What it covers. CMMC is a US Department of Defense programme that verifies whether defence contractors protect Federal Contract Information and Controlled Unclassified Information. The current version, CMMC 2.0, has three levels: Level 1 is based on the basic safeguarding requirements in FAR 52.204-21, Level 2 aligns with NIST SP 800-171 and Level 3 adds selected requirements from NIST SP 800-172. Depending on the level and contract, assessment is by self-assessment, a third party assessor or the government.
In practice. Contractors determine which level their contracts require, scope the systems that handle the relevant information and implement the corresponding practices, such as maintaining baseline configurations. Evidence includes a system security plan, policies, configuration records and, where needed, plans of action and milestones. European suppliers in US defence supply chains may also be in scope.
Common gaps. Scoping is a frequent difficulty, particularly where controlled information spreads into general IT. Self-assessment scores are sometimes optimistic.