Executive Summary: What is it?
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a US Department of Defense (DoD) program that requires all contractors, subcontractors, and suppliers in the Defense Industrial Base (DIB) to achieve a verified cybersecurity posture before handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). CMMC is not a product certification; it is an organizational certification that validates a contractor's security practices against a tiered model built on NIST SP 800-171 (Level 2) and NIST SP 800-172 (Level 3). Phase 1 began on 10 November 2025, and each later phase begins one calendar year after the one before. Full implementation (Phase 4), with CMMC requirements in all applicable DoD solicitations and contracts, begins on 10 November 2028.
CFO / Business Impact: What does it cost/risk?
- Defense Contract Access: Where a DoD solicitation involving FCI or CUI includes the CMMC requirement (every applicable solicitation from 10 November 2028), the required CMMC status is a contractual prerequisite. Contractors without it are excluded from those bids regardless of technical capability.
- Supply Chain Flow-Down: Prime contractors must require every subcontractor, at all tiers, that processes, stores or transmits FCI or CUI for the contract to meet the CMMC level and assessment type set for its subcontract, and to flow the requirement down further.
- Assessment Cost: A Level 2 certification assessment is priced by the C3PAO (CMMC Third-Party Assessment Organization) that performs it. The cost grows with the assessment scope, which at Level 2 also takes in the assets that protect the CUI systems (below), and recurs with each assessment, every three years at Level 2. Self-assessments cost internal effort instead.
Technical Reality: How does it work?
- Three Levels: Level 1 (15 basic security requirements from FAR 52.204-21, annual self-assessment) covers FCI. Level 2 (110 requirements from NIST SP 800-171, a self-assessment or a C3PAO assessment every three years, as the contract sets) covers CUI. Level 3 (advanced practices from NIST SP 800-172, government-led assessment) covers the most sensitive DoD programs.
- Assessment Boundary: At Level 1 the scope is the systems that process, store or transmit FCI. At Level 2 it is the assets that process, store or transmit CUI, plus the assets that provide security functions to them (Security Protection Assets), those that can but are not meant to handle CUI (Contractor Risk Managed Assets), and those that can handle CUI but cannot be fully secured, such as IoT devices, operational technology and test equipment (Specialized Assets). Isolating CUI to a defined enclave (e.g., a self-hosted, air-gapped system) limits assessment scope and cost.
- Self-Hosted Advantage: Software deployed on contractor-controlled infrastructure (with no vendor cloud callbacks) keeps CUI within the contractor's security boundary, simplifying the CMMC assessment boundary. Vendor SaaS platforms that co-mingle data or require vendor access to CUI environments create boundary complications.
- SPRS Score: Level 2 self-assessments require contractors to upload a score to the DoD Supplier Performance Risk System (SPRS). A score below 110 gives only a Conditional status: the score must reach at least 88 (80 percent of 110); only certain 1-point requirements, plus requirement 3.13.11 where encryption is used but not FIPS-validated, may sit on the Plan of Action & Milestones (POA&M); and the POA&M must be closed within 180 days.
What the Label Means in a Solution Profile
CMMC certifies a defense contractor's own systems, not software or cloud services, so no solution profile carries a CMMC label.
- Self-Hosted line: No self-hosted line carries CMMC. Validated encryption a tool contributes appears under the FIPS 140-3 label.
- Managed service line: No managed service line carries CMMC. For cloud services that handle controlled unclassified information, the rule asks for FedRAMP Moderate or equivalent, shown under the FedRAMP label.