Menu
Key facts
- Controls
- Level 1: 17 practices (FAR 52.204-21). Level 2: 110 practices (NIST SP 800-171 Rev 2). Level 3: 110 plus 24 enhanced from NIST SP 800-172.
- Recertification cycle
- 3-year certification (Level 2 C3PAO; Level 3 DIBCAC)
- Ongoing oversight
- Annual self-affirmation in the Supplier Performance Risk System (SPRS)
- Public registry
- Cyber AB CMMC Marketplace ↗
- Common gap categories
- Access control (AC); Configuration management (CM); System and communications protection (SC); Audit and accountability (AU); Incident response (IR); Media protection (MP)
- Related standards
What is CMMC?
CMMC (Cybersecurity Maturity Model Certification) is a mandatory US Department of Defense certification for contractors in the Defense Industrial Base that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). It has three levels: Level 1 is self-assessed annually, Level 2 requires a third-party assessment by a DoD-authorized C3PAO firm, and Level 3 requires a government-led DIBCAC assessment. The final rule (32 CFR Part 170) took effect December 16, 2024.
Is CMMC a certification or an attestation?
CMMC issues a certification with a Certificate of CMMC Status. Level 1 is self-assessed (annual affirmation in SPRS). Level 2 requires a C3PAO-led third-party assessment (valid 3 years). Level 3 requires a government-led DIBCAC assessment on top of Level 2.
Who needs CMMC?
Mandatory for any company in the US Defense Industrial Base (DIB) bidding on DoD contracts that involve CUI. Phase 1 (self-assessments) began in early 2025; Phase 2 (C3PAO requirements written into contracts) begins November 2026.
What does CMMC cost and how long does it take?
Level 1 (self): $5K–$30K over 1–3 months. Level 2 (C3PAO): $100K–$500K total over 6–18 months (the assessment fee itself is $35K–$75K; the rest is remediation, tooling, documentation). Level 3 (DIBCAC): $200K+ / 18+ months.
Phase 2 contract requirements only hit solicitations from late 2026 onward. Buyer urgency messaging should reflect this timeline rather than imply CMMC is universally enforced today.