What Is CMMC? The Cybersecurity Maturity Model Certification Explained

Sarah Silva

19 minutes ago

CMMC, the Cybersecurity Maturity Model Certification, is the Department of War’s program for verifying that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It does not create new security requirements. It checks whether contractors meet the ones their contracts already require: FAR 52.204-21 for FCI, and NIST SP 800-171 for CUI. Depending on the level, verification comes through self-assessment, an independent C3PAO, or a government assessment.

Status, October 8, 2026: CMMC Phase 1 (self-assessments) is in force. Phase 2 (mandatory C3PAO assessments) was suspended on July 13, 2026, pending a DoW review. See where CMMC stands now.

What does CMMC stand for?

CMMC stands for Cybersecurity Maturity Model Certification.

“Maturity model” is a holdover from the original 2020 version. That version scored how institutionalized a contractor’s security processes were across five levels.
“Certification” refers to the formal status a contractor receives after an assessment. The status is recorded by the Department of War and visible to contracting officers.

Today the name is mostly historical. Current CMMC is less a maturity model than a verification program with three levels, each tied to the type of information a contract involves.

What is CMMC compliance?

CMMC compliance means three things are true for the systems that handle a contract’s FCI or CUI:

You have implemented every requirement for the CMMC level in your contract.
You have been assessed at that level, by yourself, a C3PAO, or DCMA DIBCAC, depending on the contract.
A senior official at your company affirms continued compliance every year in the Supplier Performance Risk System (SPRS).

Compliance attaches to a contract, not to a company in general. A contractor needs CMMC only when a solicitation or contract includes DFARS clause 252.204-7021 and specifies a level. You can be compliant for Level 1 work and not yet eligible for a Level 2 contract.

Why CMMC exists

Since 2017, DFARS 252.204-7012 has required defense contractors to implement NIST SP 800-171, but compliance was largely on the honor system. Contractors self-attested, and DoD had limited ability to check.

CMMC was DoD’s answer to that verification gap. It adds a formal assessment and a signed affirmation to requirements contractors already had, so contracting officers can confirm a supplier’s status before award.

The broader goal is protecting the defense supply chain. Sensitive but unclassified information about weapons programs, logistics, and technology passes through many companies, including small subcontractors several tiers below the prime. Any one of them can be the weak point. For the business case, see why CMMC matters.

How CMMC, NIST SP 800-171, and DFARS fit together

Defense contractors deal with three overlapping layers. Each does a different job:

Layer	What it is	What it does	Key reference
DFARS	Defense Federal Acquisition Regulation Supplement: contract clauses	Creates the legal obligation in your contract	252.204-7012 (safeguard CUI, report incidents in 72 hours) · 7019/7020 (SPRS score) · 7021 (CMMC level)
NIST SP 800-171	A security standard published by NIST	Defines what you must do to protect CUI: 110 requirements in 14 families	NIST SP 800-171 Rev 2
CMMC	A Department of War assessment program, codified in 32 CFR Part 170	Verifies that you did it, and records your status	32 CFR Part 170

In short: DFARS creates the obligation, NIST SP 800-171 defines the controls, and CMMC verifies them. Level 3 adds 24 requirements from NIST SP 800-172 for the most sensitive programs.

NIST does not run or certify CMMC. NIST is a non-regulatory agency. Its standards become mandatory only when a regulation or contract requires them.

Two practical consequences:

Passing a CMMC assessment does not satisfy every DFARS obligation. Incident reporting under 7012 and cloud provider requirements still apply on their own.
Having no CMMC requirement does not excuse you from NIST SP 800-171. If your contract includes 7012 and you handle CUI, you must still implement it.

For a requirement-by-requirement mapping, see CMMC vs. NIST SP 800-171.

What information does CMMC protect?

CMMC covers two kinds of information. Which one you handle decides your level.

Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Examples include contract details, pricing, and delivery schedules. FCI alone requires Level 1.
Controlled Unclassified Information (CUI) is information the government creates or possesses that a law, regulation, or government-wide policy requires or permits the government to handle with safeguarding or dissemination controls. It is not classified. Examples include controlled technical information, export-controlled data, and some critical infrastructure information. CUI requires Level 2, or Level 3 for the highest-priority programs.

The National Archives’ Information Security Oversight Office (ISOO) runs the government-wide CUI program under 32 CFR Part 2002. It maintains the CUI Registry, the official list of CUI categories.

Each category is either CUI Basic, handled under the standard safeguards, or CUI Specified, where the underlying law adds handling rules on top of the baseline. For a full explanation of CUI Basic vs. CUI Specified, markings, and the Registry, see What Is CUI?

The three CMMC levels at a glance

Level	Information	Requirements	Assessment
Level 1 (Foundational)	FCI	15 from FAR 52.204-21	Annual self-assessment
Level 2 (Advanced)	CUI	110 from NIST SP 800-171 Rev 2	Self-assessment or C3PAO, every 3 years
Level 3 (Expert)	High-priority CUI	Level 2, plus 24 from NIST SP 800-172	DCMA DIBCAC, every 3 years

All three levels also require an annual affirmation in SPRS. Requirement details, POA&M rules, and scoring are on the CMMC requirements page.

CMMC 2.0 vs. CMMC 1.0: why you still see “2.0”

You will see “CMMC 2.0” across vendor sites and older guidance. Here is what it refers to.

CMMC 1.0 (released January 2020) had five levels and 171 practices. It required a third-party assessment for every contractor, even those handling only FCI. It also scored process maturity. Industry pushed back on the cost and complexity.

CMMC 2.0 (announced November 2021) restructured the program:

Five levels became three.
The extra CMMC-unique practices and maturity processes were dropped. Requirements now map directly to FAR 52.204-21, NIST SP 800-171, and NIST SP 800-172.
Self-assessment was allowed at Level 1 and for some Level 2 contracts.
Limited POA&Ms were permitted.

The 2.0 model is what DoD then wrote into regulation. Today there is just “CMMC.” If a page still describes CMMC Level 4 or Level 5, it is describing a version that never took effect in contracts.

CMMC timeline

Date	Milestone
Jan 2020	CMMC 1.0 model published (5 levels)
Nov 30, 2020	DFARS interim rule takes effect: 7019, 7020, 7021, and SPRS scoring
Nov 2021	CMMC 2.0 announced (3 levels)
Dec 16, 2024	CMMC program rule, 32 CFR Part 170, takes effect
Nov 10, 2025	DFARS CMMC rule takes effect. Phase 1 (self-assessments) begins.
Jul 13, 2026	DoW suspends Phase 2 and later phases. Reform Task Force begins a 60-day review.

Who is involved in CMMC

DoW Chief Information Officer: owns CMMC policy.
The Cyber AB: authorizes and accredits C3PAOs and registers practitioners (RPs and RPOs). ISACA, as the CAICO, certifies individual assessors (CCPs and CCAs).
C3PAOs: perform Level 2 certification assessments.
DCMA DIBCAC: performs Level 3 assessments.
Contractors and subcontractors: called Organizations Seeking Assessment (OSAs) in the rule.
Registered Practitioner Organizations (RPOs) and advisors: help contractors prepare. RPOs cannot perform certification assessments, and under the Cyber AB Code of Professional Conduct a C3PAO cannot assess an organization it consulted for within the preceding three years.

For how an assessment actually runs, see how CMMC works.

Frequently asked questions

What does CMMC stand for?

CMMC stands for Cybersecurity Maturity Model Certification. It is the Department of War program that verifies defense contractors protect Federal Contract Information and Controlled Unclassified Information, using self-assessments, independent C3PAO assessments, or government assessments depending on the level.

Is CMMC the same as NIST SP 800-171?

No. NIST SP 800-171 is the security standard: 110 requirements for protecting CUI. CMMC is the program that verifies contractors meet it. CMMC Level 2 uses NIST SP 800-171 Revision 2 as its requirement set.

What is the difference between CMMC and DFARS?

DFARS is the set of defense contract clauses that create the legal obligation. CMMC is the assessment program those clauses invoke. DFARS 252.204-7012 requires NIST SP 800-171, and DFARS 252.204-7021 requires a specific CMMC level when the contract calls for one.

What is CMMC 2.0?

CMMC 2.0 is the name for DoD’s November 2021 restructuring of the program, which cut five levels to three and aligned requirements directly with FAR 52.204-21, NIST SP 800-171, and NIST SP 800-172. The current program, codified in 32 CFR Part 170, is simply called CMMC.

Is CMMC a law?

CMMC is a federal regulation, not a statute. The program is codified in 32 CFR Part 170, and its contract requirements are in the DFARS. It applies to a contractor only when a DoW solicitation or contract includes the CMMC clause and specifies a level.

What is the difference between FCI and CUI?

FCI is non-public information provided by or generated for the government under a contract, and it triggers CMMC Level 1. CUI is information that a law, regulation, or government-wide policy requires or permits to be handled with safeguarding or dissemination controls, and it triggers Level 2 or Level 3.

Does CMMC apply if my company does not handle CUI?

Yes, if you handle Federal Contract Information on a DoW contract that includes the CMMC clause. Those contracts require CMMC Level 1: 15 basic safeguards, an annual self-assessment, and an annual affirmation in SPRS. Contracts solely for commercially available off-the-shelf items are exempt.

Who runs the CMMC program?

The Department of War Chief Information Officer owns CMMC policy. The Cyber AB authorizes C3PAOs, and ISACA, as the CAICO, certifies assessors. DCMA’s DIBCAC performs Level 3 assessments. Contractors post results and affirmations in the Supplier Performance Risk System (SPRS).

Where to go next

Work with RSI Security

RSI Security is a Cyber AB-authorized C3PAO that performs independent CMMC Level 2 assessments. Organizations still preparing can work with RSI Security on readiness through a separate advisory engagement. RSI Security does not assess any organization it has advised on CMMC.

Schedule a CMMC Level 2 assessment · Talk to an advisor about readiness