What Is CMMC? What It Stands For and How It Works
By Shaheer Malik · Updated Oct 28, 2026
CMMC stands for Cybersecurity Maturity Model Certification. It is the Department of Defense program that checks whether defense contractors protect two kinds of information on their own systems: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The rules are in 32 CFR part 170, and a DoD contract can require a CMMC status before award.[1]
What CMMC means in practice
The program applies to “all DoD contract and subcontract awardees that will process, store, or transmit information, in performance of the DoD contract, that meets the standards for FCI or CUI on contractor information systems.”[1] When a solicitation names a CMMC level, contracting officers must check the Supplier Performance Risk System (SPRS) and may not award to an offeror without a current status at that level.[4]
The DFARS calls CMMC “a framework (see 32 CFR part 170) for assessing a contractor's information security protections.”[4] It does not invent new controls: Level 1 uses the 15 basic safeguarding requirements of FAR 52.204-21, Level 2 the 110 requirements of NIST SP 800-171 Rev. 2, and Level 3 adds 24 requirements selected from NIST SP 800-172.[1]
The three levels at a glance
| Level | Protects | Requirements | Assessed by |
|---|---|---|---|
| Level 1 | FCI | 15 | You, every year |
| Level 2 | CUI | 110 | You or a C3PAO, every three years |
| Level 3 | CUI on priority programs | 110 + 24 | DCMA DIBCAC, every three years |
Where CMMC came from
The first version arrived through a DFARS interim rule effective November 30, 2020. After about 750 public comments, DoD began an internal review in March 2021 and in November 2021 announced a revised program, which cut the model from five levels to three and allowed self-assessments.[2] That revision, often called CMMC 2.0, became the final program rule, effective December 16, 2024; the DFARS rule that puts it into contracts took effect November 10, 2025.[2][3] See CMMC 2.0 explained.
Where it stands now
Phase 1 has applied since November 10, 2025. The Department of War Chief Information Officer suspended the Phase 2 move to third-party certification on July 13, 2026, and on September 3, 2026 a class deviation wrote that suspension into the DFARS: contracts may require Level 1 (Self) or Level 2 (Self), baseline compliance with NIST SP 800-171 Rev. 2 under DFARS 252.204-7012 still applies, and the November 2026 Phase 2 transition is suspended.[5] A reform task force has made recommendations that the department has not yet published; Federal News Network reported on a summary it obtained.[6] The CMMC timeline tracks every date.
Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.
FAQ
What does CMMC stand for?
Cybersecurity Maturity Model Certification. It is the Department of Defense program, set out in 32 CFR part 170, for assessing how defense contractors protect Federal Contract Information and Controlled Unclassified Information.
Is CMMC a law?
It is a federal regulation (32 CFR part 170) that reaches contractors through DFARS contract clauses. It applies when a DoD contract or subcontract includes a CMMC requirement.
Who runs CMMC?
The DoD Chief Information Officer’s office oversees the program. The Accreditation Body (the Cyber AB) authorizes C3PAOs, which assess Level 2; DCMA DIBCAC assesses Level 3.
Is CMMC the same as NIST SP 800-171?
No. NIST SP 800-171 is the set of security requirements; CMMC is the program that verifies them. CMMC Level 2 uses exactly the 110 requirements of NIST SP 800-171 Rev. 2.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)
- DFARS: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041), 90 FR 43560 (Sep 10, 2025) (checked Oct 16, 2026)
- Class Deviation 2026-O0025, Revision 3, Attachment 1: revised DFARS part 240 (Sep 3, 2026) (checked Oct 28, 2026)
- Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)
- Federal News Network: RFI offers path forward for DoD with CMMC (Jason Miller, Oct 27, 2026) (checked Oct 28, 2026)
More on cmmc basics
- CMMC Timeline: Phases, Dates and the Phase 2 Suspension
- What Is CMMC Certification? Levels, Costs and Who Needs It
- What Is CMMC Compliance? Compliant vs Certified
- CMMC 2.0 Explained: What Changed and When It Applies
- Who Needs CMMC Certification? Primes, Subs and Suppliers
- Is CMMC Going Away? The Phase 2 Pause Explained
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.