Executive Summary: What is it?
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a US Department of Defense (DoD) program that requires all contractors, subcontractors, and suppliers in the Defense Industrial Base (DIB) to achieve a verified cybersecurity posture before handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). CMMC is not a product certification; it is an organizational certification that validates a contractor's security practices against a tiered model built on NIST SP 800-171 (Level 2) and NIST SP 800-172 (Level 3). Phase 1 began on 10 November 2025, and each later phase begins one calendar year after the one before. Full implementation (Phase 4), with CMMC requirements in all applicable DoD solicitations and contracts, begins on 10 November 2028.
CFO / Business Impact: What does it cost/risk?
- Defense Contract Access: Where a DoD solicitation involving FCI or CUI includes the CMMC requirement (every applicable solicitation from 10 November 2028), the required CMMC status is a contractual prerequisite. Contractors without it are excluded from those bids regardless of technical capability.
- Supply Chain Flow-Down: Prime contractors must flow CMMC requirements down to all subcontractors and suppliers that touch covered information. A single non-certified vendor in the supply chain creates contract risk for the prime.
- Assessment Cost: Level 2 assessments by a C3PAO (CMMC Third-Party Assessment Organization) typically run $50,000–$250,000 depending on organizational scope and the number of systems in the assessment boundary.
Technical Reality: How does it work?
- Three Levels: Level 1 (15 basic security requirements from FAR 52.204-21, annual self-assessment) covers FCI. Level 2 (110 requirements from NIST SP 800-171, a self-assessment or a C3PAO assessment every three years, as the contract sets) covers CUI. Level 3 (advanced practices from NIST SP 800-172, government-led assessment) covers the most sensitive DoD programs.
- Assessment Boundary: Only systems that process, store, or transmit FCI/CUI fall within scope. Isolating CUI to a defined enclave (e.g., a self-hosted, air-gapped system) limits assessment scope and cost.
- Self-Hosted Advantage: Software deployed on contractor-controlled infrastructure (with no vendor cloud callbacks) keeps CUI within the contractor's security boundary, simplifying the CMMC assessment boundary. Vendor SaaS platforms that co-mingle data or require vendor access to CUI environments create boundary complications.
- SPRS Score: Level 2 self-assessments require contractors to upload a score to the DoD Supplier Performance Risk System (SPRS). A score below 110 gives only a Conditional status: the score must reach at least 88 (80 percent of 110); only certain 1-point requirements, plus requirement 3.13.11 where encryption is used but not FIPS-validated, may sit on the Plan of Action & Milestones (POA&M); and the POA&M must be closed within 180 days.
What the Label Means in a Solution Profile
CMMC certifies a defense contractor's own systems, not software or cloud services, so no solution profile carries a CMMC label.
- Self-Hosted line: No self-hosted line carries CMMC. Validated encryption a tool contributes appears under the FIPS 140-3 label.
- Managed service line: No managed service line carries CMMC. For cloud services that handle controlled unclassified information, the rule asks for FedRAMP Moderate or equivalent, shown under the FedRAMP label.