The Cybersecurity Maturity Model Certification (CMMC) is a framework created by the Department of Defense (DoD) to safeguard sensitive unclassified information. It combines multiple cybersecurity standards that the military and its defense contractors rely on. First introduced in 2018, CMMC has undergone several updates, but its core purpose and structure remain consistent. Any company that handles DoD contracts or works with defense suppliers is required to achieve CMMC certification. If you’re new to CMMC, this guide will explain everything you need to understand about the framework and its certification process.
Understanding CMMC Certification Levels
The Cybersecurity Maturity Model Certification (CMMC) framework consists of multiple maturity levels, ranging from Basic Cybersecurity Hygiene to Advanced Practices. It was developed in response to several DoD security breaches and aims to strengthen the protection of sensitive unclassified information (CUI).
CMMC went into effect in January 2020, and companies handling CUI were expected to implement its requirements by June 2020. Any organization with a DoD contract, including contractors and suppliers, must comply with the cybersecurity standards outlined in NIST SP 800-171.
NIST, the National Institute of Standards and Technology, created Special Publication 800-171 to protect CUI from cyber threats, including hackers and foreign adversaries. In 2015, the DoD issued DFARS (Defense Federal Acquisition Regulation Supplement), which mandates that all private DoD contractors meet NIST 800-171 standards.
Before implementing these standards, organizations must first understand what qualifies as Controlled Unclassified Information (CUI).
What is Controlled Unclassified Information (CUI)?
Since the Cybersecurity Maturity Model Certification (CMMC) framework focuses on protecting CUI, it’s important to understand what it is. Controlled Unclassified Information (CUI) is sensitive data that is not federally classified but still requires protection because of its relevance to U.S. interests.
The National Archives and Records Administration (NARA), the agency responsible for creating CUI standards and overseeing compliance, defines it as:
“CUI is any potentially sensitive, unclassified data that requires controls to ensure proper safeguarding or dissemination. It must comply with applicable laws, regulations, and government-wide policies but is not classified under Executive Order 13526 or the Atomic Energy Act.”
Agencies or companies handling CUI must maintain a public registry of all categories and subcategories. Each piece of information must be labeled with the reason it is designated as CUI. For example:
Category: Financial
Subcategories:
- Budgets
- Bank secrecy
- Mergers
- Electronic monetary transfers
- Contractor registration
For companies that already track their sensitive data, defining and categorizing CUI is relatively straightforward. The more challenging part is implementing and complying with NIST SP 800-171 standards, a requirement for achieving CMMC certification.
NIST SP 800-171 Compliance for CMMC Certification
NIST SP 800-171 was developed after the Federal Information Security Management Act (FISMA) of 2003 to improve cybersecurity for Controlled Unclassified Information (CUI). Before its 2017 revision, different federal agencies had unique standards. Today, all agencies that share CUI with private contractors follow the same regulations.
These standards apply to any organization that stores, transmits, or processes CUI for the DoD, NASA, or GSA. To achieve compliance, networks and systems must meet strict security protocols. Companies that fail to comply risk losing government contracts. Full implementation can take up to eight months, though several steps can be implemented immediately.
There are 14 key security areas required for NIST SP 800-171 compliance:
- Controlled Access: Limit access to CUI to only necessary personnel.
- Training: Ensure employees understand and can implement security protocols.
- Audit and Identity: Document unauthorized access and identify violators.
- Manage Security Configurations: Maintain documented security protocols and network configurations.
- Identification Verification: Verify and document employee identities before granting CUI access.
- Incident Response: Establish protocols for responding to breaches and notifying affected parties.
- Maintenance: Implement scheduled maintenance protocols.
- Data Storage Protection: Secure hard and electronic copies of records.
- Access Protection: Restrict employee system access to essential personnel only.
- Employee Screening: Conduct risk assessments before granting CUI access.
- Risk Assessment: Regularly test employees and networks to identify security risks.
- Assess Security Protocols: Routinely evaluate the effectiveness of security measures.
- System and Data Protection: Safeguard information at all points of transmission and monitor for breaches.
- Information and System Integrity: Detect and correct security breaches within 30 days.
Once all 14 areas are implemented, organizations can achieve NIST SP 800-171 certification, which is required for CMMC certification.
Getting CMMC Certification
Achieving Cybersecurity Maturity Model Certification (CMMC) requires an independent audit by a third-party assessor, such as RSI Security. Both NIST SP 800-171 and CMMC compliance must be evaluated, but it’s important to note that NIST compliance does not automatically guarantee CMMC certification. Each framework has distinct requirements.
During a CMMC audit, companies are evaluated across five maturity levels:
- Level 1 – Basic Cyber Hygiene
- Level 2 – Intermediate Cyber Hygiene
- Level 3 – Good Cyber Hygiene
- Level 4 – Proactive
- Level 5 – Advanced / Progressive
The appropriate CMMC level depends on the sensitivity of the Controlled Unclassified Information (CUI) the organization handles. Higher-level CUI requires a higher CMMC level, and each level comes with specific maturity process expectations:
- Maturity Level 1: Organization performs adequate security protocols for Level 1.
- Maturity Level 2: Security protocols are documented and established.
- Maturity Level 3: Security protocols are regularly reviewed to ensure proper implementation.
- Maturity Level 4: Protocols are reviewed for effectiveness, and higher-level management practices are evaluated.
- Maturity Level 5: Cybersecurity protocols are fully implemented, shared across the organization, and thoroughly documented.
CMMC Certification Timeline for DoD Contractors:
- January 2020: Requirements for CMMC levels released, including training materials for auditors.
- February – May 2020: Auditor training begins.
- June – September 2020: Audits commence; contractors must identify their CMMC level before auditing.
- October 2020 and beyond: Contractors must be certified by an accredited assessor to bid on new contracts.
Before pursuing certification, contractors should complete a CMMC Readiness Assessment. This preliminary evaluation identifies potential gaps and prepares the organization for the official audit.
CMMC Readiness Assessment
A CMMC Readiness Assessment helps organizations identify which cybersecurity protocols need to be implemented or improved before an official CMMC certification audit. Its primary goal is to detect gaps in processes, system configurations, and security measures that do not meet CMMC standards.
Common issues a readiness assessment may uncover include:
- How employee access to information systems is controlled
- How managers and system administrators are trained
- How data records are stored and protected
- How security controls are implemented
- How incident response plans are developed and executed
After the assessment, companies can develop a remediation plan to address any cybersecurity gaps. This plan ensures all issues are resolved and appropriate protocols are implemented in time for the certification audit. For the initial CMMC audit, readiness assessments and remediation must have been completed by June 2020.
The tight timeline highlights one of the ways that DoD contractors are affected by CMMC requirements, emphasizing the importance of early preparation and thorough assessment.
How CMMC Affects Contractors
The Cybersecurity Maturity Model Certification (CMMC) significantly impacts DoD contractors and any organization that handles Controlled Unclassified Information (CUI). Implementing the required cybersecurity protocols can be costly, and the government’s relatively short compliance timeline adds additional pressure.
Contractors must also hire a third-party assessor to conduct the CMMC audit, as in-house assessments are no longer permitted. While these costs can affect a company’s bottom line, failing to meet compliance deadlines can be even more expensive, potentially resulting in lost contracts or business opportunities.
CMMC Non-Certification Penalties
Unlike other cybersecurity regulations, CMMC certification does not carry monetary fines. The federal government does not penalize companies financially for non-compliance, largely because there are over 300,000 DoD contractors, making it impractical to audit everyone within the compliance timeline.
However, the consequences of non-certification can be severe. Companies that fail to achieve CMMC compliance will automatically lose existing DoD contracts and be barred from bidding on new government contracts. For many contractors, government contracts represent a major source of revenue, so the financial and operational impact of non-compliance can be significant.
Conclusion: Preparing for CMMC Certification
By the end of 2020, all companies with DoD contracts were required to meet CMMC standards in addition to maintaining NIST SP 800-171 compliance. While NIST certification has been a long-standing requirement, CMMC introduced a key change: companies can no longer self-audit and must use a third-party assessor for certification.
Achieving compliance with both NIST and CMMC standards can be complex. Many contractors turn to experienced providers like RSI Security for guidance. Certified assessors can help organizations implement required protocols, perform readiness assessments, and conduct the official CMMC audit to ensure certification.
Download Our CMMC Checklist
