CMMC
The DoD's Cybersecurity Maturity Model Certification, mandatory across the defense supply chain.
CMMC 2.0 has three levels. Level 1 covers Federal Contract Information (FCI). Level 2 covers Controlled Unclassified Information (CUI) and maps to NIST SP 800-171's 110 controls. Level 3 adds Enhanced controls from NIST 800-172.
Most DoD subcontractors handling CUI need Level 2, which usually requires third-party assessment by a C3PAO. Self-attestation is allowed for Level 1 and a limited subset of Level 2.
The CMMC final rule phases in through 2026; DoD contracts progressively add certification requirements, and primes are flowing them down early.
Start with the contract and information boundary
Identify the actual solicitation or contract requirement before choosing an assessment path. Determine which systems receive, store, process, or transmit the covered information, including connected providers. A company’s industry label alone does not determine the required level or the systems that need to be assessed.
Prepare evidence, not just answers
For each applicable requirement, identify an owner, the implemented practice, and evidence showing it operates within the assessment boundary. Policies, configuration records, access reviews, and interviews may tell different parts of that story. A readiness checklist is useful for locating gaps, but a checked box is not an assessor’s determination.
Avoid confusing readiness with certification
A short self-assessment cannot issue a CMMC status or replace the applicable assessment and affirmation process. Check the current official CMMC guidance and the specific contract rather than relying on a general phase-in summary. Any remediation plan must also satisfy the rules for the assessment path you actually need.
Related terms
NIST 800-171
The 110-control baseline for protecting Controlled Unclassified Information (CUI).
CUI
Controlled Unclassified Information — unclassified but protected government data.
SPRS
The DoD's Supplier Performance Risk System — where your NIST 800-171 score lives.
POA&M
Plan of Action & Milestones — the roadmap for closing security control gaps.
See how Scarlet Risk covers CMMC.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo