If your company works on Department of Defense contracts — or wants to — CMMC 2.0 is not optional. It is a condition of doing business with DoD, and it is being enforced now.
This guide explains what CMMC 2.0 actually requires, who must comply, how the three levels differ, what the 14 NIST domains cover, and what you need to do to get ready before it costs you a contract.
What Is CMMC 2.0?
The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's program to verify that defense contractors adequately protect sensitive government information.
The original CMMC framework had five maturity levels. DoD streamlined it to three levels in version 2.0, released in November 2021, with the final rule taking effect in December 2024. The goal is the same: ensure that companies in the defense supply chain — from large prime contractors down to small subcontractors — have the cybersecurity practices in place to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
If you handle either type of data and you want to bid on DoD contracts, you need to understand where you stand and what certification you will need.
Who Must Comply?
CMMC applies to all DoD contractors and subcontractors who handle FCI or CUI. The compliance obligation flows down the supply chain. If a prime contractor is required to hold CMMC certification, they must flow that requirement down to their subcontractors.
In practical terms, this means:
- You must comply if you have a DoD contract that involves FCI or CUI
- You must comply if you are a subcontractor on a DoD program that involves FCI or CUI, even if you are not the prime
- You may need to comply if you are pursuing future DoD contract opportunities where CMMC requirements will appear in the solicitation
Companies that only sell commercial off-the-shelf (COTS) products and never touch FCI or CUI are generally exempt. Everyone else should assume they are in scope.
The Three CMMC Levels Explained
Level 1: Foundational
Level 1 applies to companies that handle FCI but not CUI. It covers 17 basic cybersecurity practices drawn from FAR clause 52.204-21.
Examples include: using antivirus software, creating regular backups, limiting who can access company systems, and using strong passwords. These are baseline practices that most companies already have in place.
Assessment requirement: Annual self-assessment by company leadership. No third-party auditor required.
Level 2: Advanced
Level 2 applies to the majority of DoD contractors that handle CUI. It aligns with all 110 security requirements in NIST SP 800-171, organized across 14 control families.
This is where most companies run into gaps. Many DoD contractors have been self-attesting NIST 800-171 compliance for years without ever conducting a rigorous assessment. Level 2 closes that gap.
Assessment requirement: Depends on the contract. Non-prioritized acquisitions allow annual self-assessment. Prioritized acquisitions — those involving more sensitive CUI — require a third-party assessment by a C3PAO (CMMC Third Party Assessment Organization).
Level 3: Expert
Level 3 applies to the most sensitive DoD programs. It builds on Level 2 by adding more than 24 additional requirements drawn from NIST SP 800-172.
Very few companies will need Level 3. It is reserved for contractors supporting the highest-priority DoD programs.
Assessment requirement: Government-led assessment. DoD's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) conducts the evaluation.
The 14 NIST 800-171 Domains
CMMC Level 2 maps directly to NIST SP 800-171, which organizes its 110 requirements across 14 control families (called domains). Here is what each domain covers and why it matters:
1. Access Control (AC) — 22 requirements
Limit system access to authorized users and processes. Control who can access what, enforce least privilege, and separate duties to reduce insider risk.
2. Awareness and Training (AT) — 3 requirements
Ensure personnel understand cybersecurity risks and their responsibilities. Users and managers need role-specific security training.
3. Audit and Accountability (AU) — 9 requirements
Create and protect audit logs. Track user activity, retain logs for investigation, and review audit data for signs of unauthorized access.
4. Configuration Management (CM) — 9 requirements
Establish and maintain secure baseline configurations for all systems. Control changes to hardware, software, and firmware. Restrict use of unauthorized software.
5. Identification and Authentication (IA) — 11 requirements
Verify the identities of users and devices before granting access. Enforce multi-factor authentication for privileged accounts and remote access.
6. Incident Response (IR) — 3 requirements
Develop and test an incident response capability. Establish procedures to detect, respond to, and recover from cybersecurity incidents. Report incidents to DoD.
7. Maintenance (MA) — 6 requirements
Perform maintenance on organizational systems using only approved tools and by authorized personnel. Sanitize equipment before removal for off-site maintenance.
8. Media Protection (MP) — 9 requirements
Protect system media containing CUI, both paper and digital. Sanitize or destroy media before disposal. Control access to media containing sensitive information.
9. Personnel Security (PS) — 2 requirements
Screen personnel before granting access to systems. Protect CUI during and after personnel actions such as transfers and terminations.
10. Physical Protection (PE) — 6 requirements
Limit physical access to systems and the facilities where they reside. Monitor and log physical access. Protect and monitor the physical environment of systems containing CUI.
11. Risk Assessment (RA) — 3 requirements
Periodically assess operational risk to your organization. Identify vulnerabilities in systems, remediate them based on risk, and keep your risk assessments current.
12. Security Assessment (CA) — 4 requirements
Periodically assess your security controls to confirm they are working as intended. Develop and implement plans to correct deficiencies. Monitor controls on an ongoing basis.
13. System and Communications Protection (SC) — 16 requirements
Monitor and control communications at system boundaries. Employ encryption for CUI in transit and at rest. Architect systems to limit exposure of sensitive data.
14. System and Information Integrity (SI) — 7 requirements
Identify and correct system flaws in a timely manner. Protect systems from malicious code. Monitor systems to detect attacks and unauthorized use.
Together, these 14 domains paint a complete picture of what a mature cybersecurity program looks like. Most companies working toward CMMC Level 2 have addressed some of these areas but have gaps in others — particularly Audit and Accountability, Incident Response, and Risk Assessment.
The CMMC Enforcement Timeline
Phase 1: December 2024 Onward
CMMC requirements began appearing in new DoD contracts and solicitations starting in December 2024, when the final CMMC rule became effective. Contracts issued after this date may include CMMC requirements depending on the sensitivity of the information involved.
During Phase 1, DoD is primarily applying CMMC requirements to new contracts rather than retroactively modifying existing ones. However, contractors bidding on new work need to be ready.
Phase 2: Expanded Rollout
Phase 2 expands CMMC requirements to a broader set of DoD acquisitions, including more types of contracts and solicitations that previously did not include cybersecurity certification requirements.
DoD has stated its intention to include CMMC requirements in virtually all contracts involving CUI over the course of the phased implementation. If you are planning to compete for DoD work over the next one to three years, building your CMMC posture now is not optional — it is competitive positioning.
The practical implication: If you wait until a specific contract requires CMMC, you will likely not have enough time to achieve certification before the proposal deadline. Companies that are pursuing DoD contracts need to start their assessment and remediation work well in advance.
How to Prepare: A Practical Approach
Step 1: Determine Your Level
Start by identifying whether you handle FCI only (Level 1) or CUI (Level 2). Review your current DoD contracts and subcontracts. Look for references to CUI, DFARS clause 252.204-7012, and any specific data handling requirements. If you are uncertain, err toward Level 2.
Step 2: Conduct a Gap Assessment
Compare your current security practices against the requirements for your target level. For Level 2, this means assessing all 110 NIST 800-171 requirements across the 14 domains.
A thorough gap assessment will identify:
- Requirements you already satisfy
- Requirements where you partially satisfy the intent
- Requirements where you have no controls in place
Step 3: Create a System Security Plan
A System Security Plan (SSP) documents how your organization implements each NIST 800-171 requirement. It describes your system boundaries, the data you handle, and the controls you have in place.
The SSP is not just a compliance artifact — it is your evidence file. Third-party assessors will evaluate your SSP as part of a C3PAO assessment. Companies without a current, accurate SSP will fail their assessment.
Step 4: Build a Plan of Action and Milestones
For requirements you have not yet satisfied, document your remediation plan in a Plan of Action and Milestones (POA&M). The POA&M shows assessors that you have identified your gaps and have a credible, time-bound plan to close them.
A POA&M with realistic milestones is acceptable during certain phases of CMMC implementation. Unaddressed gaps with no remediation plan are not.
Step 5: Remediate and Document
Work through your POA&M systematically. Prioritize high-risk gaps — particularly those in Access Control, Identification and Authentication, and System and Communications Protection — as these tend to be the most scrutinized during assessments.
Document everything. Assessors need evidence that controls exist and are operating, not just your word that they do.
Step 6: Get Assessed
For Level 1, conduct your annual self-assessment and have a senior official affirm the results in the Supplier Performance Risk System (SPRS).
For Level 2 contracts requiring a C3PAO assessment, engage a certified assessor. The C3PAO will review your SSP, interview your personnel, and test your controls. Build time into your schedule — C3PAO assessments typically take weeks to schedule and complete.
CMMC vs NIST 800-171: What Is the Difference?
NIST 800-171 is the standard. CMMC Level 2 is the certification that verifies you meet that standard.
Before CMMC, contractors self-attested compliance with NIST 800-171 through their SPRS score. DoD had no mechanism to verify whether those self-attestations were accurate. Research consistently showed that many contractors were claiming compliance they had not actually achieved.
CMMC adds the verification layer. For Level 2 prioritized contracts, a C3PAO must independently confirm that your practices match your SSP and that your SSP covers all 110 requirements.
If you have been maintaining NIST 800-171 compliance in good faith, CMMC Level 2 will confirm that. If you have been self-attesting without rigorous internal assessment, the gap between where you say you are and where you actually are is likely significant.
How CMMC Connects to Your GSA Schedule
Many companies pursuing DoD work also hold or are pursuing a GSA Schedule contract. These two programs are not mutually exclusive — in fact, they are often complementary.
A GSA Schedule gives you the vehicle to sell to federal agencies under streamlined acquisition rules. CMMC certification tells DoD agencies that your cybersecurity posture meets their requirements. Together, they make you a more competitive supplier across the federal market.
For DoD contractors using their GSA Schedule to respond to Defense agency task orders, CMMC compliance may be a contractual requirement embedded in individual task orders. Being CMMC-ready before a task order arrives is how you stay competitive.
Take the CMMC Readiness Assessment
Not sure where your organization stands on CMMC 2.0 readiness? Our CMMC Readiness Assessment walks you through the key domains and requirements to give you a clear picture of your current posture and where to focus your preparation efforts.
It takes about 10 minutes and produces a domain-by-domain readiness profile you can use to prioritize your remediation work.
Frequently Asked Questions
What is CMMC 2.0?
CMMC 2.0 is the Department of Defense's cybersecurity certification framework for defense contractors. It has three levels — Foundational, Advanced, and Expert — based on the sensitivity of the information a contractor handles.
Who must comply with CMMC?
All DoD contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Compliance flows down the supply chain from prime contractors to subs.
What is the difference between CMMC Level 1 and Level 2?
Level 1 covers 17 basic practices for companies handling FCI and requires annual self-assessment. Level 2 covers all 110 NIST 800-171 requirements for companies handling CUI and may require third-party assessment by a C3PAO.
When did CMMC enforcement start?
Phase 1 enforcement began in December 2024 when the final CMMC rule became effective. New DoD contracts are beginning to include CMMC requirements, with broader rollout continuing through Phase 2.
What is NIST 800-171?
NIST SP 800-171 defines 110 security requirements across 14 control families for protecting CUI in non-federal information systems. CMMC Level 2 directly maps to all 110 of these requirements.
Do I need a C3PAO assessment?
It depends on your level and the specific contract. Level 1 allows self-assessment. Level 2 requires either self-assessment or C3PAO assessment depending on whether the acquisition is prioritized. Level 3 requires government assessment.
Next Steps
CMMC compliance is not something you can achieve overnight. Companies that wait until a specific contract requirement forces their hand will find themselves scrambling — and likely uncompetitive on the opportunities that matter most.
Start with an honest assessment of where you stand. Take our free CMMC Readiness Assessment to identify your gaps across all 14 NIST domains. If you want to discuss your specific situation and develop a remediation roadmap, contact us for a free consultation.