In a nutshell
CMMC is the US Department of Defense's framework that requires contractors to prove their cybersecurity maturity before winning DoD work. It builds on NIST SP 800-171.
The case for action
Why your organisation needs CMMC
The upside
What your organisation gains
Stay eligible for DoD contracts and flow-down work from primes.
Avoid False Claims Act exposure and contract termination.
Build a defensible, audit-ready security posture for CUI.
Open doors to higher-value federal opportunities.
Scope
Who it covers — and where
Who it applies to
Every company in the Defense Industrial Base — primes, subcontractors, and suppliers — even if you only sell screws or software to a DoD supplier.
Where it applies
United States — applies to any company in the DoD supply chain worldwide.
Timing
When you need to act
Phased rollout began in 2025 and ramps through 2028. Check your contract for the required level (1, 2 or 3) and the assessment deadline.
The path forward
Your roadmap to compliance
A practical journey — not a bureaucratic checklist. Tackle these stages in order and you'll move from "we should look into this" to ready.
- 1
Determine your CMMC Level (1, 2 or 3) from your contract clauses (DFARS 252.204-7021).
- 2
Define your scope — only the systems handling FCI or CUI need to be assessed.
- 3
Run a self-assessment against the relevant NIST 800-171 controls.
- 4
Close gaps: MFA, encryption, FIPS-validated crypto, incident response, training.
- 5
Document a System Security Plan (SSP) and Plan of Action & Milestones (POA&M).
- 6
Engage a C3PAO (for Level 2+) and book a formal assessment.
Reality check
Common struggles (and how to fix them)
The struggle
Confusion over what counts as CUI vs FCI.
The fix
Ask your prime for the marking guide and isolate CUI to a small, well-controlled enclave.
The struggle
Cloud tools aren't FedRAMP-aligned.
The fix
Move CUI workloads into GCC High or a FedRAMP Moderate-equivalent environment.
Quick answers
Frequently asked questions
Need a head start on CMMC?
Use our ready-to-go tools and templates to skip the blank page.
Browse the storeRate this guide
Be the first to rate.