CMMC, read like a drawing: what each line means.

The rule, in one paragraph.

The Cybersecurity Maturity Model Certification is a Department of War program, written into regulation as 32 CFR Part 170 and in force since December 16, 2024. It checks that the companies holding the Department's information protect it to the standard the contract names. The standard is not new. For Level 2 it is NIST SP 800-171 Rev 2, which DFARS 252.204-7012 has required of contractors holding covered defense information since 2017. CMMC adds the check: an assessment, a posted score and a signed affirmation.

Six terms your prime will use as if you already know them.

FCI

Federal Contract Information. Information the government gives you or you create for it under a contract, not meant for public release. A purchase order and its delivery schedule are FCI.

CUI

Controlled Unclassified Information. Information the government has to protect by law or policy, marked under 32 CFR Part 2002. Drawings, specifications, technical data packages and export-controlled information from a defense program are the usual CUI in a shop.

SPRS

The Supplier Performance Risk System, the Department's portal where your self-assessment score is posted and where a prime or a contracting officer reads it.

SSP

The System Security Plan. The document that describes your scope and says how each requirement is met. Requirement CA.L2-3.12.4 makes it mandatory, and it is the first thing an assessor asks for.

POA&M

The Plan of Action and Milestones. The list of requirements not yet met, who closes each one, and by when. A Level 2 plan of action closes within 180 days of the assessment.

C3PAO

A CMMC Third-Party Assessor Organization, a firm accredited to conduct Level 2 certification assessments when a contract requires one.

Three levels. The contract names yours.

• LEVEL 1

  You hold FCI and nothing more. 15 basic safeguards from FAR 52.204-21. You assess yourself every year, post the result in SPRS, and a senior official affirms it.

• LEVEL 2

  You hold CUI. The 110 requirements of NIST SP 800-171 Rev 2 in 14 families, checked against 320 objectives in NIST SP 800-171A. Self-assessment, or a certified assessor when the contract says so. This is where most small suppliers with drawings on the floor land.

• LEVEL 3

  The most sensitive programs. Everything in Level 2 plus 24 enhanced requirements from NIST SP 800-172, assessed by the government's own assessors. A small group of contractors, and not the subject of this site.

The 14 families, and what each one is really about.

• 22Access ControlWho can get at CUI, from where, and what they can do with it.
• 3Awareness and TrainingPeople know what CUI is and how to handle it, and you can prove they were told.
• 9Audit and AccountabilityLogs that show who did what, kept long enough to matter.
• 9Configuration ManagementMachines are set up the same way on purpose, and changes are controlled.
• 11Identification and AuthenticationEvery person is a named account, and a password alone is not enough.
• 3Incident ResponseYou can detect, handle and report a problem. DFARS 252.204-7012 gives you 72 hours to report a cyber incident to the Department.
• 6MaintenanceRepairs and service, including off-site repair, do not leak CUI.
• 9Media ProtectionDrives, paper and backups holding CUI are marked, controlled and destroyed properly.
• 2Personnel SecurityPeople are screened before access, and access ends when they leave.
• 6Physical ProtectionThe building, the room, the visitor log.
• 3Risk AssessmentYou look for weaknesses on a schedule and fix what you find.
• 4Security AssessmentThe SSP, the plan of action, and checking your own controls still work.
• 16System and Communications ProtectionThe network boundary, encryption, and keeping CUI traffic separate.
• 7System and Information IntegrityPatching, malware protection, and watching for trouble.

Access Control and System and Communications Protection together hold 38 of the 110 requirements. That is why the first step on this site is scope: the fewer machines that touch CUI, the fewer places those 38 have to be true.

Questions owners ask first.