CMMC 2.0
The Cybersecurity Maturity Model Certification — the US Department of Defense's framework for verifying that contractors handling Controlled Unclassified Information (CUI) actually meet NIST SP 800-171 security requirements, not just attest to them on paper.
CMMC 2.0 has three levels. Level 1 (Foundational) covers 15 basic safeguarding requirements for Federal Contract Information and is verified by annual self-assessment. Level 2 (Advanced) maps directly to the 110 security requirements in NIST SP 800-171 and, depending on the sensitivity of the CUI involved, requires either self-assessment or a third-party assessment by a CMMC Third-Party Assessment Organization (C3PAO). Level 3 (Expert) adds a further set of enhanced requirements from NIST SP 800-172 and is assessed by the government directly, reserved for the highest-risk CUI.
CMMC's program rule (32 CFR Part 170) became effective in December 2024, and the DFARS acquisition rule that actually requires CMMC certification in DoD contracts followed — contractors should track the specific rollout timeline for their own contract vehicle, since CMMC is being phased into new contract solicitations over time rather than applying to every existing DoD contract simultaneously.
Who is impacted
Defense Industrial Base (DIB) contractors and subcontractors that process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as part of a DoD contract — the required level depends on the sensitivity of the information the specific contract involves.
Requirements
Level 1: 15 basic safeguarding practices, annual self-assessment. Level 2: full implementation of NIST SP 800-171's 110 security requirements, verified by self-assessment or C3PAO third-party assessment depending on the contract. Level 3: NIST SP 800-171 plus enhanced NIST SP 800-172 requirements, assessed directly by the government.
Key deadlines
CMMC 2.0 program rule effective (32 CFR Part 170)
Executive guides & research
CMMC: The Complete Executive Guide
CMMC 2.0's three levels, its direct relationship to NIST SP 800-171, and why the real consequence of non-compliance is contract eligibility, not a fine.
Glossary
C3PAO
CMMC Third-Party Assessment Organization — an accredited organization authorized to conduct CMMC Level 2 certification assessments for defense contractors that require third-party (rather than self-) assessment.
Controlled Unclassified Information (CUI)
Federal information that requires safeguarding under law, regulation, or government-wide policy, but isn't classified — the specific category of information CMMC Level 2 and above is built to protect.
Related regulations
Related
Stay ahead of CMMC changes
Get Regulatory Alerts the moment something about CMMC 2.0 changes — new deadlines, guidance updates, enforcement actions.