CMMC (Cybersecurity Maturity Model Certification) is the US Department of Defense program that requires its contractors to certify against a set of cybersecurity controls drawn from NIST 800-171 and NIST 800-172. It has three levels and a phased rollout under DFARS clause 252.204-7021. The final DFARS rule took effect November 10, 2025.
What are the three CMMC levels?
CMMC has three levels. Level 1 covers 17 basic controls for FCI. Level 2 covers all 110 NIST 800-171 r2 requirements. Level 3 adds 800-172 controls.
Levels 1 and 2 use self-assessment or annual third-party audit by a C3PAO depending on the contract. Level 3 requires a government-led DIBCAC assessment (DoD CIO CMMC alignment).
When does CMMC apply to new DoD contracts?
The DoD published the final DFARS rule on September 10, 2025. It took effect November 10, 2025 and phases in across new contracts over four years.
The phased schedule, per the Federal Register notice, runs Phase 1 (self-assessment) starting Nov 10, 2025; Phase 2 (Level 2 C3PAO certification at award) Nov 10, 2026; Phase 3 (Level 3 at award, certification at option exercise) Nov 10, 2027; Phase 4 (full implementation) Nov 10, 2028.
Who has to get CMMC certified?
Defense contractors and subcontractors that handle Federal Contract Information at Level 1, or CUI at Level 2, are in scope.
The clause flows down through the supply chain, so a SaaS or service supplier that touches a defense prime's CUI inherits the same level. Most teams over-invest in tooling for the assessment itself and under-invest in scoping the CUI boundary cleanly, which drives the eventual audit cost. NIST 800-171 is the control catalog the audit tests against, and NIST CSF 2.0 is the strategy layer most contractors map alongside.
Related terms
These adjacent terms describe the control catalog CMMC certifies against and the contract clauses that carry CMMC obligations to defense suppliers.
- NIST 800-171 - the control catalog CMMC Level 2 audits against
- NIST CSF 2.0 - the strategic framework most defense contractors map alongside CMMC
- DFARS 252.204-7012 - the safeguarding clause that flows 800-171 to defense contractors
- C3PAO - a CMMC Third-Party Assessment Organization authorized to audit Level 2