Compliance Guide - CMMC (Cybersecurity Maturity Model Certification)¶

Overview¶

CMMC is the US Department of Defense (DoD) program that verifies whether defense contractors actually protect the government information they handle. It applies across the Defense Industrial Base: prime contractors and their subcontractors at every tier, from aerospace giants to 20-person machine shops. CMMC does not invent new security controls. It checks that contractors implement requirements they were already bound to by contract (FAR 52.204-21 and DFARS 252.204-7012), which self-attestation alone had failed to enforce.

The program has two rules:

CMMC is being phased into contracts over four years (see below). As of this page's date, Phase 1 is in effect and Phase 2 starts on 10 November 2026.

The key idea: the contract decides the level. A solicitation states the CMMC level and assessment type required, and the contractor must hold that status in the DoD's Supplier Performance Risk System (SPRS) at the time of award for the information systems that will process, store or transmit the contract's information.

Two kinds of information¶

Classified information is out of CMMC's scope; it has its own regime.

CMMC at a glance¶

flowchart LR
  SOL[Solicitation states<br/>level and assessment type]
  SCOPE[Scope the assessment:<br/>where FCI or CUI lives]
  IMPL[Implement FAR 52.204-21,<br/>NIST SP 800-171 R2,<br/>or 800-172 subset]
  ASSESS[Assessment:<br/>self, C3PAO or DIBCAC]
  SPRS[Results and affirmation<br/>entered in SPRS]
  AWARD[Eligible for award]
  AFF[Annual affirmation;<br/>reassess every 3 years<br/>for Levels 2 and 3]

  SOL --> SCOPE --> IMPL --> ASSESS --> SPRS --> AWARD --> AFF
  AFF -. lapses if not affirmed .-> SPRS

The CMMC path: the contract sets the level, you scope and implement the requirements, pass the right assessment, record it in SPRS with an affirmation, and keep affirming every year.

The three levels¶

An affirmation is a statement by a senior official of the company that it has met and will maintain the requirements. Affirmations are made in SPRS. If an annual affirmation is missed, the CMMC status lapses. False affirmations carry legal risk under the False Claims Act, which is why the affirming official should see real evidence before signing.

Why Rev. 2 and not Rev. 3? NIST published SP 800-171 Revision 3 in May 2024, but the CMMC rule incorporates Revision 2 by reference, and DoD has kept DFARS 252.204-7012 on Revision 2 for now. Build to Rev. 2 for CMMC and track DoD announcements about moving to Rev. 3.

Scoring and POA&Ms¶

Level 2 uses the DoD Assessment Methodology scoring: you start at 110 and subtract 5, 3 or 1 point for each requirement not met, depending on how much it matters. Many important requirements (for example MFA and FIPS-validated encryption of CUI) are worth more than one point, and two (MFA and FIPS-validated cryptography) can receive partial credit in defined cases.

You can receive a Conditional status and be eligible for award with some requirements not met, if:

• your score is at least 80% of the maximum (88 of 110 for Level 2);
• the unmet requirements are ones the rule allows on a POA&M (in general, one-point requirements; the highest-weighted requirements, and some specific ones, cannot be deferred);
• every POA&M item is closed within 180 days, verified by a POA&M closeout assessment.

If the closeout does not confirm all requirements are met within 180 days, the Conditional status expires. Operational plans of action for temporary deficiencies are a separate concept from the assessment POA&M.

Phased rollout¶

Each phase starts one calendar year after the previous one, counted from the 48 CFR rule's effective date. C3PAO assessment capacity is limited, so organisations expecting Level 2 (C3PAO) contracts should book assessments well before they need the status.

Scoping: the decision that drives cost¶

Most of the effort and cost of CMMC depends on how much of your environment touches CUI. The rule defines asset categories for Level 2:

A common strategy is an enclave: a separate, tightly controlled environment (often a dedicated cloud tenant) where all CUI work happens, so the rest of the company is out of scope. The trade-off is that people must actually do CUI work only inside it.

Cloud and external service providers: under DFARS 252.204-7012, a cloud service storing, processing or transmitting CUI must meet the FedRAMP Moderate baseline or equivalent, plus the clause's incident reporting and forensics requirements. Managed service providers that handle security functions are in scope as security protection assets. See the FedRAMP guide.

Incident reporting, which sits in DFARS 252.204-7012 rather than in CMMC itself: report cyber incidents affecting covered defense information to DoD within 72 hours of discovery, preserve images for 90 days, and submit malware samples.

Cloud Provider CMMC Support¶

Organisations handling CUI usually use the providers' US government environments, which carry FedRAMP High or Moderate authorisations and support ITAR and DoD requirements. Commercial regions are generally not the right home for CUI.

AWS¶

Azure¶

Google Cloud¶

Check each provider's current list of in-scope services before relying on one for CUI; not every service is available or authorised in the government environments.

CMMC vs other frameworks¶

Preparation Checklist¶

Scope and plan¶

• Identify every contract and where FCI and CUI enter, live and leave the company (data flow diagrams help; see Threat modeling explained)
• Decide the boundary: enterprise-wide or an enclave
• Categorise assets (CUI, security protection, contractor risk managed, specialized, out of scope)
• Write the System Security Plan (SSP) describing how each requirement is implemented
• Confirm cloud and managed service providers meet FedRAMP Moderate (or equivalent) where they handle CUI

Implement¶

• Work through all 110 requirements; prioritise the 5-point and 3-point ones that cannot go on a POA&M
• MFA for privileged access and network access to CUI systems
• FIPS-validated cryptography protecting CUI at rest and in transit
• Centralised audit logging with review and retention
• Incident response capability that can meet the 72-hour DoD reporting duty
• Flow requirements down to subcontractors handling FCI or CUI

Assess¶

• Run a mock assessment against NIST SP 800-171A objectives
• Enter the self-assessment score in SPRS, or book a C3PAO through the Cyber AB marketplace
• Senior official affirmation in SPRS; calendar the annual re-affirmation

Evidence Collection¶

Common gaps¶

• Scope far bigger than necessary because CUI is spread across email, file shares and laptops.
• Encryption in place but not FIPS-validated.
• SSP written to the standard's wording rather than describing how the company really works.
• Assessment objectives (800-171A has several per requirement) not all evidenced.
• Subcontractors never told which information is CUI.
• Affirming officials signing without seeing evidence.

Certification Exam Relevance¶

CMMC knowledge is relevant for: - ISC2 CISSP and CCSP - regulatory compliance and supply chain requirements - ISACA CISA - assessing controls against a framework and working with assessors - CompTIA Security+ - regulatory frameworks and attestation concepts - Microsoft SC-100 - regulatory compliance in a security strategy

The Cyber AB also runs CMMC-specific credentials (Certified CMMC Professional and Certified CMMC Assessor) for people who work on assessments.

Documentation Links¶

📖 DoD CIO: Cybersecurity Maturity Model Certification - the official program site, documents and guidance

📖 32 CFR Part 170: CMMC Program final rule (Federal Register) - levels, assessments, scoring and phase-in

📖 48 CFR CMMC acquisition rule (Federal Register) - the DFARS clauses that make CMMC a condition of award

📖 NIST SP 800-171 Rev. 2 - the 110 requirements Level 2 assesses

📖 NIST SP 800-172 - the enhanced requirements Level 3 draws on

📖 The Cyber AB - the accreditation body for C3PAOs and assessors, and the marketplace to find them