What is CMMC? A complete guide for defense contractors

What CMMC is

CMMC, the Cybersecurity Maturity Model Certification, is the Department of War's program for verifying that defense contractors actually meet the cybersecurity requirements written into their contracts. The requirements themselves are older than the program: the basic safeguarding clause at FAR 52.204-21 and the CUI clause at DFARS 252.204-7012, which points at NIST SP 800-171.

CMMC exists because self-attestation alone was not working. Reviews found that many contractors who claimed compliance had not implemented what they claimed. The program's answer was an assessment regime: self-assessment at Level 1, third-party assessment by a C3PAO at Level 2, and government assessment at Level 3. In July 2026 the Department suspended the third-party rollout pending a program review, so verification currently runs on documented self-assessments affirmed in SPRS, with the legal responsibility for accuracy resting on the contractor.

Who it reaches

If your organization holds DoD contracts, or supplies a company that does, you are inside the program's reach. That includes:

• Prime contractors, who contract directly with the Department.
• Subcontractors, who supply goods or services to primes and receive the clauses by flow-down.
• Supply chain vendors of any size that process, store or transmit CUI or FCI in support of a contract.

The three levels

CMMC 2.0 reduced the original five levels to three. Each builds on the one below it, and the level is set by the solicitation, not chosen by you.

Level 1: Foundational

For organizations that handle Federal Contract Information only.

• The 15 basic safeguarding requirements of FAR 52.204-21, assessed as 17 practices drawn from NIST SP 800-171.
• Annual self-assessment with an affirmation in SPRS. No third-party assessment.
• Basic hygiene: who may log in, passwords, malware protection, physical access.

Level 2: Advanced

For organizations that handle Controlled Unclassified Information. This is where most contractors land.

• All 110 security requirements of NIST SP 800-171 Revision 2, in 14 families.
• Assessed by a C3PAO under the Phase 2 rollout, which is suspended; self-assessment applies during the suspension, and voluntary C3PAO assessments continue.
• Triennial assessment with annual affirmations.

See the 110 requirements by domain, or read every one of them in plain language in our free guide.

Level 3: Expert

For programs judged to face advanced persistent threats.

• Everything in Level 2 plus selected requirements from NIST SP 800-172.
• Government-led assessment by DCMA DIBCAC. Level 2 certification is a prerequisite.

Which standard applies today

This is the question that costs money when it is answered wrong. NIST SP 800-171 Revision 2 is what a contract requires today. DFARS 252.204-7012 points at it, the CMMC rule at 32 CFR 170 points at it, and a standing DoD class deviation keeps contractors on Revision 2 even though NIST published Revision 3 in 2024. Publishing a revision does not change an obligation; a change to the deviation or an amendment to the rule would.

Two things are worth knowing about the road ahead. The Department has published its own values for Revision 3's organization-defined parameters, which is preparation for an eventual move, not adoption. And outside DoD, the proposed FAR CUI rule for civilian agencies points at Revision 3, so a contractor with both civilian and defense CUI work may one day carry two baselines. Our guide keeps the status and the differences current, requirement by requirement.

Terms you will meet

CUI

Controlled Unclassified Information. Information the government creates or possesses that law, regulation or policy says must be safeguarded: technical drawings, specifications, test results and the like. Whether something is CUI is the government's decision. Not sure what you are holding?

FCI

Federal Contract Information. Provided by or generated for the government under a contract, not intended for public release, and not CUI. Level 1 territory.

C3PAO

Certified Third Party Assessment Organization. The independent assessors authorized to conduct Level 2 certification assessments.

SSP

The system security plan. It describes your boundary, your environment and how each requirement is met. An assessment cannot proceed without one. Bedrock CMMC generates it from your control implementations, so it never drifts from what you actually do.

POA&M

Plan of action and milestones. The dated list of what is not yet met, who owns it and by when. The full guide.

SPRS score

Your score in the Supplier Performance Risk System, from 110 down to a floor of minus 203, reflecting which of the 110 requirements are met. Required for DoD contracts and visible to contracting officers.

How to get started

1. Find out which level your contracts set

   Read the clauses. FAR 52.204-21 alone points at Level 1. DFARS 252.204-7012 means CUI, and almost always Level 2. If the information itself is the puzzle, work it through.

2. Run a gap assessment

   Evaluate your environment against every requirement at your level, objective by objective. Bedrock CMMC shows met and not-met status across all 14 families and calculates the SPRS score as you go.

3. Close the gaps and write it down

   Implement what is missing, collect evidence, and build the system security plan and the POA&M. This is the work compliance software exists to accelerate.

4. Post an honest score and affirm it

   Submit your self-assessment score to SPRS and have a senior official affirm it. During the suspension this is the record contracts check, and it is a representation to the government.

5. Consider a voluntary assessment

   C3PAO assessments continue on a voluntary basis. Many primes value them, and a completed assessment is the strongest evidence behind your affirmation if the mandate returns in reformed shape.

Questions people ask