The Cybersecurity Maturity Model Certification (CMMC) is a framework created by the Department of Defense (DoD) to safeguard sensitive unclassified information. It combines multiple cybersecurity standards that the military and its defense contractors rely on. First introduced in 2018, CMMC has undergone several updates, but its core purpose and structure remain consistent. Any company that handles DoD contracts or works with defense suppliers is required to achieve CMMC certification. If you’re new to CMMC, this guide will explain everything you need to understand about the framework and its certification process.

If your organization currently works as a contractor with the Department of Defense (DoD), compliance is likely a critical component of your contract. Current Defense Federal Acquisition Register Supplement (DFARS) requirements include adherence to the National Institute of Standards and Technology (NIST) Special Publication 800-171 (SP 800-171). However, your next contract will likely require CMMC implementation.

CMMC-AB plays a central role in how organizations achieve compliance with the Cybersecurity Maturity Model Certification (CMMC), the Department of Defense’s framework for protecting Controlled Unclassified Information (CUI).

CMMC will be required for organizations that contract with the U.S. Department of Defense (DoD). While these contracts can be highly valuable, they require meeting strict cybersecurity standards. To achieve certification, organizations must be assessed by a qualified third-party assessor that is accredited by the CMMC Accreditation Body (CMMC-AB).

In this article, we explain who the CMMC-AB is, what it does, and how it fits into the broader CMMC ecosystem, including the other key stakeholders responsible for enforcing and maintaining CMMC requirements.