CMMC, the Cybersecurity Maturity Model Certification, is the Department of War’s program for verifying that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It does not create new security requirements. It checks whether contractors meet the ones their contracts already require: FAR 52.204-21 for FCI, and NIST SP 800-171 for CUI. Depending on the level, verification comes through self-assessment, an independent C3PAO, or a government assessment.
Status, October 8, 2026: CMMC Phase 1 (self-assessments) is in force. Phase 2 (mandatory C3PAO assessments) was suspended on July 13, 2026, pending a DoW review. See where CMMC stands now.
What does CMMC stand for?
CMMC stands for Cybersecurity Maturity Model Certification.
- “Maturity model” is a holdover from the original 2020 version. That version scored how institutionalized a contractor’s security processes were across five levels.
- “Certification” refers to the formal status a contractor receives after an assessment. The status is recorded by the Department of War and visible to contracting officers.
Today the name is mostly historical. Current CMMC is less a maturity model than a verification program with three levels, each tied to the type of information a contract involves.
What is CMMC compliance?
CMMC compliance means three things are true for the systems that handle a contract’s FCI or CUI:
- You have implemented every requirement for the CMMC level in your contract.
- You have been assessed at that level, by yourself, a C3PAO, or DCMA DIBCAC, depending on the contract.
- A senior official at your company affirms continued compliance every year in the Supplier Performance Risk System (SPRS).
Compliance attaches to a contract, not to a company in general. A contractor needs CMMC only when a solicitation or contract includes DFARS clause 252.204-7021 and specifies a level. You can be compliant for Level 1 work and not yet eligible for a Level 2 contract.
Why CMMC exists
Since 2017, DFARS 252.204-7012 has required defense contractors to implement NIST SP 800-171, but compliance was largely on the honor system. Contractors self-attested, and DoD had limited ability to check.
CMMC was DoD’s answer to that verification gap. It adds a formal assessment and a signed affirmation to requirements contractors already had, so contracting officers can confirm a supplier’s status before award.
The broader goal is protecting the defense supply chain. Sensitive but unclassified information about weapons programs, logistics, and technology passes through many companies, including small subcontractors several tiers below the prime. Any one of them can be the weak point. For the business case, see why CMMC matters.
How CMMC, NIST SP 800-171, and DFARS fit together
Defense contractors deal with three overlapping layers. Each does a different job:
| Layer | What it is | What it does | Key reference |
|---|---|---|---|
| DFARS | Defense Federal Acquisition Regulation Supplement: contract clauses | Creates the legal obligation in your contract | 252.204-7012 (safeguard CUI, report incidents in 72 hours) · 7019/7020 (SPRS score) · 7021 (CMMC level) |
| NIST SP 800-171 | A security standard published by NIST | Defines what you must do to protect CUI: 110 requirements in 14 families | NIST SP 800-171 Rev 2 |
| CMMC | A Department of War assessment program, codified in 32 CFR Part 170 | Verifies that you did it, and records your status | 32 CFR Part 170 |
In short: DFARS creates the obligation, NIST SP 800-171 defines the controls, and CMMC verifies them. Level 3 adds 24 requirements from NIST SP 800-172 for the most sensitive programs.
NIST does not run or certify CMMC. NIST is a non-regulatory agency. Its standards become mandatory only when a regulation or contract requires them.
Two practical consequences:
- Passing a CMMC assessment does not satisfy every DFARS obligation. Incident reporting under 7012 and cloud provider requirements still apply on their own.
- Having no CMMC requirement does not excuse you from NIST SP 800-171. If your contract includes 7012 and you handle CUI, you must still implement it.
For a requirement-by-requirement mapping, see CMMC vs. NIST SP 800-171.
What information does CMMC protect?
CMMC covers two kinds of information. Which one you handle decides your level.
- Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Examples include contract details, pricing, and delivery schedules. FCI alone requires Level 1.
- Controlled Unclassified Information (CUI) is information the government creates or possesses that a law, regulation, or government-wide policy requires or permits the government to handle with safeguarding or dissemination controls. It is not classified. Examples include controlled technical information, export-controlled data, and some critical infrastructure information. CUI requires Level 2, or Level 3 for the highest-priority programs.
The National Archives’ Information Security Oversight Office (ISOO) runs the government-wide CUI program under 32 CFR Part 2002. It maintains the CUI Registry, the official list of CUI categories.
Each category is either CUI Basic, handled under the standard safeguards, or CUI Specified, where the underlying law adds handling rules on top of the baseline. For a full explanation of CUI Basic vs. CUI Specified, markings, and the Registry, see What Is CUI?
The three CMMC levels at a glance
| Level | Information | Requirements | Assessment |
|---|---|---|---|
| Level 1 (Foundational) | FCI | 15 from FAR 52.204-21 | Annual self-assessment |
| Level 2 (Advanced) | CUI | 110 from NIST SP 800-171 Rev 2 | Self-assessment or C3PAO, every 3 years |
| Level 3 (Expert) | High-priority CUI | Level 2, plus 24 from NIST SP 800-172 | DCMA DIBCAC, every 3 years |
All three levels also require an annual affirmation in SPRS. Requirement details, POA&M rules, and scoring are on the CMMC requirements page.
CMMC 2.0 vs. CMMC 1.0: why you still see “2.0”
You will see “CMMC 2.0” across vendor sites and older guidance. Here is what it refers to.
CMMC 1.0 (released January 2020) had five levels and 171 practices. It required a third-party assessment for every contractor, even those handling only FCI. It also scored process maturity. Industry pushed back on the cost and complexity.
CMMC 2.0 (announced November 2021) restructured the program:
- Five levels became three.
- The extra CMMC-unique practices and maturity processes were dropped. Requirements now map directly to FAR 52.204-21, NIST SP 800-171, and NIST SP 800-172.
- Self-assessment was allowed at Level 1 and for some Level 2 contracts.
- Limited POA&Ms were permitted.
The 2.0 model is what DoD then wrote into regulation. Today there is just “CMMC.” If a page still describes CMMC Level 4 or Level 5, it is describing a version that never took effect in contracts.
CMMC timeline
| Date | Milestone |
|---|---|
| Jan 2020 | CMMC 1.0 model published (5 levels) |
| Nov 30, 2020 | DFARS interim rule takes effect: 7019, 7020, 7021, and SPRS scoring |
| Nov 2021 | CMMC 2.0 announced (3 levels) |
| Dec 16, 2024 | CMMC program rule, 32 CFR Part 170, takes effect |
| Nov 10, 2025 | DFARS CMMC rule takes effect. Phase 1 (self-assessments) begins. |
| Jul 13, 2026 | DoW suspends Phase 2 and later phases. Reform Task Force begins a 60-day review. |
Who is involved in CMMC
- DoW Chief Information Officer: owns CMMC policy.
- The Cyber AB: authorizes and accredits C3PAOs and registers practitioners (RPs and RPOs). ISACA, as the CAICO, certifies individual assessors (CCPs and CCAs).
- C3PAOs: perform Level 2 certification assessments.
- DCMA DIBCAC: performs Level 3 assessments.
- Contractors and subcontractors: called Organizations Seeking Assessment (OSAs) in the rule.
- Registered Practitioner Organizations (RPOs) and advisors: help contractors prepare. RPOs cannot perform certification assessments, and under the Cyber AB Code of Professional Conduct a C3PAO cannot assess an organization it consulted for within the preceding three years.
For how an assessment actually runs, see how CMMC works.
Frequently asked questions
Where to go next
- CMMC compliance guide
- Who needs CMMC?
- CMMC requirements by level
- How to prepare for CMMC
- CMMC glossary
Work with RSI Security
RSI Security is a Cyber AB-authorized C3PAO that performs independent CMMC Level 2 assessments. Organizations still preparing can work with RSI Security on readiness through a separate advisory engagement. RSI Security does not assess any organization it has advised on CMMC.
Schedule a CMMC Level 2 assessment · Talk to an advisor about readiness