CMMC (Cybersecurity Maturity Model Certification) is a cybersecurity compliance framework developed by the U.S. Department of Defense (DoD) to protect sensitive information within the Defense Industrial Base (DIB).
The framework establishes standardized cybersecurity requirements for defense contractors and verifies that those requirements are implemented before organizations can receive certain Department of Defense contracts.
CMMC is designed to:
Rather than relying solely on organizations to self-attest to cybersecurity compliance, CMMC introduces certification levels and assessment requirements that confirm security controls are implemented and operating effectively.
CMMC was introduced to address cybersecurity weaknesses across the U.S. defense supply chain. The Defense Industrial Base (DIB) consists of hundreds of thousands of organizations that design, manufacture, and support military systems and technologies.
Because these organizations often store or process sensitive government data, weaknesses within contractor networks can create national security risks.
Historically, contractors were required to implement security controls defined in NIST SP 800-171, but compliance largely relied on self-attestation. Investigations later revealed that many organizations had not fully implemented the required safeguards.
CMMC was created to strengthen enforcement by requiring organizations to demonstrate cybersecurity maturity through certification and formal assessments.
Several factors contributed to the development of the CMMC framework.
CMMC is mandated by the U.S. Department of Defense and applies to contractors and subcontractors bidding on contracts involving Federal Contract Information or Controlled Unclassified Information.
Key enforcement characteristics include:
Organizations that cannot demonstrate the required certification level may be unable to bid on certain defense contracts.
The CMMC framework has evolved since its original release.
CMMC 1.0 (Original Model)
The initial version of the framework introduced five maturity levels intended to measure cybersecurity capabilities across contractors.
CMMC 2.0 (Current Model)
The updated version simplified the framework to three maturity levels, reducing redundancy while aligning more closely with existing federal cybersecurity standards.
CMMC 2.0 defines three certification levels that correspond to different types of sensitive information and threat exposure.
Level 1: Foundational
Level 1 applies to contractors that handle FCI.
Key characteristics include:
These requirements emphasize basic safeguards such as system access control and protection of federal contract data.
Level 2: Advanced
Level 2 applies to organizations that process or store CUI.
Key characteristics include:
Because many defense contractors handle CUI, Level 2 certification is expected to apply to a large portion of the DIB.
Level 3: Expert
Level 3 is intended for contractors working on high-priority national security programs.
This level builds on Level 2 requirements and introduces additional security controls derived from NIST SP 800-172, which focuses on defending CUI against advanced persistent threats.
Key characteristics include:
The original CMMC model defined five maturity levels:
CMMC 2.0 consolidated these levels into three tiers to simplify implementation and align more closely with existing cybersecurity standards.
CMMC was developed in response to several systemic cybersecurity challenges affecting defense contractors.
Key drivers included:
The framework aims to create a standardized certification system that verifies cybersecurity maturity across contractors supporting national defense programs.
The introduction of CMMC has several operational and governance implications for organizations within the defense supply chain.
Common impacts include:
Organizations pursuing certification frequently implement additional security controls such as:
Although CMMC is closely related to NIST SP 800-171, the two frameworks serve different roles.
NIST SP 800-171
CMMC
In simple terms:
NIST defines the required security controls, while CMMC verifies that contractors have implemented them before receiving certain Department of Defense contracts.
Defense Manufacturer
A manufacturing company producing specialized military components receives technical drawings containing Controlled Unclassified Information. Because the organization stores and processes CUI, it must achieve CMMC Level 2 certification and implement controls such as encryption, logging, access restrictions, and multi-factor authentication.
Managed Service Provider
An IT service provider supporting defense contractors may fall within the scope of CMMC if it manages infrastructure that stores or processes Federal Contract Information or Controlled Unclassified Information.
Software Development Contractor
A company developing software for high-priority defense programs may require Level 3 certification and be subject to government-led security assessments.
Organizations that may fall within the scope of CMMC include:
Any organization within the Defense Industrial Base that processes, stores, or transmits FCI or CUI may eventually require certification.
AI-powered DNS security isn’t just the future—it’s how you stay ahead today. Start your free trial of DNSFilter and see how proactive DNS protection makes all the difference.