CMMC Ecosystem Overview
The CMMC Ecosystem Overview domain tests why the program exists, which documents give it legal force, and who is allowed to do what. Expect items on the path from CMMC 1.0 to CMMC 2.0, on the 2024 final rule, and on the line between DoD, the accreditation body, and assessors.
Why the program exists
DFARS 252.204-7012 has required NIST SP 800-171 since 2017, but compliance was self-attested. Government audits found widespread gaps, so DoD built a verification layer. CMMC does not replace SP 800-171; it wraps assessment, affirmation, and certification around the same security requirements.
Sources of authority
- 32 CFR Part 170 - the CMMC final rule, published 15 October 2024 and effective 16 December 2024. It defines the levels, assessment types, affirmations, and who may assess.
- DFARS 252.204-7021 - the contract clause that puts a required CMMC level into solicitations, phased in over roughly three years.
- NIST SP 800-171, NIST SP 800-172, and FAR 52.204-21 - the technical requirement sources behind the levels.
Who does what
- The DoD CMMC Program Management Office owns policy and runs the program.
- The Cyber AB is the sole accreditation body: it accredits C3PAOs and Licensed Training Providers and certifies individual professionals. It does not assess contractors.
- C3PAOs perform Level 2 certification assessments. DIBCAC, a DCMA organization, performs Level 3 assessments for the government.
- Contractors assess or are assessed, then a senior official affirms the result.
Worked example
A subcontractor asks, "Who certifies us?" The answer depends on the clause. If the contract requires Level 1, or a Level 2 self-assessment, no external certifier is involved: the company assesses itself and a senior official affirms. If the contract requires a Level 2 certification, an accredited C3PAO must do it. Only Level 3 brings in government assessors.
Traps that cost marks
- CMMC 1.0 had five levels and 171 practices; CMMC 2.0 has three. Never mix the two models.
- CMMC is mandatory once it appears in a contract, not optional good practice.
- The Cyber AB accredits organizations; it never issues certificates to contractors.
- A completed self-assessment is not a "certification" - reserve that word for C3PAO or DIBCAC assessments.
- The level is set by DoD in the solicitation, never chosen by the contractor.