Control frameworks and standards
CMMC
The certification programme for US defence suppliers, largely based on NIST SP 800-171.
Official source Published by US Department of Defense. US government work.
What it is
The Cybersecurity Maturity Model Certification (CMMC) is the US Department of Defense programme that checks whether defence suppliers protect sensitive government information. It exists because self-attestation to existing contract clauses was not producing reliable protection across the defence industrial base.
Who it applies to
- Contractors and subcontractors in the US defence supply chain that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI)
- Non-US suppliers, including European companies, that handle FCI or CUI under DoD contracts
- Managed service and cloud providers supporting those contractors, which may fall into the assessment scope
- The required level is set in each contract according to the information involved
- Status
- US federal regulation: the programme rule (32 CFR Part 170) took effect in December 2024, and the acquisition rule adding CMMC to DoD contracts took effect in November 2025, starting a phased rollout over several years.
- Enforcement
- The DoD sets the level in solicitations and contracts. Level 1 uses annual self-assessment, Level 2 a self-assessment or a third party assessment by an authorised C3PAO depending on the contract, and Level 3 a government assessment; misrepresenting compliance can lead to loss of contracts and liability under the US False Claims Act.
Key points
- Know what information you handle: FCI and CUI drive the level
- Level 2 is essentially NIST SP 800-171, so existing 800-171 work carries over
- Scoping the CUI environment carefully, for example with an enclave, can reduce cost a lot
- A System Security Plan and limited Plans of Action and Milestones are allowed only under strict conditions
- Requirements flow down to subcontractors that handle FCI or CUI
- Cloud services that store CUI generally need to meet FedRAMP Moderate or an equivalent
Where to start
- 1Ask your prime contractor or contracting officer which level your contracts will require
- 2Map where FCI and CUI enter, are stored and leave your systems
- 3Run a gap assessment against NIST SP 800-171 and write a System Security Plan
- 4Book a C3PAO early if a third party Level 2 assessment is likely, as capacity is limited
How it is structured
| Level 1 (Foundational) | Basic safeguarding of FCI, based on the FAR basic safeguarding requirements |
|---|---|
| Level 2 (Advanced) | Protection of CUI, aligned with the 110 requirements of NIST SP 800-171 Revision 2 |
| Level 3 (Expert) | Additional selected requirements from NIST SP 800-172 against advanced threats |
| Assessment and affirmation | Assessment results submitted to the DoD system, with annual affirmation by a senior official |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (1)
Ordered by how often our lessons cite them.