For years, many Department of Defense contractors have been required to protect sensitive information under DFARS clauses and NIST security standards. The Cybersecurity Maturity Model Certification program, known as CMMC, adds a layer of verification. It is designed to confirm that contractors have actually implemented required cybersecurity practices before they receive certain contracts.
CMMC has evolved through several stages and is being phased into DoD contracts over time. Details and timelines can change, so rely on official DoD CMMC resources and the specific requirements in each solicitation. This article offers general background only.
Why CMMC exists
The defense industrial base includes a large number of companies, from major primes to small specialty suppliers. Adversaries have targeted this supply chain to obtain sensitive technical and program information. Earlier rules relied heavily on contractors’ self-attestation of compliance. CMMC was developed to provide greater assurance through assessments, while scaling requirements to the type of information a contractor handles.
The levels in general terms
The current version of the program uses three levels:
- Level 1 applies to contractors that handle federal contract information, which is information not intended for public release that is provided by or generated for the government under a contract. It involves basic safeguarding practices and annual self-assessment.
- Level 2 applies to many contractors that handle controlled unclassified information. It aligns with the security requirements in NIST SP 800-171. Depending on the contract, assessments may be self-assessments or performed by an authorized third-party assessment organization.
- Level 3 applies to a smaller set of contractors handling CUI associated with higher-priority programs. It adds requirements drawn from additional NIST guidance, with assessments conducted by the government.
Solicitations are expected to specify the required CMMC level, and contractors generally need the appropriate status before award, with affirmations of continued compliance.
What it means for subcontractors
CMMC requirements generally flow down to subcontractors at the level appropriate to the information they handle. A small supplier may need Level 1 even if the prime needs Level 2. If you work in the defense supply chain, ask your primes what information you will receive and what level they expect you to hold. Primes increasingly ask about cybersecurity readiness when choosing partners.
How to prepare
- Identify the types of information you handle: federal contract information, CUI or neither.
- Review the DFARS cybersecurity clauses in your current contracts.
- If you handle CUI, conduct an honest assessment against NIST SP 800-171 and document a system security plan.
- Consider limiting where sensitive information is stored to reduce scope.
- Plan budget and time for remediation and, if needed, a third-party assessment.
Be cautious of vendors promising guaranteed certification or shortcuts. Authorized assessors and consultants are listed through the official CMMC ecosystem. Starting early gives you time to address gaps without the pressure of a pending contract. For a small firm, readiness can become a genuine advantage when primes are choosing partners.