Cybersecurity Maturity Model Certification

DoD Cybersecurity Maturity Model Certification 2.0. Phase 1 (self-assessments in contracts) began 10 November 2025. Phase 2 third-party certification, due 10 November 2026, was suspended on 13 July 2026 pending a CMMC Reform Task Force review.

JurisdictionUnited States
CategoryGovernment & Defense
StatusPhased
Effective date
Latest development

Analysis

Key Requirements

The Cybersecurity Maturity Model Certification (CMMC) framework consists of three main levels, each with specific requirements:

  • Level 1 (Foundational): Encompasses the basic safeguarding requirements for Federal Contract Information (FCI) specified in FAR Clause 52.204-21. Organizations must implement 17 practices to achieve this level[1].
  • Level 3 (Expert): Will be based on a subset of NIST SP 800-172 requirements. Detailed information for this level will be released at a later date[1].

Key requirements across all levels include:

  • Maintaining a current CMMC certificate (not older than 3 years) at the required level for the duration of the contract[2].
  • Implementing practices across 14 capability domains, including Access Control, Incident Response, and Risk Assessment[1].
  • Ensuring subcontractors also have appropriate CMMC certification for the information being shared[2].

Compliance Challenges

Organizations face several challenges in achieving CMMC compliance:

  • Scope determination: Accurately identifying which parts of the organization handle FCI or Controlled Unclassified Information (CUI) can be complex, especially for large enterprises[3].
  • Resource allocation: Implementing required security practices and preparing for certification can be resource-intensive, particularly for smaller contractors[4].
  • Supply chain management: Ensuring all subcontractors meet appropriate CMMC levels adds complexity to supply chain management[5].
  • Documentation and evidence: Preparing comprehensive documentation to demonstrate compliance during assessments can be time-consuming and challenging[6].

Real-world examples of these challenges can be found in case studies from the CMMC Accreditation Body.

Implementation Best Practices

To implement CMMC effectively:

  1. Conduct a gap analysis: Assess your current cybersecurity posture against CMMC requirements to identify areas needing improvement[7].
  1. Develop a System Security Plan (SSP): Create a comprehensive SSP detailing your organization's approach to meeting CMMC requirements[8].
  1. Implement required practices: Systematically implement the practices required for your target CMMC level, using the CMMC Model Overview as a guide.
  1. Conduct regular internal audits: Perform ongoing assessments to ensure continued compliance and identify areas for improvement[9].
  1. Prepare for assessment: Engage with a CMMC Third Party Assessment Organization (C3PAO) for official certification.

Useful tools and resources include:

Recent Updates

The most significant recent update to CMMC was the transition from version 1.0 to 2.0:

  • Streamlined model: Reduced from five levels to three, simplifying the framework[10].
  • Alignment with existing standards: Stronger emphasis on aligning with NIST standards[10].
  • Self-assessment option: Introduced for Level 1 and a subset of Level 2[10].

The DoD CMMC website provides the most up-to-date information on changes and implementation timelines.

Related Regulations

CMMC interacts with several related standards and regulations:

  • NIST SP 800-171: Forms the basis for CMMC Level 2 requirements.
  • DFARS 252.204-7012: Mandates the protection of CUI and is closely aligned with CMMC requirements.
  • FAR 52.204-21: Provides the foundation for CMMC Level 1 practices.

These regulations complement CMMC by providing detailed security requirements and guidelines for protecting sensitive information in the defense industry.

Industry Impact

The implementation of CMMC has significant impacts on the defense industry:

  • Increased cybersecurity investment: Many companies, especially smaller contractors, need to invest in improving their cybersecurity practices.
  • Supply chain effects: Prime contractors are increasingly scrutinizing their subcontractors' cybersecurity capabilities.
  • Market dynamics: CMMC certification is becoming a competitive differentiator in the defense market.

For detailed industry analyses, refer to reports from organizations like the National Defense Industrial Association (NDIA).

Sources

CMMC Model Overview DFARS 252.204-7021 Kiteworks CMMC Implementation Guide IntelliGRC AWS CMMC Solutions DoD CMMC Model Overview PDF Kiteworks CMMC Compliance Checklist SaltyCloud CMMC Guide DAU CMMC Overview FedTech CMMC Article DoD CIO CMMC Resources NIST SP 800-171 DFARS 252.204-7012 FAR 52.204-21 CMMC Impact on Small Businesses CMMC Supply Chain Implications CMMC Market Analysis

Recent developments

  • — The Department of Defense suspended CMMC Phase 2, which was due to require third-party certification in contracts from 10 November 2026, pending a Reform Task Force review. (source)
  • — The CMMC requirements officially take effect on November 10, 2025, mandating cybersecurity audits and certification for DOD contractors and subcontractors handling FCI or CUI. (source)

Read the full guide to Cybersecurity Maturity Model Certification

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates