CybersecurityNearMe.aiApply for a Grant
MenuClose
Find a Provider
In-Kind Grants
Learn
AboutContact
Apply for a Grantinfo@cybersecuritynearme.ai

CMMC

What is CMMC and Why Your Business Needs It

Understanding CMMC certification requirements for defense contractors. A complete guide to the Cybersecurity Maturity Model Certification and what it means for your DoD contracts.

February 20, 20268 min read

The three CMMC levelsLevel 1, Foundational: Federal Contract Information, 15 requirements, annual self-assessment. Level 2, Advanced: Controlled Unclassified Information, 110 practices, self-assessment or third-party assessment depending on the contract. Level 3, Expert: the most sensitive programs, more than 110 practices, government-led assessment.1LEVEL 1, FOUNDATIONALYou handle FederalContract Information15 requirements from FAR52.204-21. You check your ownwork once a year.2LEVEL 2, ADVANCEDYou handle ControlledUnclassifiedInformation110 practices from NIST SP800-171. Self-assessment or athird-party assessor, dependingon the contract.3LEVEL 3, EXPERTYou work on the mostsensitive programsMore than 110 practices, basedon NIST SP 800-172. Thegovernment runs the assessment.The three CMMC levelsLevel 1, Foundational: Federal Contract Information, 15 requirements, annual self-assessment. Level 2, Advanced: Controlled Unclassified Information, 110 practices, self-assessment or third-party assessment depending on the contract. Level 3, Expert: the most sensitive programs, more than 110 practices, government-led assessment.1LEVEL 1, FOUNDATIONALYou handle FederalContract Information15 requirements from FAR 52.204-21.You check your own work once a year.2LEVEL 2, ADVANCEDYou handle ControlledUnclassified Information110 practices from NIST SP 800-171.Self-assessment or a third-partyassessor, depending on the contract.3LEVEL 3, EXPERTYou work on the mostsensitive programsMore than 110 practices, based on NISTSP 800-172. The government runs theassessment.

The Cybersecurity Maturity Model Certification (CMMC) is a unified standard for implementing cybersecurity across the Defense Industrial Base (DIB). If your business works with the Department of Defense, understanding CMMC is critical to maintaining and winning federal contracts.

CMMC 2.0 Framework Overview

CMMC 2.0 streamlines the original framework into three levels:

Level 1, Foundational: 15 basic safeguarding requirements from FAR 52.204-21. Annual self assessment required.

Level 2, Advanced: 110 practices aligned with NIST SP 800-171. Met through a self-assessment or a C3PAO third party assessment, depending on the contract. On July 13, 2026 the Department of War suspended CMMC Phase II; during the review it enforces NIST SP 800-171 through self-assessments and select government-led assessments (DoD CIO).

Level 3, Expert: 110+ practices based on NIST SP 800-172. Government led assessments required.

Who Needs CMMC Certification?

Any company that processes, stores, or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as part of a DoD contract will need CMMC certification. This includes:

  • Prime contractors
  • Subcontractors at all tiers
  • Cloud service providers handling DoD data
  • Managed service providers supporting DoD contractors

The CMMC Gap Assessment Process

Before pursuing certification, most organizations benefit from a CMMC Gap Assessment, a thorough evaluation of your current cybersecurity posture against CMMC requirements. This assessment identifies gaps that need to be remediated before a formal certification assessment.

Last reviewed:

Ready to close your cybersecurity gap?

Start with a grant application if budget is the blocker, or talk to a specialist if you are ready to buy.

Apply for an in-kind grantContact us

Or email info@cybersecuritynearme.ai