[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cmmc\u002Foverview":3},{"item":4,"lessons":16,"controls":54,"related":83},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cmmc","overview","CMMC","Cybersecurity Maturity Model Certification (CMMC)",9,"US Department of Defense","**What it covers.** CMMC is a US Department of Defense programme that verifies whether defence contractors protect Federal Contract Information and Controlled Unclassified Information. The current version, CMMC 2.0, has three levels: Level 1 is based on the basic safeguarding requirements in FAR 52.204-21, Level 2 aligns with NIST SP 800-171 and Level 3 adds selected requirements from NIST SP 800-172. Depending on the level and contract, assessment is by self-assessment, a third party assessor or the government.\n\n**In practice.** Contractors determine which level their contracts require, scope the systems that handle the relevant information and implement the corresponding practices, such as maintaining baseline configurations. Evidence includes a system security plan, policies, configuration records and, where needed, plans of action and milestones. European suppliers in US defence supply chains may also be in scope.\n\n**Common gaps.** Scoping is a frequent difficulty, particularly where controlled information spreads into general IT. Self-assessment scores are sometimes optimistic.",null,"https:\u002F\u002Fdodcio.defense.gov\u002FCMMC\u002F","Read about CMMC","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50],{"slug":19,"title":20,"published_at":21},"unpatched-contractor-software-opens-fbi-systems-to-shinyhunters-breach","Unpatched Contractor Software Opens FBI Systems to ShinyHunters Breach","2026-10-12T12:22:22.353+00:00",{"slug":23,"title":24,"published_at":25},"new-cui-regulations-tighten-cybersecurity-rules-for-federal-contractors","New CUI Regulations Tighten Cybersecurity Rules for Federal Contractors","2026-10-07T20:20:19.528+00:00",{"slug":27,"title":28,"published_at":29},"ai-driven-security-research-targets-vulnerabilities-in-military-messaging-apps","AI-Driven Security Research Targets Vulnerabilities in Military Messaging Apps","2026-09-29T18:20:21.659+00:00",{"slug":31,"title":32,"published_at":33},"hidden-russian-ownership-exposes-critical-supply-chain-risk-in-us-security-contracts","Hidden Russian Ownership Exposes Critical Supply Chain Risk in U.S. Security Contracts","2026-09-24T20:21:52.875+00:00",{"slug":35,"title":36,"published_at":37},"flock-safetys-opaque-manufacturing-origins-raise-national-security-concerns","Flock Safety's Opaque Manufacturing Origins Raise National Security Concerns","2026-09-17T10:20:40.341+00:00",{"slug":39,"title":40,"published_at":41},"defense-contractors-overestimate-cmmc-readiness-as-evidence-gaps-widen","Defense Contractors Overestimate CMMC Readiness as Evidence Gaps Widen","2026-08-21T10:21:29.511+00:00",{"slug":43,"title":44,"published_at":45},"trump-eo-mandates-defense-contractor-supply-chain-mapping","Trump EO Mandates Defense Contractor Supply Chain Mapping","2026-07-21T20:21:26.832+00:00",{"slug":47,"title":48,"published_at":49},"adversarial-nation-code-found-in-apps-marketed-to-us-military-personnel","Adversarial Nation Code Found in Apps Marketed to US Military Personnel","2026-07-20T10:20:46.746+00:00",{"slug":51,"title":52,"published_at":53},"legacy-third-party-hosting-enables-us-army-website-defacement","Legacy Third-Party Hosting Enables US Army Website Defacement","2026-07-06T18:20:23.333+00:00",[55,60,65,69,74,79],{"slug":56,"name":57,"problem":58,"stories":59},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",4,{"slug":61,"name":62,"problem":63,"stories":64},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",3,{"slug":66,"name":67,"problem":68,"stories":64},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":70,"name":71,"problem":72,"stories":73},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",2,{"slug":75,"name":76,"problem":77,"stories":78},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":80,"name":81,"problem":82,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",[84,90,95,99,103,107,112,117],{"family":85,"item":86,"code":87,"title":88,"together":89},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",6,{"family":91,"item":92,"code":93,"title":94,"together":59},"cis","2","Control 2","Inventory and Control of Software Assets",{"family":91,"item":96,"code":97,"title":98,"together":59},"15","Control 15","Service Provider Management",{"family":91,"item":100,"code":101,"title":102,"together":64},"16","Control 16","Application Software Security",{"family":91,"item":104,"code":105,"title":106,"together":64},"3","Control 3","Data Protection",{"family":108,"item":109,"code":110,"title":111,"together":73},"iso","27036","ISO\u002FIEC 27036","ISO\u002FIEC 27036: Cybersecurity, Supplier relationships",{"family":113,"item":114,"code":115,"title":116,"together":73},"gdpr","28","Article 28","Processor",{"family":118,"item":6,"code":119,"title":119,"together":73},"itil","ITIL"]