1. Regulatory Basis and Policy Authority

The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a mandatory cybersecurity framework enforced by the Department of Defense (DoD) through the Defense Federal Acquisition Regulation Supplement (DFARS). It establishes minimum cybersecurity standards that all organizations in the Defense Industrial Base (DIB) must meet as a condition of contract award. CMMC 2.0 supersedes CMMC 1.0 and was formalized through 32 CFR Part 170, effective December 16, 2024.

1.1 Legislative and Regulatory Lineage

CMMC 2.0 is the product of a multi-year regulatory evolution rooted in protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The following regulatory instruments form the foundational chain of authority:

1.2 Scope of Applicability

CMMC applies to all organizations that handle FCI or CUI as part of DoD contracts, subcontracts, or task orders — including prime contractors, subcontractors at all tiers, suppliers, cloud service providers, and managed security service providers that process, store, or transmit covered information on behalf of a DIB entity.

The following information types determine CMMC Level applicability:

• Federal Contract Information (FCI):Information provided by or generated for the Government under a contract that is not intended for public release. Requires Level 1 compliance (FAR 52.204-21).
• Controlled Unclassified Information (CUI):Information the Government creates or possesses that requires safeguarding per law, regulation, or policy (32 CFR Part 2002 / CUI Registry). Requires Level 2 or Level 3.
• CUI with Enhanced Protection Requirements:CUI in programs with elevated sensitivity (e.g., weapons systems, nuclear, critical infrastructure). May require Level 3.

2. CMMC 2.0 Framework Architecture

CMMC 2.0 streamlines the original five-level model into three distinct certification levels, each building upon the previous. The framework directly maps to NIST SP 800-171 (Levels 1 and 2) and NIST SP 800-172 (Level 3). Each level specifies a defined set of practices organized across 14 security domains, a prescribed assessment method, and an allowance (or restriction) on the use of Plans of Action and Milestones (POA&Ms) to address gaps.

2.1 The Three Certification Levels

* Level 2 self-assessment is permitted for programs designated as non-prioritized acquisitions. DoD contract solicitations specify which Level 2 assessment path applies.

2.2 Level 1 — Foundational

Level 1 represents the minimum security hygiene baseline for participation in the Defense Industrial Base. The 17 practices span 6 of the 14 CMMC domains and address the fundamental protections necessary to safeguard FCI from unauthorized access and disclosure. Level 1 does not require independent third-party assessment.

Level 1 practice domains and their associated safeguarding requirements:

2.3 Level 2 — Advanced

Level 2 is the most broadly applicable CMMC Level across the DIB. Virtually every contractor handling CUI, including but not limited to technical data, engineering drawings, export-controlled items, and personnel records, must meet Level 2. The 110 practices are organized across all 14 domains and are directly traceable to NIST SP 800-171 Rev 2 security requirements.

Assessment pathway determination for Level 2:

• Prioritized Acquisitions:Programs identified by DoD as having higher CUI sensitivity. C3PAO assessment required. Certificate valid for 3 years.
• Non-Prioritized Acquisitions:Self-assessment with SPRS score submission and senior official affirmation. Annual reaffirmation required.
• POA&M Allowance:Contractors may receive a conditional certification with open POA&M items, provided no critical practices are deficient. All POA&Ms must be closed within 180 days of assessment.
• Critical Practices:11 practices are designated as non-deferrable. A deficiency in any critical practice results in immediate assessment failure with no POA&M allowance.

2.4 Level 3 — Expert

Level 3 is reserved for a small subset of the DIB — those contractors whose systems process CUI associated with critical programs or technologies. The 24 additional practices from NIST SP 800-172 address enhanced security requirements designed to defend against sophisticated nation-state and APT-level threats. Level 3 assessments are conducted solely by the government with no commercial third-party involvement.

The 24 NIST SP 800-172 enhanced requirements added at Level 3 address the following security themes:

• Advanced Configuration Management:Automated mechanisms to enforce configuration baselines and detect unauthorized changes.
• Incident Response Enhancement:Organizationally defined incident response teams; cyber threat intelligence integration.
• Risk Management Rigor:Penetration testing and red team exercises; supply chain risk management programs.
• System and Communication Defense:Deception technologies; advanced traffic filtering; protected DNS services.
• Threat Hunting:Proactive, intelligence-driven threat hunting on organizational networks.
• Software Supply Chain:Verification of software provenance; integrity checking of software components.

3. Domain-by-Domain Practice Requirements

CMMC 2.0 organizes all practices across 14 security domains. Each domain maps to a corresponding NIST SP 800-171 family (Levels 1 and 2) and is extended by NIST SP 800-172 requirements at Level 3. The following domain profiles provide the practice count at each level, key technical requirements, and policy implications for IT and security practitioners.

3.1 Access Control (AC)

3.2 Audit and Accountability (AU)

3.3 Awareness and Training (AT)

3.4 Configuration Management (CM)

3.5 Identification and Authentication (IA)

3.6 Incident Response (IR)

3.7 Maintenance (MA)

3.8 Media Protection (MP)

3.9 Personnel Security (PS)

3.10 Physical Protection (PE)

3.11 Risk Assessment (RA)

3.12 Security Assessment (CA)

3.13 System and Communications Protection (SC)

3.14 System and Information Integrity (SI)

4. Assessment and Certification Process

The CMMC assessment process is the formal mechanism by which an organization’s cybersecurity practices are evaluated against the applicable CMMC Level requirements. Assessment requirements vary by level and contract designation, but all paths require formal affirmation and score submission to the Supplier Performance Risk System (SPRS).

4.1 SPRS Score Calculation

All DoD contractors subject to DFARS 252.204-7012 are required to calculate a system security score and submit it to SPRS prior to contract award. The SPRS score is a quantitative measure of compliance with NIST SP 800-171 requirements:

NIST SP 800-171 DoD Assessment Methodology scoring weights:

4.2 Level 2 Third-Party Assessment (C3PAO)

For prioritized Level 2 acquisitions, assessment must be conducted by a DoD-authorized Certified Third-Party Assessment Organization (C3PAO). C3PAOs are listed in the CMMC Marketplace (cyberAB.org) and must be authorized by the CMMC Accreditation Body (CyberAB). Assessors conducting the assessment must hold Certified CMMC Assessor (CCA) credentials.

The Level 2 C3PAO assessment process consists of the following phases:

• Pre-Assessment:Contractor submits System Security Plan (SSP), network diagrams, and supporting documentation. C3PAO performs document review.
• Assessment Execution:C3PAO conducts on-site or remote assessment activities including interviews, document review, and technical testing of implemented practices.
• Preliminary Findings:C3PAO provides draft findings. Contractor may submit additional evidence or clarification for specific findings.
• Final Assessment Report:C3PAO issues final report to the CMMC Third Party Assessment Organization (C3PAO) and submits results to the CMMC eMASS system.
• Certification Decision:DoD reviews assessment results. Conditional certification may be granted with open POA&Ms for non-critical practices, valid for 180 days pending closure.
• Certificate Validity:CMMC Level 2 certificates are valid for 3 years. Annual affirmations by a senior company official are required in years 2 and 3.

4.3 Critical Practices — Non-Deferrable Requirements

Eleven CMMC Level 2 practices are designated as critical. Deficiency in any critical practice at the time of assessment results in automatic failure with no POA&M allowance. These practices represent the minimum non-negotiable security controls required to safeguard CUI:

4.4 Plans of Action and Milestones (POA&M)

A Plan of Action and Milestones (POA&M) is a formal document that describes the corrective actions planned to remediate security deficiencies identified during an assessment. CMMC 2.0 introduced a conditional certification pathway allowing contractors to receive a Level 2 certificate while open POA&M items are resolved, subject to strict limitations.

Required POA&M elements per OMB Memorandum M-02-01 and CMMC 2.0 regulations:

• Practice Identifier:CMMC practice ID and NIST SP 800-171 requirement reference number.
• Weakness Description:Specific description of the security deficiency, including affected systems and scope.
• Point of Contact:Named individual responsible for remediation.
• Resources Required:Budget, personnel, and tooling required to implement the corrective action.
• Scheduled Completion Date:No later than 180 days from initial assessment date.
• Milestones with Completion Dates:Intermediate checkpoints demonstrating progress toward full remediation.
• Changes to Milestones:Documentation of any changes to the original milestone schedule with justification.

5. System Security Plan and Documentation Requirements

A System Security Plan (SSP) is the foundational documentation artifact required by CMMC 2.0 (via NIST SP 800-171 practice 3.12.4). The SSP describes the system boundary, the security requirements applicable to the system, and the status of implementation for each CMMC practice. It is the primary artifact reviewed during any formal CMMC assessment.

5.1 Required SSP Components

5.2 Additional Required Policy Documentation

Beyond the SSP, CMMC 2.0 assessors will review organizational policies and procedures to validate that security practices are formally defined, communicated, and maintainable. The following policy documents are routinely requested during Level 2 and Level 3 assessments:

6. CMMC Assessment Scoping

Accurate scoping is one of the most technically challenging and consequential activities in CMMC preparation. The CMMC Assessment Scope defines which assets, systems, and environments are subject to assessment. Improper scoping — either too broad or too narrow — creates either assessment risk or compliance gaps. The DoD CMMC Scoping Guidance documents provide definitive categorization of asset types.

6.1 Asset Categories

CMMC scoping guidance defines five asset categories. All assets that fall within the first three categories are in scope for CMMC assessment. Only assets in the latter two categories may be excluded from scope.

6.2 Cloud Service Provider (CSP) Scoping

Cloud environments present unique scoping challenges for CMMC. Any CSP that processes, stores, or transmits CUI on behalf of a DIB contractor is in scope for CMMC and must meet equivalent security requirements. The following CSP requirements apply:

• FedRAMP Moderate Equivalent or Higher:CSPs used to process CUI must meet FedRAMP Moderate baseline or a DoD-approved equivalent. This is a prerequisite, not a substitute for CMMC.
• Shared Responsibility Model:DIB contractors must document which CMMC practices are implemented by the CSP (inherited controls) versus those implemented by the contractor (contractor-responsible controls).
• External Cloud System Documentation:Cloud services must be identified in the SSP as external systems with interconnection security agreements and data flow documentation.
• CUI in Cloud:CUI stored in cloud environments must be encrypted at rest and in transit using FIPS-validated cryptographic modules. Contractor must control encryption keys.

7. NIST SP 800-171 / 800-172 Alignment

CMMC 2.0 achieves its technical rigor through direct alignment with NIST SP 800-171 Revision 2 (Levels 1 and 2) and NIST SP 800-172 (Level 3). Understanding this alignment is essential for practitioners performing gap assessments, writing SSPs, and preparing for formal C3PAO evaluations. Every CMMC Level 2 practice has a one-to-one correspondence to a NIST SP 800-171 security requirement.

7.1 NIST SP 800-171 Structure

7.2 NIST SP 800-172 Enhanced Practices (Level 3)

NIST SP 800-172 provides enhanced security requirements for protecting CUI associated with critical programs and high-value assets from APT-level threats. The 24 enhanced requirements are organized across 11 of the 14 families and are additive to the 110 SP 800-171 requirements. Level 3 requires implementation of all 134 practices.

8. Implementation and Compliance Roadmap

Organizations pursuing CMMC compliance should follow a structured, phased approach that prioritizes high-risk gaps, establishes foundational documentation, and systematically advances toward the required certification level. The following roadmap provides a practical framework for IT and security teams managing a CMMC readiness program.

8.1 Pre-Assessment Preparation (All Levels)

Phase 1 — Scoping and Gap Assessment (Months 1–2)

• Define Assessment Scope:Identify all assets that process, store, or transmit CUI. Classify assets using the five categories in Section 6. Document scope in the SSP.
• CUI Flow Mapping:Trace all CUI ingress and egress paths. Identify all systems, users, and processes that touch CUI. Document in data flow diagrams.
• Conduct NIST SP 800-171 Self-Assessment:Evaluate all 110 practices against current implementations. Calculate SPRS score. Document all deficiencies.
• Identify Critical Practice Gaps:Prioritize the 11 critical practices (Section 4.3). Any gap in a critical practice must be remediated before assessment.
• Develop POA&M:For all non-critical deficiencies, create POA&M entries with resource estimates and projected completion dates within 180 days.

Phase 2 — Documentation Development (Months 2–4)

• Draft System Security Plan (SSP):Complete all SSP components per Section 5.1. Map each NIST SP 800-171 requirement to specific implementations.
• Develop Supporting Policies:Create or update all policy documents in Section 5.2. Ensure policies reference CMMC/NIST practice IDs.
• Implement Awareness Training:Deploy annual security awareness training. Document completion records. Develop role-based training for privileged users.

Phase 3 — Technical Remediation (Months 3–6)

• MFA Deployment:Enable MFA for all accounts with access to CUI systems. Prioritize privileged accounts and remote access paths.
• Encryption Implementation:Enforce TLS 1.2+ on all CUI data in transit. Enable FIPS-validated encryption at rest on CUI systems and removable media.
• Audit Logging:Deploy centralized log management. Configure audit logging on all CUI systems. Establish log retention per policy (minimum 1 year recommended).
• Vulnerability Management:Establish authenticated vulnerability scanning schedule. Implement risk-based remediation SLAs (e.g., critical: 15 days, high: 30 days).
• Configuration Hardening:Apply CIS Benchmarks or DISA STIGs to all systems in scope. Disable unnecessary services, ports, and protocols.
• Endpoint Protection:Deploy and centrally manage EDR on all CUI endpoints. Enable behavioral detection. Automate signature updates.

8.2 Assessment Readiness (Months 5–6)

• Internal Mock Assessment:Conduct an internal assessment against all 110 practices. Use NIST SP 800-171A assessment procedures to validate implementations.
• Engage C3PAO:Select a DoD-authorized C3PAO from the CyberAB Marketplace. Submit pre-assessment documentation package (SSP, network diagrams, POA&M).
• Remediate Remaining Gaps:Address all critical practice deficiencies before the formal assessment. Update POA&M with current status of all open items.
• Update SPRS Score:Submit updated SPRS score reflecting post-remediation status. Ensure senior official affirmation is current.
• Incident Response Test:Conduct tabletop exercise to validate IRP. Document test results and update plan.

8.3 Post-Certification Maintenance

• Continuous Monitoring:Maintain ongoing vulnerability scanning, log review, and configuration compliance checks. Feed findings into the POA&M process.
• Change Management:Assess security impact of all changes to in-scope systems. Document changes in the SSP and notify C3PAO/DIBCAC of significant boundary changes.
• Annual Training:Refresh security awareness training annually. Update role-based training for new threats and techniques.
• Annual Affirmation:A senior company official (e.g., CISO, CIO, or CEO) must annually affirm continued compliance in SPRS.
• Incident Reporting:Report cyber incidents to DIBNet within 72 hours per DFARS 252.204-7012. Preserve forensic data for 90 days.

9. Cyber Incident Reporting Requirements

DFARS 252.204-7012 establishes mandatory cyber incident reporting requirements for all DoD contractors subject to CMMC. These requirements are independent of CMMC Level — all contractors handling CUI must comply with incident reporting obligations, regardless of whether formal CMMC certification has been achieved.

9.1 Reporting Obligations

Required reporting elements for cyber incident notifications:

9.2 Malware Submission

In addition to portal reporting, contractors must submit malicious software discovered in connection with a reported cyber incident to the DoD Cyber Crime Center (DC3) or the CERT Coordination Center (CERT/CC) for analysis. This obligation exists alongside the 72-hour reporting requirement and does not extend the reporting deadline.

10. References, Authorities, and Resources

10.1 Authoritative References

10.2 Key Program Resources

• CMMC Program Office:https://www.acq.osd.mil/cmmc/
• CyberAB (Accreditation Body):https://cyberab.org — CMMC Marketplace, C3PAO directory, CCA credential verification.
• Supplier Performance Risk System (SPRS):https://www.sprs.csd.disa.mil — Self-assessment score submission and affirmation portal.
• DIBNet Portal:https://dibnet.dod.mil — Cyber incident reporting portal per DFARS 252.204-7012.
• DoD Cyber Crime Center (DC3):https://www.dc3.mil — Malware submission and cyber intelligence sharing for DIB.
• CUI Registry:https://www.archives.gov/cui — Authoritative source for CUI category definitions and handling requirements.
• Project Spectrum (DoD):https://www.projectspectrum.io — Free CMMC readiness tools and resources for small DIB businesses.