Everything You Need to Know About CMMC
28 in-depth topics covering every aspect of CMMC 2.0 compliance — from foundational concepts to advanced assessment preparation, DFARS clauses, documentation requirements, and post-certification obligations.
28 topics · 6 categories · Updated June 2026
What Is CMMC?
The Cybersecurity Maturity Model Certification is the DoD's unified cybersecurity standard for defense contractors — replacing the self-attestation honor system with mandatory third-party verification.
Who Needs CMMC?
Any organization in the DoD supply chain that handles Federal Contract Information or Controlled Unclassified Information needs CMMC — including subcontractors at every tier.
When does CMMC roll out?
CMMC is rolling out in four phases from 2024 through 2028. Phase 2 (Level 2 C3PAO assessments) was suspended on July 13, 2026, pending a Department of War review — the underlying DFARS and NIST 800-171 obligations were not paused.
What Is Controlled Unclassified Information (CUI)?
CUI is information the government creates or possesses that requires safeguarding but is not classified. Understanding exactly what qualifies as CUI — and what doesn't — is the foundation of scoping your CMMC environment.
What changed from CMMC 1.0 to CMMC 2.0?
The 2021 overhaul collapsed five levels to three, eliminated 20 unique CMMC practices, reintroduced POA&Ms, and aligned the model directly with NIST standards. Here's what changed and why.
What is CMMC Level 1 (Foundational)?
17 basic safeguarding practices covering Federal Contract Information. Annual self-assessment with senior official affirmation, no third-party C3PAO required.
What is CMMC Level 2 (Advanced)?
110 practices aligned to all of NIST SP 800-171 Rev 2. Required for any contractor handling CUI. Most contracts require a C3PAO third-party assessment every three years.
What is CMMC Level 3 (Expert)?
The highest CMMC level, with 130+ practices adding NIST SP 800-172 requirements on top of Level 2. Reserved for the most sensitive DoD programs, assessed by the government (DCSA).
What are the 14 NIST SP 800-171 control domains?
CMMC Level 2's 110 controls are organized into 14 domains. Each domain covers a distinct area of cybersecurity — from access control to system integrity.
What changed between NIST SP 800-171 Rev 2 and Rev 3?
NIST published Rev 3 in May 2024, but CMMC still uses Rev 2 as of 2026. Here's what Rev 3 changes, when DoD will transition, and what contractors should do now.
What does DFARS 252.204-7012 require to safeguard CUI?
The foundational DFARS clause requiring CUI protection, 72-hour cyber incident reporting, and cloud provider security standards. Has been in DoD contracts since 2016.
What do DFARS 252.204-7019 and 7020 require for SPRS?
These two clauses require contractors to assess themselves against NIST SP 800-171, post the score to SPRS, and allow DoD to conduct higher-level assessments. Both have been in effect since November 2020.
What is DFARS 252.204-7021, the CMMC contract clause?
The CMMC clause itself — making certification a condition of contract award. Went into effect in June 2025. If this clause is in your solicitation, you must be CMMC-certified to win the work.
What CMMC requirements must primes flow down to subcontractors?
Under 32 CFR 170.23, primes must flow CMMC requirements to every subcontractor who touches FCI or CUI — and verify compliance before sharing sensitive data.
Will the FAR CUI rule reach civilian contractors too?
A proposed FAR clause would extend CUI protection requirements — and NIST SP 800-171 — to contractors working with civilian agencies like NASA, HHS, and the Department of State.
Self-Assessment vs. C3PAO Assessment: Which Do You Need?
Level 1 is always self-assessed. Most Level 2 contracts now require a C3PAO. Level 3 is government-led. Here's how to determine which applies to your contracts.
How a C3PAO Assessment Works: Step by Step
A Level 2 C3PAO assessment is a structured multi-week engagement with examine, interview, and test phases. Here's exactly what to expect from initial scoping through the certification decision.
How to Find and Vet a C3PAO
There are 100+ authorized C3PAOs as of 2026. Not all have equal experience. Here's how to find one, what to look for, and what questions to ask before signing a contract.
What is the difference between conditional and full CMMC certification?
A conditional certificate lets you win contracts while completing remaining remediation within 180 days. But not all controls are POA&M-eligible — some must be fully met before you can be certified.
What CMMC Assessors Actually Look For
Assessors use examine, interview, and test methods across all 110 controls. They're not just looking at documents — they want evidence, consistency, and proof that staff actually know the procedures.
What must a System Security Plan (SSP) contain?
The SSP is the master document of your CMMC program — describing your CUI boundary, every system in scope, and how each of the 110 controls is implemented. Assessors read it first.
How does a Plan of Action & Milestones (POA&M) work under CMMC?
The POA&M documents gaps that remain open after assessment and tracks their remediation. CMMC 2.0 allows POA&Ms for conditional certification, but limits which controls qualify.
How do you calculate and submit your SPRS score?
The Supplier Performance Risk System score is your self-assessed compliance number — ranging from -203 to 110. Here's how it's calculated, where to post it, and what a realistic score looks like.
What evidence do CMMC assessors need?
Assessors need evidence for every control they evaluate. Here's what types of evidence satisfy the examine, interview, and test methods — and how to organize it before your assessment.
How much should you budget for CMMC compliance?
DoD estimates CMMC Level 2 compliance costs $75K–$150K+, but real-world costs vary widely. Here's a breakdown of the major cost categories and what drives them up or down.
How long does CMMC preparation really take?
DoD estimates 12–18 months for typical contractors. In practice, most small businesses need 18–24 months from gap assessment to certified. Here's what happens in each phase.
Which common CMMC mistakes delay certification?
From underscoping your CUI boundary to inflating SPRS scores, these are the mistakes that most commonly derail CMMC programs — and how to avoid them.
What does maintaining CMMC compliance after certification involve?
Getting certified is not the finish line. Annual affirmations, triennial reassessments, continuous monitoring, and incident response readiness are all ongoing obligations.
Need help applying this to your organization?
CMMC Ready Now helps defense contractors navigate the path from gap assessment to certified. Start with a no-cost 30-minute conversation with Rick.