Who Needs to Comply with CMMC?

Who Does CMMC Apply To?

Cybersecurity Maturity Model Certification (CMMC) is required of any individual in the DOD supply chain, including contractors who interact exclusively with the Department of Defense and any and all subcontractors.

According to the DOD, the CMMC requirements will affect over 300,000 organizations. Fortunately, most businesses require only a Level 1 to Level 3 certification. The CMMC Accreditation Body (CMMC-AB) establishes a process to qualify private third-party assessment organizations (C3PAO) and assessors to determine CMMC levels.

The RFP will define the precise level of certification a business needs to be granted a federal contract.

CMMC Compliance Definition

CMMC compliance refers to an organization's adherence to the cybersecurity requirements set by the DoD to protect Controlled Unclassified Information (CUI) within the defense industrial base (DIB). CMMC consolidates various cybersecurity standards, including NIST SP 800-171, into a unified framework with multiple maturity levels.

The latest version, CMMC 2.0, simplifies compliance into three levels:

Level 1 (Foundational) – Basic safeguarding of Federal Contract Information (FCI), aligned with 17 practices from NIST 800-171.
Level 2 (Advanced) – Protects CUI with 110 security controls from NIST 800-171.
Level 3 (Expert) – Requires additional measures based on NIST 800-172.

Depending on contract requirements, organizations must self-assess or obtain third-party certification to bid on DoD contracts. CMMC ensures a standardized, risk-based approach to cybersecurity, enhancing supply chain security for federal defense projects.

When is CMMC Compliance Required?

CMMC is required for companies that are part of the DoD supply chain and handle Controlled Unclassified Information (CUI). The CMMC ensures these entities meet specific cybersecurity standards to protect sensitive information. As of CMMC 2.0, different certification levels are required based on the type of information the organization handles, with some contracts mandating CMMC compliance as a condition for bidding.

Read more: Additional guidance on compliance for subcontractors.

Resources: