The Cybersecurity Maturity Model Certification (CMMC) establishes cybersecurity processes, practices, and requirements to safeguard sensitive and unclassified information shared by the Department of Defense (DoD) and its contractors and subcontractors. Specifically, it aims to protect the Defense Industrial Base (DIB) from more complex cyberattacks.
The CMMC 2.0 certification was launched in November 2021, and all DoD contractors and subcontractors must meet all their CMMC requirements by 2025 to bid for new contracts or continue their business with the Department.
This article discusses how to get CMMC certified and everything you need to know to become CMMC compliant.
🥷 Keep yourself updated with the latest IT news with the NinjaOne weekly newsletter.
What is CMMC?
CMMC, which is not the same as the CCSK, stands for the Cybersecurity Maturity Model Certification, a new standard that applies to all contractors and subcontractors of the Department of Defense (DoD). The new certification was designed as a cybersecurity framework to assure the protection of sensitive unclassified information and guard against supply-chain-style attacks by cybercriminals.
The CMMC ensures that DoD suppliers and contractors protect sensitive information and maintain a strong cybersecurity posture. It builds upon existing standards and practices, including the NIST SP 800-171 and NIST SP 800-53.
What is CMMC 2.0 model?
CMMC 2.0 is the next iteration of the initial cybersecurity model. Whereas the 1.0 model featured a five-level rating system, with each level progressively getting harder and more expensive, the 2.0 program streamlines these requirements to three levels.
- Level 1 is required for organizations working with Federal Contract Information (FCI) and only requires basic cybersecurity strategies as defined in FAR 52.204-21, “Basic Safeguarding of Covered Contractor Information Systems.” This level generally focuses on physical access control, risk management, and system integrity.
- Level 2 is required for organizations working with Controlled Unclassified Information (CUI) and complies with the 110 security controls defined in NIST 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.” This level typically covers cybersecurity incident response and all other requirements stated in Level 1.
- Level 3 is the highest compliance level, intended for organizations working with CUI and targeted by Advanced Persistent Threats (APT). It requires compliance with NIST 800-172, “Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171,” and includes proactive strategies to detect and remediate threats before they offer any organizational impact. As such, Level 3 also includes sophisticated detection and mitigation abilities and has system hardening requirements.
Remember that CMMC levels build off one another. Thus, you need to complete Level 1 to reach Level 2, and so on.
The updated structure also greatly simplified the goals to be:
- Safeguarding sensitive and military information.
- Enforcing DIB cybersecurity standards to meet evolving threats.
- Ensure accountability with CMMC compliance.
- Building a culture of cybersecurity and cyber resilience.
- Maintaining high public trust through professional and ethical standards.
CMCC 1.0 vs. 2.0
While both programs are essentially the same in protecting controlled unclassified information, the 2.0 program made several key changes, which can be described as:
| Assessments | CMCC 1.0 | CMCC 2.0 |
| 5 increasingly progressive levels from Basic to Advanced. | 3 increasingly progressive levels.
|
|
| Levels 2 and 4 are transition stages between levels 1, 3, and 5. |
- More streamlined model. CMMC 2.0 only has three compliance levels compared to the previous model’s 5. Additionally, CMMC 2.0 is more closely aligned with NIST cybersecurity models.
- Improved reliable assessments. CMMC 2.0 allows all companies at Level 1 and a subset of businesses at Level 2 to demonstrate compliance through self-assessments, resulting in higher accountability.
- Flexible implementation. CMMC 2.0 allows companies to create their own Plans of Action and milestones (POA&Ms) within specified circumstances. It also enables the Government to waive the inclusion of CMMC requirements, given special conditions.
Why did the DoD make the CMMC 2.0 program?
After the launch of CMMC 1.0, DoD representatives received feedback from relevant stakeholders. Most comments about the 1.0 model concerned its current cost, how to increase trust in the CMMC assessment ecosystem, and clarifying and aligning its requirements with other federal and commonly accepted standards.
Who needs CMMC certification?
Any organization handling FCI or CUI must achieve CMMC certification at the level specified in its contract. If it does not have a contract yet, it is recommended that you apply for the level that best suits its current capabilities.
Take note that if you have a DFARS 7012 clause, you are subject to CMMC requirements.
What does CMMC mean for MSPs?
CMMC compliance for managed service providers (MSPs) working with DoD-connected clients may become a requirement, and they should develop a plan for meeting the requirements laid out in CMMC Level 1. Doing so will allow the client’s business to continue running smoothly and improve the overall security of non-DoD-connected clients. Many of the requirements of CMMC Level 1, like the ability to provide security assessments and awareness training, can be valuable services to include in your Managed Services Agreement (MSA).
For MSPs engaged with other parts of the federal and local government, some level of CMMC compliance may also become the new standard for public agencies. With the increasing rate of company breaches and the demand for cybersecurity services, CMMC can serve as a useful guide to identify a pathway for growing the business. CMMC was also developed in partnership with European countries like Switzerland and the UK, suggesting the possibility of an international cybersecurity standard and new growth opportunities.
When will CMMC become mandatory in contracts?
The Cybersecurity Maturity Model Certification Requirements (otherwise known as DFARS 252.204-7021) were published in January 2024 and described its implementation and inclusion in contracts by March 2025. Keep in mind that CMMC 2.0 is not (and will not be) a contractual requirement until the DoD completely implements and codifies the program.
That said, experts highly encourage organizations, contractors, and relevant MSPs to start their CMMC requirements as soon as possible.
Do I still need to comply with CMMC 1.0 now that CMMC 2.0 has been published?
Once CMMC 2.0 is codified in DFARS, the DoD will require all companies to adhere to the revised CMMC framework.
Currently, CMMC 1.0 is only required in select pilot contracts, as approved by the Office of the Under Secretary for Acquisition and Sustainment (OUSD (A&S))
How do I know what certification level I need?
Most contracts will require only Level 1 certification, so this is an important first step all DoD contractors and subcontractors should take. Beyond that, new contracts will indicate the CMMC Level required.
How much does CMMC cost?
It is estimated that meeting CMMC Level 1, the lowest standard, will cost $3,000 to maintain every year.
From there, the cost for each subsequent level substantially increases. On average, the Department of Defense states that the cost of CMMC Level 2 is $100,000, at minimum. This number can increase, depending on other factors, such as self-assessment and whether outside expertise will be needed.
What are the CMMC level requirements?
CMMC 2.0 requirements are heavily influenced by NIST standards and guidelines. We can summarize these requirements as follows:
| Level | Requirements | Assessment | Description |
| 1 | Meets 15 requirements in SP 800-171 | Annual self-assessment | Create and maintain:
|
| 2 | Meets Level 1 requirements and 110 standards determined by a third-party assessment. | Third-party assessment every three years. | Monitor and control:
|
| 3 | Must exceed 110 SP 800-171 requirements and Level 1 and 2 compliance. | Triennial assessments conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) | Implement and maintain:
|
How do I get CMMC certified?
- Conduct a self-assessment using NIST 800-171 standards.
- Create a plan of action and milestones (POA & Ms) based on your score from the self-assessment. Attempt to achieve the maximum score of 110.
- Submit the score to the DoD’s Supplier Performance Risk System (SPRS).
- Identify the scope of your services. Take note that Cyber-AB, the official accreditation body of the CMMC ecosystem, has only released the assessment guide for CMMC 2.0, Levels 1 and 2.
- Schedule a preliminary gap assessment by a third-party organization to identify gaps in your information security process. This step is optional, but recommended.
- Fix any identified security gaps found in step 5.
- Use the Cyber-AB marketplace to find a C3PAO like NSF-ISR to schedule your CMMC assessment.
- Undergo the CMMC assessment.
- Phase 1 includes the pre-assessment planning, identifying assessment team members, and developing a rough order of magnitude.
- Phase 2 covers the actual C3PAI assessment. It includes an analysis and review of objective evidence related to CMMC practices.
- Phase 3 is the post-assessment reporting, including a quality assurance review and any recommendations.
- Phase 4 may require remediation if your organization does not meet certain CMMC requirements. Typically, there is a 90-day timeframe to address any shortcomings.
- Receive your CMMC certification.
Remember that companies cannot submit their self-assessment for CMMC at the highest levels. Instead, third-party agencies conduct an unbiased audit and identify your organization’s security maturity level.
A managed services provider or third-party assessment organizers (C3PAOs) can help you better understand the CMMC framework and what improvements can be made to make the certification process easier
How NinjaOne helps IT pros get ahead of CCMC
Ensuring your services can be delivered through the cloud to accelerate CMMC compliance efforts and reduce costs. By leveraging cloud tools, IT pros can provide many CMMC practices that improve cybersecurity for the whole organization and mitigate risks.
Cloud-based remote monitoring and management software, such as the one offered by NinjaOne, can serve as important pieces in the cybersecurity toolchain. Not only can they accelerate the detection of vulnerabilities and management of security, but the tools can also be leveraged to coordinate and organize many core security functions, such patch management and antivirus.
Frequently Asked Questions (FAQs)
-
Do contractors and subcontractors need to maintain the same CMMC level?
Yes, but only if both groups handle the same type of FCI and CUI. In most cases, the primary flow of sensitive data decreases along the supply chain. As such, contractors usually have a lower CMMC level.
-
Does my organization still need to be certified if it does not handle CUI?
Always refer to your contract with the Department of Defense. For the most part, if your organization processes, stores, or handles CUI in any way, you must have at least a Level 1 CMMC certification.
-
Who is responsible for managing CMMC inside the company?
There is no specific rule about who should manage your CMMC certification. Your leadership should clearly define the roles and responsibilities of maintaining your cybersecurity hygiene.
-
How will CMMC apply to non-US companies?
The DoD will continue to engage with international partners and apply necessary cybersecurity standards as needed.
-
What is the difference between CMMC and NIST 800-171?
While both frameworks improve your organization’s cybersecurity posture, CMMC is for any organization that deals with public information and adds more protocols based on NIST.
