CMMC Consulting

The Cybersecurity Maturity Model Certification (CMMC) is a unified cybersecurity standard for Department of Defense (DoD) acquisitions, aimed at securing the Defense Industrial Base (DIB) supply chain by increasing the protection of controlled unclassified information (CUI) and federal contract information (FCI) and implementing the NIST SP 800-171 rev. 2 security requirements. The CMMC Programmatic Rule, CFR 32 Part 170, was published to the Federal Register and went into effect on December 16, 2024.

The CMMC framework comprises of three levels and may require an independent third-party certification by an accredited organization. The DoD plans to implement CMMC requirements in four phases over three years, mandating compliance from all DoD contractors bidding on contracts by the final phase.

CMMC Program requirements apply to all DoD contract and subcontract awardees that, in performance of a DoD contract, will process, store or transmit information that meets the standard for FCI and CUI on contractor information systems. CMMC requirements may also extend to private sector businesses that support defense contractors, including cloud service providers (CSPs) and external service providers (ESPs).

CMMC Program requirements can extend to private-sector businesses and other entities that support defense contractors, such as CSPs and ESPs.

A CSP is an external company offering cloud computing services as defined by NIST SP 800-145, Sept 2011. An ESP includes external personnel, technology, or facilities used by an organization to provide and manage IT and/or cybersecurity services. For an entity to be considered an ESP under the CMMC Program, Controlled Unclassified Information (CUI) or security protection data must be processed, stored or transmitted on the ESP's assets.

Learn more about the CMMC requirements for Cloud Service Providers.

The CMMC Program, CFR 32 Part 170, rule was published to the Federal Register and went into effect on December 16, 2024. CMMC will not be enforced in contracts until the acquisition rule, 48 CFR 252.204-7021, Cybersecurity Maturity Model Certification Requirements, is finalized and published to the Federal Register. Once the acquisition rule goes into effect, there will be a phased implementation approach over three years to enforce the CMMC requirements. The acquisition rule is not expected to go into effect until mid-2025.

Once 48 CFR 252.204-7021 becomes effective, certain DoD contractors handling FCI and CUI will be required to achieve a CMMC Status at the applicable level as a condition of contract award. The level required for contract award will be specified within the contract solicitation.

CMMC Level 1 (Self-Assessment): This level applies to contracts that involve only FCI. Contractors are required to conduct a self-assessment against the requirements specified in the FAR clause 52.204-21 to ensure compliance. The requirements focus on the basic safeguarding of FCI, excluding publicly available government-provided information and simple transactional data.

CMMC Level 2 (Self-Assessment or Certification): This level applies to contracts involving CUI. Compliance may be demonstrated through either a self-assessment or certification by third-party assessors. The level of assessment will be determined by the DoD or prime Contracting Officers. Entities must implement all NIST 800-171 security requirements to receive a CMMC Status of Final. POA&Ms are allowed for self and third-party assessments, however, they must be remediated within 180 days of the CMMC Status Date. 

CMMC Level 3 (Certification): This level applies to contracts requiring a higher-level of protection against Advanced Persistent Threats (ATP). The level of assessment will be determined by the DoD or prime Contracting Officers. Contractors with a Level 3 requirement will first be required to obtain a CMMC Status of Final Level 2 (C3PAO) based on the Level 3 scoping requirements. Then, the contractor will engage with the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) to perform a Level 3 assessment over the 24 select NIST 800-172 security requirements. 

To assess the CMMC Level needed for your organization, you should consider the type of information you handle, and the requirements specified in your contracts. For instance, if your organization handles FCI, you will likely need to meet CMMC Level 1, which involves basic safeguarding of FCI. If you handle CUI, you will likely need to meet CMMC Level 2 (Self) at a minimum, which includes protecting CUI. For those managing CUI within the DoD’s highest priority programs, CMMC Level 3 may be required, which involves protecting CUI and reducing the risk of advanced persistent threats (APT). 

Ultimately, the CMMC Level required by your organization will be specified within the DoD solicitation. The applicable CMMC Level is determined by the DoD or prime Contracting Officers. However, by understanding the types and classification levels of the data your organization is handling as a result a DoD contract, you will be able to get ahead of the requirements before they become a contractual obligation. If you are a subcontractor, it is recommended that you reach out to the prime Contracting Officers to begin discussions on which CMMC Level they would require for your organization.

Our CMMC advisory professionals are available to help you determine the CMMC Level needed for your organization.

The CMMC Program implementation date is 60 days after the publication of the final Title 48 CFR CMMC acquisition rule. The CMMC assessment requirements will be implemented using a four-phase plan over three years. The phases add CMMC Level requirements incrementally, starting with self-assessments in Phase 1 and ending with full implementation of program requirements in Phase 4. Contractors should understand this phased approach and create a timeline to meet the requirements. This includes prioritizing affected contracts and ensuring all necessary certifications are in place.

Once the final acquisition rule becomes effective, where applicable, solicitations will require Level 1 or 2 self-assessments. One year after the acquisition rule’s effective date, where applicable, solicitations will require Level 2 certification. Two years after the acquisition rule’s effective date, where applicable, solicitations will require Level 3 certification. Beginning 3 years after acquisition rule’s effective date, all solicitations and contracts will include applicable CMMC Level requirements as a condition of contract award. In some procurements, the DoD may implement CMMC requirements in advance of the planned phase.

Non-compliance with CMMC requirements can have significant consequences for DoD contractors. Non-compliant contractors risk losing future business opportunities with the DoD, as CMMC certification will become a mandatory condition for contract awards. Ensuring compliance not only protects your current contracts but also positions your organization for continued success in the defense sector.