If your company sells to the US Department of Defense — or to anyone who does — the Cybersecurity Maturity Model Certification decides whether you can keep bidding. CMMC is the DoD's way of verifying that contractors actually protect the sensitive information flowing through their systems, instead of just promising to.
Who needs CMMC
Any organization in the defense supply chain that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) will see a CMMC level written into its contracts. That includes subcontractors several tiers down from the prime — machine shops, software vendors, logistics providers. If CUI touches your network, the requirement follows it.
The three levels
- Level 1 (Foundational): 15 basic safeguarding practices for FCI, verified by an annual self-assessment.
- Level 2 (Advanced): the 110 security requirements of NIST SP 800-171 for CUI. Most contracts require a third-party assessment by a C3PAO; some allow self-assessment.
- Level 3 (Expert): adds requirements from NIST SP 800-172 for the most sensitive programs, assessed by the government itself.
The overwhelming majority of contractors land at Level 2 — which means implementing NIST 800-171 properly, not approximately.
What an assessment actually checks
Assessors verify each practice against evidence: your System Security Plan, policies, configurations, screenshots and logs. Practices are scored, and unimplemented ones drag your score down until they're closed. A Plan of Action & Milestones buys limited time for a small set of items, but the days of paper-only compliance are over.
How to get there without losing a year
- Scope first: identify exactly where CUI lives and shrink that boundary before you harden it.
- Run a gap assessment against all 110 requirements and score yourself honestly.
- Remediate by risk, not by convenience — access control, MFA and logging gaps first.
- Build the SSP and evidence as you go; assessors read documents before they read configurations.
- Rehearse the assessment with your team so the real one holds no surprises.
Done in that order, most organizations can reach a defensible Level 2 posture in months. Done in reverse, the same work stretches across audit cycles and stalled contract awards.
