CMMC 2.0: What US Defence Contractors Must Know
The Cybersecurity Maturity Model Certification 2.0 is reshaping requirements for US defence supply chain participation. Here is what contractors need to understand and act on.
What CMMC 2.0 Changes
The Cybersecurity Maturity Model Certification (CMMC) programme fundamentally shifts how the US Department of Defense approaches cybersecurity requirements for its supply chain. CMMC introduces third-party verification — assessed by C3PAOs — for the most sensitive programmes. CMMC 2.0 streamlined the original five-level framework into three levels.
The Three CMMC Levels
Level 1: Foundational
Level 1 covers contractors handling only Federal Contract Information (FCI). It requires 17 practices from NIST SP 800-171 covering basic cybersecurity hygiene. Compliance is demonstrated through annual self-assessment with senior official affirmation.
Level 2: Advanced
Level 2 covers contractors handling Controlled Unclassified Information (CUI) — the category covering most sensitive defence programme information. It aligns directly with all 110 practices from NIST SP 800-171. Most Level 2 contracts require third-party C3PAO assessment every three years.
Level 3: Expert
Level 3 covers contractors supporting the most sensitive DoD programmes. It builds on Level 2 with additional requirements from NIST SP 800-172, targeting advanced persistent threats. Third-party assessment is conducted by the Defense Contract Management Agency.
The NIST SP 800-171 Practice Domains
The 110 practices across 14 domains include: Access Control (22 practices), Awareness and Training (3), Audit and Accountability (9), Configuration Management (9), Identification and Authentication (11), Incident Response (3), Maintenance (6), Media Protection (9), Personnel Security (2), Physical Protection (6), Risk Assessment (3), Security Assessment (4), System and Communications Protection (16), and System and Information Integrity (7).
Preparing for CMMC Assessment
Gap assessment against NIST SP 800-171. Most contractors have significant gaps. The DoD's data from self-assessment scores suggests the average contractor achieves well below full compliance.
System Security Plan (SSP). Documenting the security environment, implemented practices, and rationale for any practices not implemented. The SSP is the primary evidence document for CMMC assessors.
Plan of Action and Milestones (POA&M). Documenting known gaps with remediation plans, responsible owners, and target dates.
C3PAO engagement. For Level 2 contracts requiring third-party assessment, engaging a C3PAO early — months before contract award requirements — enables pre-assessment gap identification and remediation. Organisations that wait until the contract requirement is imminent face compressed remediation timelines.
Supply chain consideration. If you subcontract any scope involving CUI flow-down, your subcontractors may also have CMMC requirements. Understanding your full CUI data flow is essential.