Who Does CMMC Apply To?
Cybersecurity Maturity Model Certification (CMMC) is required of any individual in the DOD supply chain, including contractors who interact exclusively with the Department of Defense and any and all subcontractors.
According to the DOD, the CMMC requirements will affect over 300,000 organizations. Fortunately, most businesses require only a Level 1 to Level 3 certification. The CMMC Accreditation Body (CMMC-AB) establishes a process to qualify private third-party assessment organizations (C3PAO) and assessors to determine CMMC levels.
The RFP will define the precise certification level a business needs to be granted a federal contract.
CMMC Compliance Definition
CMMC compliance refers to an organization's adherence to the cybersecurity requirements set by the DoD to protect Controlled Unclassified Information (CUI) within the defense industrial base (DIB). CMMC consolidates various cybersecurity standards, including NIST SP 800-171, into a unified framework with multiple maturity levels.
The latest version, CMMC 2.0, simplifies compliance into three levels:
- Level 1 (Foundational) – Basic safeguarding of Federal Contract Information (FCI), aligned with 17 practices from NIST 800-171.
- Level 2 (Advanced) – Protects CUI with 110 security controls from NIST 800-171.
- Level 3 (Expert) – Requires additional measures based on NIST 800-172.
Depending on contract requirements, organizations must self-assess or obtain third-party certification to bid on DoD contracts. CMMC ensures a standardized, risk-based approach to cybersecurity, enhancing supply chain security for federal defense projects.
When is CMMC Compliance Required?
CMMC is required for companies in the DoD supply chain that handle Controlled Unclassified Information (CUI). The CMMC ensures these entities meet specific cybersecurity standards to protect sensitive information. Under CMMC 2.0, different certification levels are required based on the type of information the organization handles, and some contracts require CMMC compliance as a condition for bidding.
Read more: Additional guidance on compliance for subcontractors.
Resources: