CMMC: The Complete Executive Guide

CMMC verifies that Defense Industrial Base contractors actually implement the controls they've self-attested to since 2017 — three levels, increasing in rigor and in who checks the work.

The Cybersecurity Maturity Model Certification program verifies that Defense Industrial Base contractors actually implement the security controls they've been required to self-attest to since 2017 — three levels of increasing rigor, from an annual self-assessment at Foundational through third-party C3PAO assessment for most Advanced (Level 2) programs to government-led assessment at Expert. CMMC Level 2 doesn't invent new requirements: it maps directly onto the same 110 requirements in NIST SP 800-171, and what it adds is independent verification, closing a real gap DoD found between paper self-attestations and actual implementation. Two separate rules govern its real-world effect — the program rule (32 CFR Part 170, already effective) defines what CMMC is, while the DFARS acquisition rule is what actually makes a specific certification level a condition of contract award, and it is phasing in gradually, solicitation by solicitation, not on a single program-wide date. CMMC has no fine mechanism of its own; the real consequence of non-compliance is contract ineligibility, a market-access risk rather than a financial-penalty one, and obligations frequently flow down from a prime contractor to its subcontractors, a detail smaller suppliers commonly miss. The most commonly underestimated cost is genuine technical remediation — FIPS-validated cryptography, centralized audit logging, and multifactor authentication applied consistently across a precisely scoped CUI boundary — not the self-assessment paperwork, which is usually the smallest and most budgeted-for line item. This guide covers who is actually in scope by contractual relationship, what real implementation of the 110 requirements requires, a realistic maturity model for timing assessment readiness, and how to avoid the mistakes that most commonly stall CMMC programs.

Key findings

1. CMMC Level 2 verifies the same 110 requirements NIST SP 800-171 has required since 2017 — it doesn't add new controls, it adds independent verification.

2. Two separate rules govern real-world effect: the program rule (already effective) and the DFARS acquisition rule (phasing in solicitation by solicitation).

3. CMMC flow-down requirements frequently reach subcontractors — a detail smaller suppliers commonly miss.

4. The real consequence of non-compliance is contract ineligibility, not a fine — a market-access risk, not a financial-penalty one.

5. Precisely scoping the CUI boundary before remediation begins is the single highest-leverage early decision — an overly broad boundary inflates every downstream cost.