability or missing DoD reporting mechanisms.
• Failure to flow down requirements to subcontractors and verify their certification.
• Neglecting the annual affirmation and continuous-monitoring obligations after certification.
• Overuse of POA&Ms for ineligible or critical controls that cannot be deferred.
• CUI not marked or handled consistently, undermining media-protection and access controls.

CMMC Mapped to Other Frameworks

Frequently asked questions

Need help with CMMC?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.