Resources

CMMC in plain English

CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense's program for checking that contractors protect sensitive unclassified information. If you handle Controlled Unclassified Information (CUI), such as many defense drawings and specs, it applies to you through your contracts.

The three levels

Level 1 covers basic safeguarding of Federal Contract Information: 15 practices, with an annual self-assessment. Level 2 covers CUI: the 110 security requirements of NIST SP 800-171, verified by self-assessment or, under the original rollout, by an authorized third-party assessor (a C3PAO). On 13 July 2026 DoD suspended CMMC Phase 2, including the planned 10 November 2026 start of C3PAO assessments, so for now contracts may require only Level 1 or Level 2 self-assessments. NIST SP 800-171 and DFARS 252.204-7012 still apply. This is a DoD policy suspension; the CMMC rule (32 CFR 170) has not been amended. Level 3 adds requirements for the most sensitive programs and is assessed by the government.

What you actually need for Level 2

• A defined boundary: which computers, people and places touch CUI. Shrinking it (for example, an isolated enclave) is often the cheapest control.
• A System Security Plan (SSP) that says how each of the 110 requirements is met.
• A score. The DoD method starts at 110 and subtracts 1, 3 or 5 points for each requirement not met, down to -203. Many contractors report it in SPRS.
• A Plan of Action and Milestones (POA&M) for gaps. Under the CMMC rule, only certain lower-value items may stay open, for a limited time.

Common traps

Multifactor authentication, FIPS-validated encryption, logging and log review, and controlling removable media are where small shops lose the most points. And a policy that describes something you don't do is worse than no policy.

Rules and phase-in dates change; check your contracts and current DoD guidance. This guide is general information, not legal advice. Status checked 21 Oct 2026 (source: DoD CIO). If third-party assessments return, use an authorized C3PAO. Try our free SPRS score calculator.

General guidance, not legal advice. Standards are referenced by name only. Written by Matt Norman, Norman Quality Tools (Veteran-Owned & Operated).