Also known as: Cybersecurity Maturity Model Certification · CMMC compliance · CMMC certification · CMMC 2.0
The Department of Defense's framework for assessing a contractor's compliance with the security requirements that protect sensitive government data.
Per DFARS 252.204-7021, "The Cybersecurity Maturity Model Certification (CMMC) is a framework for assessing a contractor's compliance with applicable information security protections (see 32 CFR part 170)." The current program — commonly called CMMC 2.0 and codified in 32 CFR part 170 (effective December 16, 2024) — streamlined the original five-tier model into three levels. Eligibility for many DoD contracts now ties to a verified "CMMC status" at Level 1, 2, or 3 for the contractor information systems used in performance that "process, store, or transmit" Federal Contract Information (FCI) or Controlled Unclassified Information (CUI): Level 1 is an annual self-assessment against the 15 basic safeguarding requirements of FAR 52.204-21; Level 2 requires meeting the 110 requirements of NIST SP 800-171 Revision 2 (self-assessment for some programs and, under the codified rule, third-party (C3PAO) certification for others); and Level 3 adds a subset of NIST SP 800-172 controls and is assessed by the government (DIBCAC). Contractors must "have and maintain for the duration of the contract a current CMMC status," complete annual affirmations of continuous compliance in DoD's Supplier Performance Risk System (SPRS), and flow the requirement down to subcontractors. As of 2026, the Department suspended the planned expansion to Level 2 (C3PAO) and Level 3 (DIBCAC) designations, so only self-assessment paths are currently being designated; confirm the operative requirement in each solicitation or contract.
Source: CMMC Program Rule — 32 CFR Part 170 (eCFR)
CMMC 2.0 is the current version of the program, codified in 32 CFR part 170 (effective December 16, 2024). It streamlined the original five maturity levels into three (Level 1 self-assessment, Level 2 aligned to NIST SP 800-171, Level 3 aligned to NIST SP 800-172).
Compliance means actually meeting the required security controls (e.g., the 110 requirements of NIST SP 800-171 Revision 2 for Level 2). Certification is the assessment-and-affirmation step that establishes your CMMC status: under the codified rule a third-party assessor (C3PAO) performs the Level 2 certification assessment where one is designated, Level 1 is self-assessed, and Level 3 is assessed by the government (DIBCAC). As of 2026, new Level 2 (C3PAO) and Level 3 (DIBCAC) designations are suspended, so status is being established through self-assessment and annual affirmation.
It depends on the data your DoD contract involves: Level 1 (basic, annual self-assessment) for Federal Contract Information, and Level 2 or 3 (with third-party or government assessment) for Controlled Unclassified Information. The required level is specified in the contract.
Yes. Prime contractors must flow CMMC requirements down to subcontractors that handle FCI or CUI, so even small suppliers in the defense supply chain can be required to hold a CMMC status.
Definitions are educational and may be modified by your specific policy language, endorsements, and state rules. For regulatory guidance, refer to the California Department of Insurance or the NAIC.
Reviewed and maintained by RiskCube's licensed brokerage team.