Cybersecurity Maturity Model Certification (CMMC)

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense (DoD) program that verifies whether contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) on their own information systems. The program rules are in 32 CFR Part 170, effective December 16, 2024. The contract terms are in the Defense Federal Acquisition Regulation Supplement (DFARS).

When does CMMC appear in DoD contracts?

CMMC requirements began appearing in DoD solicitations on November 10, 2025, the effective date of the DFARS final rule that added the provision at DFARS 252.204-7025 and the clause at DFARS 252.204-7021. Under 32 CFR 170.3(e), the program phases in over four one-year steps.

• Phase 1 (from November 10, 2025): Level 1 or Level 2 self-assessment as a condition of award.
• Phase 2 (one year later, November 10, 2026): adds Level 2 certification by a CMMC Third-Party Assessment Organization (C3PAO).
• Phase 3 (one year after Phase 2): Level 2 (C3PAO) for all applicable contracts, and Level 3.
• Phase 4 (from November 10, 2028): all applicable solicitations and contracts, including option periods on older awards.

What do Levels 1, 2 and 3 require?

Level 1 protects FCI and requires the 15 security requirements in FAR 52.204-21(b)(1), self-assessed every year. Level 2 protects CUI and requires the 110 requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2. Level 3 adds 24 requirements from NIST SP 800-172, assessed by DoD's Defense Contract Management Agency.

FAR 4.1901 defines FCI as information not intended for public release that is provided by or generated for the government under a contract.

Does CMMC apply to non-U.S. suppliers?

Yes, when a non-U.S. supplier will process, store or transmit FCI or CUI under a DoD contract or subcontract. 32 CFR 170.23 applies CMMC to "prime contractors and subcontractors throughout the supply chain at all tiers." Awards solely for commercially available off-the-shelf (COTS) items are excluded.

In the DFARS rule's preamble, DoD wrote that a contract subject to NIST SP 800-171 "would require the contractor, whether foreign or domestic, to secure their information systems." A subcontractor handling only FCI needs Level 1; one handling CUI needs at least Level 2 self-assessment, or a C3PAO certification if the prime contract requires one.