CMMC Foundation cheat sheet

CMMC is a U.S. Department of Defense (DoD) program that verifies defense contractors meet cybersecurity requirements before awarding or renewing certain contracts.

CMMC 2.0 replaced the original CMMC 1.0 five-level model in November 2021, collapsing requirements into three levels aligned to NIST SP 800-171 and NIST SP 800-172.

The CMMC Program final rule (32 CFR Part 170) was published in the Federal Register on 15 October 2024 and took effect 10 December 2024, establishing phased contract inclusion.

CMMC applies to DoD contracts and subcontracts involving Federal Contract Information (FCI) or Controlled Unclassified Information (CUI); it does not apply to commercial off-the-shelf purchases without such data.

The CMMC ecosystem comprises the DoD (program owner), the CMMC Accreditation Body (Cyber AB), C3PAOs, certified assessors, certified professionals, registered practitioners, and authorized instructors.

CMMC builds on existing FAR and DFARS clauses: FAR 52.204-21 for FCI and DFARS 252.204-7012 for CUI safeguarding and incident reporting.

The program's stated goals are to safeguard FCI and CUI, harmonize cybersecurity requirements across DoD contracts, and increase trust in the defense industrial base.

CMMC requirements flow down to subcontractors that store, process, or transmit FCI or CUI, so primes must verify subcontractor compliance.

Level 1 (Foundational) requires the 15 FAR 52.204-21 basic safeguarding requirements for FCI and is assessed by annual self-assessment with an annual senior official affirmation.

Level 2 (Advanced) requires all 110 security requirements of NIST SP 800-171 Rev 2; assessment is either a self-assessment (with affirmation) or a C3PAO-led third-party assessment depending on contract.

Level 3 (Expert) builds on all Level 2 requirements plus a subset of NIST SP 800-172 enhanced requirements; it is assessed only by the DoD, not by a C3PAO.

Level 2 self-assessment applies to contracts where the DoD has not designated CUI-critical programs; Level 2 certification (C3PAO) applies to select programs designated by the DoD.

Level 3 assessments are conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), which also performs Level 2 enforcement and oversight.

Assessment scoring uses a weighted approach under NIST SP 800-171A: each requirement is scored MET (1.0), NOT MET (0 for most, 5 for certain requirements), or NOT APPLICABLE.

A Level 2 certification is valid for three years, after which a new C3PAO assessment is required; annual affirmations are still required during that period.

POA&Ms are permitted at Level 2 and Level 3 for a limited subset of requirements, with a maximum 180-day remediation window and restrictions on which requirements qualify.

CMMC assessment objectives are derived from NIST SP 800-171A for Level 2 and NIST SP 800-172A for Level 3, providing the evidence criteria assessors use.

The Cyber AB (CMMC Accreditation Body) is the sole accreditation authority recognized by the DoD to accredit C3PAOs and certify individuals in the CMMC ecosystem.

A C3PAO (Certified Third-Party Assessment Organization) is an accredited firm authorized to conduct Level 2 certification assessments; it must employ Certified Assessors.

A Certified Assessor is an individual credentialed by the Cyber AB to lead or participate in C3PAO assessments; assessors must meet experience, training, and exam requirements.

A Certified Professional is an individual who has passed the Certified Professional exam and can support clients in preparing for assessments, but cannot perform certification assessments.

A Registered Practitioner is an entry-level credential requiring CMMC training and a code of conduct; it does not authorize leading assessments or providing certification.

An Authorized Instructor is credentialed by the Cyber AB to deliver official CMMC training content; only Authorized Instructors may teach Cyber AB-approved curricula.

The Cyber AB maintains a public registry of accredited C3PAOs, certified assessors, certified professionals, and registered practitioners, which contractors can use to verify credentials.

C3PAOs must be independent of the contractor being assessed; conflicts of interest (e.g., prior consulting engagements) disqualify the organization from assessing that client.

The Cyber AB's CMMC Certified Assessor exam and Certified Professional exam are separate credentials with distinct scopes; only Certified Assessors can sign off on certification assessment results.

Prime contractors are responsible for flowing CMMC requirements to subcontractors when the subcontract involves FCI or CUI, and must verify subcontractor compliance.

Small businesses make up a large share of the defense industrial base; DoD has phased CMMC requirements to give smaller contractors time to prepare.

Contractors must identify where FCI and CUI reside in their environment, as the level of CMMC required depends on the data type and contract designation.

The DoD phased rollout began with Level 1 and Level 2 self-assessment requirements in solicitations starting in 2025, with Level 2 C3PAO certification and Level 3 requirements following in later phases.

Contractors can use the Supplier Performance Risk System (SPRS) to post their NIST SP 800-171 self-assessment scores, which primes may use to evaluate subcontractors.

A current NIST SP 800-171 self-assessment score in SPRS is a prerequisite for many DoD contracts involving CUI, independent of CMMC certification timing.

Marketplace participants include managed service providers (MSPs), managed security service providers (MSSPs), consultants, and C3PAOs; contractors often rely on MSPs to meet CMMC requirements.

Costs of CMMC compliance include assessment fees, remediation of gaps, ongoing monitoring, and staff training; small businesses may qualify for DoD-funded readiness programs such as the Project Spectrum and APEX accelerators.

Contractors should map contract clauses (FAR 52.204-21, DFARS 252.204-7012, 7019, 7020, 7021) to determine which CMMC level and assessment type apply before bidding.