Achieve CMMC certification for DoD contracts

The Cybersecurity Maturity Model Certification (CMMC) is a DoD cybersecurity framework designed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within the Defense Industrial Base (DIB). CMMC 2.0, released in 2021, streamlined the model to three levels aligned with existing standards, primarily NIST SP 800-171.

CMMC 2.0 has three levels: Level 1 (Foundational) requires 17 basic practices for FCI protection with annual self-assessment. Level 2 (Advanced) requires all 110 NIST SP 800-171 controls for CUI protection, with self-assessment or third-party assessment depending on contract criticality. Level 3 (Expert) adds enhanced controls from NIST SP 800-172 for the most sensitive programs.

All prime contractors and subcontractors in the Defense Industrial Base who process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) need CMMC certification. The specific level required will be specified in contract solicitations based on the sensitivity of information handled.

The Supplier Performance Risk System (SPRS) score is a numerical representation of your NIST 800-171 implementation status, ranging from -203 to +110. A perfect score of 110 means full implementation of all controls. Contractors must submit their score to DoD. CMMC Level 2 requires demonstrating implementation of all 110 controls.

A CMMC Third-Party Assessment Organization (C3PAO) is an authorized organization that conducts CMMC assessments for Level 2 certification. C3PAOs are accredited by the Cyber AB (CMMC Accreditation Body) and employ certified CMMC assessors who evaluate contractors against CMMC requirements.

CMMC is being phased into DoD contracts starting in 2025. Phase 1 (2025) requires self-assessment for Level 1 and some Level 2 contracts. Phase 2 (2026) introduces third-party assessments for prioritized contracts. Phase 3 (2027-2028) extends requirements across all applicable contracts. Start preparation now to maintain contract eligibility.

CMMC and NIST 800-171 share the same 110 security controls for Level 2. The key difference is verification: NIST 800-171 allows self-attestation while CMMC Level 2 may require third-party assessment. CMMC also introduces a certification process, SPRS scoring requirements, and the C3PAO ecosystem for independent verification.

It depends on the contract. CMMC 2.0 allows self-assessment for some Level 2 contracts involving less critical CUI. Contracts involving prioritized acquisitions or more sensitive information require third-party assessment by an accredited C3PAO. The solicitation will specify which assessment type is required.