What is CMMC? A Practitioner's Definition

Definition

CMMC, short for Cybersecurity Maturity Model Certification, is the U.S. Department of Defense framework used to verify whether defense contractors have the cybersecurity controls required for certain contracts. In practice, it determines what security standard your business must meet if you store, process, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

How it works

CMMC is not a general best-practice badge. It is a contract-driven compliance requirement tied to doing business with the DoD.

At a high level, the DoD assigns a required CMMC level to a solicitation or contract. That level depends on the sensitivity of the information involved, especially whether the contractor will handle FCI, CUI, or neither.

The model is commonly understood in three levels:

Level 1: Foundational

Level 1 applies to organizations that handle FCI but not CUI. It focuses on basic safeguarding requirements derived from FAR 52.204-21. These are baseline cyber hygiene measures such as:

• limiting access to authorized users
• identifying and authenticating users
• protecting systems from unauthorized access
• applying basic media and physical protections

For many small subcontractors, this is the first level they encounter.

Level 2: Advanced

Level 2 applies to organizations that handle CUI. This is where CMMC aligns closely with NIST SP 800-171. The expectation is that the organization implements the 800-171 security requirements and can demonstrate that those controls are operating effectively.

This level is the most relevant for manufacturers, MSPs, engineering firms, software providers, and other defense supply chain companies that touch sensitive but unclassified DoD data.

Level 3: Expert

Level 3 is intended for a narrower set of contractors supporting especially sensitive DoD programs. It builds on Level 2 with additional requirements tied to more advanced threats.

Not every defense contractor will need Level 3. Most organizations asking “Do I need CMMC?” are really trying to determine whether they fall into Level 1 or Level 2.

What “need” actually means

You do not decide on your own that you are “CMMC certified” and then shop for contracts. Instead, you encounter CMMC when:

• a solicitation includes a CMMC requirement
• a prime contractor requires its subcontractors to meet a certain level
• your organization stores, processes, or transmits FCI or CUI for DoD work
• you are preparing for future eligibility in the defense industrial base

The key operational question is: What data do we handle, where does it live, and which contract clause applies?

If your team cannot answer that, your first step is data scoping, not buying tools.

What compliance looks like in practice

For security teams and IT admins, CMMC usually turns into a series of concrete tasks:

• inventory systems in scope
• identify whether FCI, CUI, or both are present
• map current controls to the required CMMC level
• remediate gaps
• document policies, procedures, and system security plans
• prepare for self-assessment or third-party assessment, depending on contract requirements

For example, a machine shop bidding on a DoD subcontract may only need Level 1 if it receives basic contract information. A software engineering firm managing design data or technical documentation tied to defense work may need Level 2 because it handles CUI.

Technical Notes

A simple starting point is to identify systems that may contain DoD data:

# Example Windows file server review
Get-ChildItem -Path "\\fileserver\shares" -Recurse | Select-Object FullName, LastWriteTime

# Example Linux search for likely controlled data markers
grep -RniE "CUI|Controlled Unclassified|Distribution Statement|NOFORN" /srv/shared-data/

Useful logging and asset questions include:

- Which mailboxes receive DoD contract documents?
- Which SharePoint sites or file shares store drawings, specs, or purchase data?
- Which endpoints sync those files locally?
- Which vendors or MSPs have admin access to those systems?

Those basics often reveal whether your compliance scope is much larger than expected.

When you’ll encounter it

Most organizations encounter CMMC in one of four situations.

1. During DoD contract bidding

A solicitation may state that a specific CMMC level is required for award. If you cannot meet that requirement, you may be ineligible to bid or win.

2. As a subcontractor to a prime

Even if you never contract directly with the DoD, a prime contractor may flow down security obligations to you because you support their DoD program. Many smaller firms first hear about CMMC from a customer questionnaire, supplier portal, or contract amendment.

3. During internal compliance preparation

Some organizations start preparing before a contract explicitly requires CMMC because they expect future defense business. This is common for companies entering aerospace, manufacturing, logistics, or engineering supply chains.

4. While handling CUI unexpectedly

A business may discover it already has CUI in email, engineering repositories, ticketing systems, or collaboration platforms. Once that happens, leadership often realizes the issue is not theoretical. Scope, documentation, and control maturity suddenly matter.

Technical Notes

Signs you are likely to encounter CMMC soon include:

- Contract language referencing FAR 52.204-21
- Contract language referencing DFARS 252.204-7012 or related clauses
- Customer requests for NIST SP 800-171 assessment results
- Supplier security questionnaires asking about FCI or CUI handling
- Requirements for a System Security Plan (SSP) or POA&M

From a practitioner standpoint, these are early warnings to validate scope and readiness before procurement deadlines.

Related terms

FCI

Federal Contract Information is information provided by or generated for the government under contract that is not intended for public release. If you handle FCI, Level 1 may apply.

CUI

Controlled Unclassified Information is more sensitive than FCI and has formal handling requirements. If you handle CUI for DoD work, Level 2 is the term that usually matters most.

NIST SP 800-171

This is the core security standard behind much of CMMC Level 2. If your environment must protect CUI, 800-171 is the baseline control set you will spend time implementing and documenting.

FAR and DFARS

These are the Federal Acquisition Regulation and Defense Federal Acquisition Regulation Supplement clauses that drive security obligations in contracts. In practice, contract language often determines whether CMMC becomes mandatory for your organization.

SSP and POA&M

An SSP is a System Security Plan describing your environment and implemented controls. A POA&M, or Plan of Action and Milestones, tracks known gaps and remediation work. Both are standard artifacts in defense compliance preparation.

Assessment scope

This refers to the people, systems, applications, storage locations, and service providers that touch in-scope DoD information. Bad scoping is one of the fastest ways to make CMMC expensive and difficult.

The practical takeaway

CMMC is the DoD’s way of verifying that contractors have the right cybersecurity controls for the information they handle. You need it when your business supports DoD contracts involving FCI or CUI, whether directly or through a prime.

For most SMBs, the real work is not memorizing the levels. It is identifying in-scope data, narrowing the environment, implementing the required controls, and documenting evidence early enough to avoid losing contract opportunities.

For further insights on cybersecurity vulnerabilities, you can check out our articles on CVE-2026-14162 and CVE-2026-4321.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.