Terms / Certification
CMMC
The Cybersecurity Maturity Model Certification. It is the program that verifies a defense contractor meets the security requirements already in its contract.
Also called Cybersecurity Maturity Model Certification.
Official Source Material
The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor's compliance with applicable information security protections (see 32 CFR part 170).
Source: 48 CFR 252.204-7021(b), eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
CMMC adds verification, and it does not add requirements.
This is the single most useful thing to understand about the program. The 15 requirements at Level 1 come from FAR 52.204-21. The 110 at Level 2 come from NIST SP 800-171, which DFARS 252.204-7012 has required since 2017. CMMC writes down how the Government checks that you did it. If the program feels like a new obligation, the obligation was already there and nobody was checking.
The program lives in two places, and both matter to you.
32 CFR Part 170 describes the program: the levels, the assessments, the scoping, the affirmations. DFARS 252.204-7021 puts it into your contract and makes it enforceable. Read the rule to understand what is required and the clause to understand what you agreed to.
Your level is written into the contract, not chosen by you.
The contracting officer inserts one of four entries: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC). That entry decides whether you assess yourself or pay an assessment organization, and it decides how long the result lasts. Find it before you plan anything.
Nobody can waive this for you, and no one certifies you permanently.
Waivers belong to the Government, apply to a whole contract, and happen before solicitation. Your customer cannot grant one. A status also expires: one year at Level 1, three years at Level 2 and Level 3, with an affirmation every year in between. Treat it as a cycle rather than a project with an end.
What falls short
- Waiting for CMMC to appear in a solicitation before starting. The underlying requirements already apply, and once the requirement is in a solicitation your timeline is gone.
- A plan that ends at the assessment. The status must be maintained for the duration of the contract.
- Treating CMMC as an IT project. Scoping, contracts, and the annual affirmation are business decisions.
Edge cases
- You hold only Federal Contract Information. Level 1 applies, you assess yourself annually, and no plan of action is permitted.
- Your contract predates the clause. The safeguarding obligations still apply, and the status obligation arrives with the clause.
- You perform work exclusively for commercially available off-the-shelf items. Section 170.3 excludes contracts solely for those items.
Over-engineering
- A certification pursued before a contract requires one. Prepare, and let the contract set the level.
- A security programme built to a framework other than the one named in the rule. The requirements are specified, and a different framework becomes a mapping exercise.