What is CMMC 2.0?
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a unified standard for implementing cybersecurity across the Defense Industrial Base (DIB). It's designed to protect sensitive unclassified information shared by the Department of Defense (DoD) with its contractors and subcontractors.
CMMC 2.0 streamlines the original CMMC framework from five levels to three, aligns with NIST standards, and allows self-assessment for certain levels. This certification will become mandatory for all DoD contractors handling Controlled Unclassified Information (CUI) or Federal Contract Information (FCI).
Supply Chain Security
Ensures cybersecurity throughout the entire defense supply chain
Information Protection
Safeguards CUI and FCI from adversarial threats and cyber attacks
Verification Focus
Moves from self-attestation to verified implementation of controls
CMMC Maturity Levels
Requirements
17 practices from FAR 52.204-21 for basic cyber hygiene
Information Protected
Federal Contract Information (FCI) only
Assessment Type
Annual self-assessment with affirmation
Who This Is For: Contractors handling only FCI, not CUI. Includes basic IT service providers, facilities maintenance, and logistics support.
Requirements
110 practices from NIST SP 800-171 Rev 2
Information Protected
Controlled Unclassified Information (CUI)
Assessment Type
Triennial third-party assessment (critical programs) or annual self-assessment (non-critical programs)
Who This Is For: Most defense contractors handling CUI. Includes manufacturers, engineering firms, IT services, and research organizations.
Requirements
110+ practices from NIST SP 800-172
Information Protected
CUI on highest priority programs
Assessment Type
Triennial government-led assessment
Who This Is For: Contractors on critical national security programs. Includes advanced weapon systems, critical infrastructure, and classified-adjacent work.
Who Needs CMMC?
Prime Contractors
All companies with direct DoD contracts will require CMMC certification at the appropriate level based on the information they handle.
Subcontractors
Any subcontractor that processes, stores, or transmits FCI or CUI must be certified at the appropriate CMMC level.
Support Service Providers
IT service providers, cloud providers, and other support services handling covered defense information require certification.
Research Institutions
Universities and research organizations performing DoD-funded research involving CUI need appropriate certification.
NIST 800-171 Alignment
CMMC Level 2 directly aligns with NIST SP 800-171 Rev 2, requiring implementation of 110 security requirements across 14 control families. Organizations already compliant with NIST 800-171 have a significant head start on CMMC certification.
- Access Control (AC) - 22 controls
- Awareness & Training (AT) - 3 controls
- Audit & Accountability (AU) - 9 controls
- Configuration Management (CM) - 9 controls
- Identification & Authentication (IA) - 11 controls
- Incident Response (IR) - 3 controls
- Maintenance (MA) - 6 controls
- Media Protection (MP) - 8 controls
- Personnel Security (PS) - 3 controls
- Physical Protection (PE) - 6 controls
- Risk Assessment (RA) - 3 controls
- Security Assessment (CA) - 4 controls
- System & Communications (SC) - 16 controls
- System & Information Integrity (SI) - 7 controls
Access Control
Multi-factor authentication, least privilege, account management
System Security
Boundary protection, encryption, secure configurations
Incident Response
Detection, analysis, containment, recovery procedures
Risk Management
Vulnerability scanning, risk assessments, remediation tracking
Assessment Process
Pre-Assessment Preparation
Complete self-assessment, remediate gaps, prepare System Security Plan (SSP) and Plan of Action & Milestones (POA&M)
C3PAO Selection
Choose a CMMC Third-Party Assessment Organization (C3PAO) from the approved list on the Cyber-AB marketplace
Scoping Meeting
Define assessment boundaries, identify CUI flows, determine in-scope systems and locations
On-Site Assessment
Document review, technical testing, personnel interviews, physical inspection over 2-5 days
Certification Decision
Receive assessment report, address findings if needed, obtain 3-year certification upon passing
Implementation Roadmap
Months 1-3: Discovery & Planning
- • Identify CUI and data flows
- • Define system boundaries
- • Conduct gap assessment
- • Develop implementation plan
- • CUI inventory
- • Network diagram
- • Gap analysis report
- • Project roadmap
Months 4-6: Technical Implementation
- • Deploy security tools
- • Configure access controls
- • Implement encryption
- • Set up monitoring
- • MFA deployment
- • SIEM configuration
- • Network segmentation
- • Vulnerability management
Months 7-9: Process & Documentation
- • Develop policies/procedures
- • Create System Security Plan
- • Conduct training
- • Document evidence
- • Security policies
- • SSP document
- • Training records
- • Incident response plan
Months 10-12: Testing & Certification
- • Internal testing
- • Remediate findings
- • Mock assessment
- • Official C3PAO assessment
- • Test results
- • Remediation evidence
- • Assessment report
- • CMMC certificate
Get a Quote
CMMC certification costs vary significantly based on the target level, your organization's current cybersecurity maturity, the scope of CUI handled, and the extent of remediation needed. Level 1 self-assessments are considerably less involved than Level 2 C3PAO assessments.
Get a personalized quote through the AuditNex marketplace to understand what your CMMC assessment will cost.
Preparing for Certification
- Executive Buy-In: Leadership commitment and resource allocation
- Accurate Scoping: Proper CUI identification and boundary definition
- Documentation: Comprehensive SSP and evidence collection
- Continuous Monitoring: Ongoing compliance verification
- Training Program: Regular security awareness for all staff
- Underestimating Scope: CUI often exists in unexpected places
- Poor Documentation: Insufficient evidence of control implementation
- Technical Debt: Legacy systems that can't meet requirements
- Rushed Timeline: Attempting certification without proper preparation
- Supply Chain Gaps: Subcontractors not meeting requirements
Identify All CUI
Map where CUI enters, is processed, stored, and transmitted in your environment
Conduct Gap Assessment
Evaluate current state against NIST 800-171 requirements
Develop Remediation Plan
Prioritize gaps based on risk and implementation complexity
Allocate Resources
Secure budget and personnel for implementation