What Is CMMC?
CMMC, the Cybersecurity Maturity Model Certification, is the Department of Defense program that verifies defense contractors protect Federal Contract Information and Controlled Unclassified Information. It sets three levels of cybersecurity requirements and decides whether you prove compliance through a self-assessment, a certified third-party assessor (C3PAO), or a government assessment.
Updated November 2026
CMMC in Six Facts
- Full Name
- Cybersecurity Maturity Model Certification
- Run By
- The DoD Chief Information Officer, codified in 32 CFR Part 170
- Built On
- FAR 52.204-21, NIST SP 800-171 Revision 2 and NIST SP 800-172
- Levels
- Three, matched to the sensitivity of the information you handle
- Validity
- Three years, with an affirmation of continued compliance every year
- Where Results Go
- The Supplier Performance Risk System (SPRS)
Cybersecurity Maturity Model Certification
CMMC gives the DoD a consistent way to confirm that the companies in its supply chain have put the required cybersecurity practices in place. The level a contract calls for depends on the type of information you will handle.
- Learn about CMMC from the source.
- Understand public ruling and implementation to make critical business decisions.
- Be assured of correct application, management, and scalable cybersecurity in adherence to CMMC.
CMMC Levels Explained
Each level builds on the one before it. Your contract names the level you need.
Foundational
- Protects
- Federal Contract Information (FCI)
- Requirements
- 15 basic safeguarding requirements from FAR 52.204-21
- Assessment
- Annual self-assessment and annual affirmation
- POA&Ms
- Not permitted
Advanced
- Protects
- Controlled Unclassified Information (CUI)
- Requirements
- The 110 requirements of NIST SP 800-171 Revision 2
- Assessment
- Self-assessment or C3PAO certification every three years, plus annual affirmation
- POA&Ms
- Limited, with a minimum score of 88 out of 110 and closeout within 180 days
Expert
- Protects
- CUI tied to the DoD’s most critical programs
- Requirements
- All of Level 2 plus 24 requirements from NIST SP 800-172
- Assessment
- DIBCAC assessment every three years, after a final Level 2 C3PAO certification, plus annual affirmation
- POA&Ms
- Limited, with closeout within 180 days
How CMMC Compliance Works
Define Your Scope
Find where FCI and CUI live, which people, systems and facilities touch it, and draw your assessment boundary. A smaller, well-defined scope makes everything after it easier.
Implement and Document
Put the required practices in place and describe them in a System Security Plan (SSP).
Score and Post to SPRS
Score yourself with the DoD methodology, which runs from −203 to 110, and post the result in SPRS. See how your SSP, POA&M and SPRS score fit together.
Get Assessed
Complete the assessment your contract requires, whether a self-assessment, a C3PAO certification assessment, or a DIBCAC assessment for Level 3.
Close Any POA&Ms
If you earned Conditional status, close out every remaining item within 180 days to reach Final status.
Affirm and Maintain
Affirm compliance every year and keep the environment monitored and current between assessments.
What Is Required Today
CMMC requirements can already appear in DoD contracts through DFARS clauses 252.204-7021 and 252.204-7025. The DoD has paused the move to required third-party certification while it reviews the program, so most contracts currently call for Level 1 or Level 2 self-assessments.
The pause does not change the security work underneath. The same NIST SP 800-171 requirements are already required by DFARS 252.204-7012, so the effort you put in now carries forward under any outcome.
Still in Force Today
- DFARS 252.204-7012 safeguarding and 72-hour incident reporting
- NIST SP 800-171 Revision 2 as the required standard
- A current self-assessment score posted in SPRS
- CMMC Level 1 and Level 2 self-assessments and annual affirmations where a contract requires them
Choosing a CMMC Consultant or Assessor
Preparing for CMMC and being assessed for it are two different jobs. CMMC conflict of interest rules bar a C3PAO from assessing an organization it has consulted for, so the firm that helps you prepare cannot be the one that certifies you.
CMMC Readiness
Gap assessments, scoping, remediation planning and SSP and POA&M support to get you ready. Explore readiness services
C3PAO Assessments
Sentinel Blue is a CyberAB-authorized C3PAO that conducts CMMC Level 2 certification assessments. We keep assessment work separate from advisory work, and never assess an organization we have helped prepare. Learn about C3PAO certification
Managed Compliance
Ongoing governance, risk and compliance support that keeps your documentation, evidence and SPRS score current. Explore Pathfinder
Continuous Monitoring
Around-the-clock security monitoring and response from a SOC built for the Defense Industrial Base. Explore Overwatch
CMMC Questions, Answered
What does CMMC stand for?
CMMC stands for Cybersecurity Maturity Model Certification. It is the Department of Defense program, codified in 32 CFR Part 170, that verifies defense contractors protect Federal Contract Information and Controlled Unclassified Information.
What are the three CMMC levels?
Level 1 covers 15 basic requirements for Federal Contract Information. Level 2 covers the 110 requirements of NIST SP 800-171 Revision 2 for Controlled Unclassified Information. Level 3 adds 24 requirements from NIST SP 800-172 for CUI tied to the most critical programs.
Who needs CMMC?
Any DoD prime contractor or subcontractor whose contract includes a CMMC requirement and whose systems will process, store or transmit FCI or CUI. Primes must flow the requirement down to subcontractors that handle that information.
Is CMMC required right now?
CMMC requirements can already appear in DoD contracts. The DoD has paused the move to required third-party certification while it reviews the program, so most contracts currently call for Level 1 or Level 2 self-assessments. The underlying NIST SP 800-171 requirements remain mandatory under DFARS 252.204-7012.
How long does a CMMC certification last?
A CMMC status is valid for three years. You also need to affirm continued compliance in SPRS every year.
What is the minimum score for CMMC Level 2?
A score of at least 88 out of 110 earns Conditional status, as long as every open item is eligible for a Plan of Action and Milestones. All open items must be closed within 180 days to reach Final status.
Can the same company prepare me for CMMC and certify me?
No. CMMC conflict of interest rules bar a C3PAO from assessing an organization it has provided consulting services to. Use one firm for readiness and a separate C3PAO for your certification assessment.
How is CMMC different from DFARS 7012?
DFARS 252.204-7012 is the contract clause that requires you to implement NIST SP 800-171 and report cyber incidents within 72 hours. CMMC is the program that verifies you have implemented those requirements.