What Does CMMC Stand For? A Defense Contractor's Guide

CMMC stands for Cybersecurity Maturity Model Certification. It is the Department of Defense’s framework for verifying that defense contractors protect sensitive information before they can bid on contracts.

If you are a defense contractor or subcontractor, CMMC requirements depend on the information you handle and the clauses in your solicitation or contract. Check each solicitation before deciding which assessment applies.

What CMMC replaced

Before CMMC, defense contractors were expected to self-attest their compliance with NIST SP 800-171 under DFARS 252.204-7012. The problem: self-attestation had no verification. Contractors could claim compliance without ever being assessed. Many did.

The DoD found that the majority of the defense industrial base was not actually meeting the security requirements they claimed to meet. CMMC was created to fix this by requiring independent third-party assessments.

The three CMMC levels

Level 1: Foundational

15 basic cybersecurity practices from FAR 52.204-21. Covers Federal Contract Information (FCI), not CUI. Requirements include basic access control, identification and authentication, and physical protection. Self-assessment is allowed.

Most contractors who only handle FCI (not CUI) need Level 1. This is the minimum for any DoD contract.

Level 2: Advanced

110 security practices mapped to NIST SP 800-171 Rev 2. This is the level that matters for contractors handling CUI. It covers 14 control families:

• Access Control (AC)
• Awareness and Training (AT)
• Audit and Accountability (AU)
• Configuration Management (CM)
• Identification and Authentication (IA)
• Incident Response (IR)
• Maintenance (MA)
• Media Protection (MP)
• Personnel Security (PS)
• Physical Protection (PE)
• Risk Assessment (RA)
• Security Assessment (CA)
• System and Communications Protection (SC)
• System and Information Integrity (SI)

Level 2 applies to CUI handling and may require either self-assessment or assessment by a certified third-party assessment organization (C3PAO), depending on the solicitation.

Level 3: Expert

Level 3 adds practices from NIST SP 800-172 on top of Level 2. It is designed for contractors working with the most sensitive CUI and facing advanced persistent threats. Government-led assessments are required. Very few contractors need Level 3.

Who needs CMMC

Companies that bid on DoD contracts involving CUI should prepare for Level 2 requirements and verify the assessment type stated in each solicitation. This includes:

• Prime contractors
• Subcontractors at any tier who handle CUI
• Companies that store, process, or transmit CUI on behalf of a prime
• IT service providers managing systems that touch CUI

Requirements can flow down through the supply chain. If a prime contractor requires a subcontractor to handle CUI, the subcontractor must meet the applicable contract requirements, which may include a Level 2 self-assessment or certification.

What CUI actually is

Controlled Unclassified Information is government-created or government-owned information that requires safeguarding. It is not classified, but it is not public either. Examples include:

• Technical drawings and specifications for defense systems
• Contract performance data
• Export-controlled technical data (ITAR)
• Personnel records related to contract work
• Vulnerability assessments and security plans

If you receive documents marked CUI, FOUO (For Official Use Only), or with ITAR markings, you are handling CUI. Your systems must meet CMMC Level 2 requirements.

For a deeper look at how CUI designation works, read Encrypted CUI Is Still CUI.

What CMMC assessment looks like

When a solicitation requires a CMMC Level 2 certification assessment, it is conducted by a C3PAO (Certified Third-Party Assessment Organization) accredited by the Cyber AB (formerly the CMMC Accreditation Body). The process:

1. Scoping. You define which systems, people, and processes handle CUI. This becomes your assessment boundary.
2. Documentation review. The assessor reviews your System Security Plan (SSP) and any Plans of Action and Milestones (POA&Ms). The SSP documents how each of the 110 practices is implemented.
3. Evidence collection. The assessor examines technical evidence: configurations, logs, policies, and procedures. They verify that your documentation matches reality.
4. Interviews. The assessor talks to your staff to confirm that security practices are understood and followed, not just written down.
5. Findings. Each practice is scored as Met, Not Met, or Not Applicable. To pass, all 110 practices must be Met or have an approved POA&M.

The assessment typically takes 1-3 weeks for a small organization, depending on scope and complexity.

Common systems the assessor examines

Your C3PAO will look at every system in your CUI boundary. For most small contractors, the critical systems are:

Email. How is CUI transmitted? Is email encrypted in transit and at rest? Are audit logs captured? Is MFA enforced? For a detailed breakdown of what assessors ask about email, read CMMC Level 2 Email Controls: What Your C3PAO Will Ask.

File storage. Where is CUI stored? Who has access? Are permissions based on least privilege? Is there version history and audit logging?

Endpoints. Are laptops and workstations encrypted? Are they managed? Can data be wiped remotely?

Identity and access management. How are users authenticated? Is MFA enforced? Are accounts disabled when people leave? If you use Active Directory, read how to audit AD for CMMC.

How much CMMC costs

The cost varies widely depending on your current security posture and the tools you choose:

• Assessment services: Fees vary by assessor, boundary size, readiness, and scheduling.
• Remediation: Depends on gaps found. Could be minimal or could require new infrastructure.
• Tools and services: Costs depend on the provider, migration scope, support model, and contract terms. Compare the whole operating model, not only the advertised license.

The biggest hidden cost is time. Getting compliant can take months if your current tools require infrastructure rebuilds (like migrating to GCC High).

How to get started

1. Determine your level. If you handle CUI, you need Level 2. If you only handle FCI, Level 1 may suffice.
2. Scope your boundary. Identify every system, person, and process that touches CUI. The smaller your boundary, the simpler your assessment.
3. Assess your gaps. Compare your current security posture against the 110 NIST 800-171 practices. Use the CMMC Level 2 readiness checklist for 39 prompts across 11 assessment areas.
4. Fix your gaps. Start with your email and file storage. These are the systems most likely to fail assessment and the easiest to fix by switching to a compliant platform.
5. Document everything. Write your SSP. Document how each practice is implemented. Your assessor wants evidence, not promises.
6. Confirm the assessment path. Check the solicitation and engage a C3PAO when certification is required.

CMMC is changing, but the underlying safeguarding and evidence obligations remain. Keep the required controls operating while the DoD completes its review.

Put CUI work in a smaller boundary

IRONKEEP is in private beta for defense organizations that want MAIL, DRIVE, DOCS, CHAT, and MEETINGS in one governed workspace. It is designed to support CUI workflows and NIST SP 800-171 evidence, but each customer remains responsible for scope, configuration, contract requirements, and assessment. Request a defense pilot.