Cybersecurity Maturity Model Certification (CMMC) Program
CMMC is a tiered cybersecurity certification program administered by the U.S. Department of Defense (DoD). It requires defense contractors and subcontractors within the Defense Industrial Base (DIB) to implement and verify specific cybersecurity practices as a condition of contract award. The program was designed to replace reliance on contractor self-attestation with a verified assessment structure . Program Structure (CMMC 2.0): The program is structured into three levels, each tied to the sensitivity of the information handled: Level Information Handled Core Requirements Assessment Method Level 1 (Foundational) FCI only 15 basic safeguarding requirements (FAR 52.204-21) Annual self-assessment; results posted in SPRS Level 2 (Advanced) CUI 110 security requirements from NIST SP 800-171 Rev 2 Self-assessment (for some contracts) OR third-party assessment by a C3PAO (for most CUI contracts) Level 3 (Expert) CUI requiring higher protection against Advanced Persistent Threats (APTs) 110 NIST SP 800-171 controls + 24 selected controls from NIST SP 800-172 Government-led assessment by DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) Key Features: Assessment verification: Level 2 certification for most CUI contracts requires an assessment by an authorized C3PAO (CMMC Third-Party Assessment Organization). Level 3 requires a DIBCAC assessment . SPRS posting: Contractors must post their CMMC status (self-assessment scores or certification results) in the Supplier Performance Risk System (SPRS), which contracting officers verify before award . Annual affirmation: A senior company official must annually affirm continuous compliance in SPRS . Phased rollout: The original plan was a four-phase implementation beginning November 10, 2025, with full mandatory application by November 10, 2028 . Critical Recent Development — Phase 2 Suspension: According to the official DoD CIO website, on July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements, which had been scheduled for November 10, 2026. Phase I self-assessment requirements remain in place. The Department stated it will conduct a comprehensive review of CMMC aligned with Acquisition Transformation System directives, prioritizing speed to capability and lowering barriers for small businesses. During this period, DoW will enforce cybersecurity compliance with NIST 800-171 Rev 2 through self-assessments and select government-led assessments . This represents a significant policy shift from the original phased implementation timeline and should be verified against the latest official DoD guidance. Note on Prime Contractor Requirements: Separately from official DoD deadlines, many prime contractors have imposed their own CMMC certification deadlines on subcontractors as a supply chain risk management measure. These prime-driven deadlines are often earlier than the government's phased schedule and may require Level 2 C3PAO certification as a condition of continued subcontracting eligibility .
Document information
- Uploaded on
- October 18, 2026
- Number of pages
- 1
- Written in
- 2026/2027
- Type
- Exam (elaborations)
- Contains
- Questions & answers
