Cybersecurity Maturity Model Certification
Achieve Compliance, Secure Your Future
What is the Cybersecurity Maturity Model Certification (CMMC)?
The Cybersecurity Maturity Model Certification (CMMC) is based on the NIST SP 800-171 framework, established to protect Controlled Unclassified Information (CUI) in nonfederal systems. Since 2016, the DoD has used NIST 800-171, but voluntary compliance has proven insufficient. In response, the DoD created CMMC to bring greater standardization and accountability to cybersecurity across the Defense Industrial Base (DIB). By achieving CMMC certification, your organization ensures it meets the required standards to protect sensitive CUI.
Who Needs to be CMMC Certified?
If your organization is part of the DIB and handles CUI, you will most likely need to obtain CMMC certification to qualify for DoD solicitations. The DOD will begin to include CMMC requirements in contracts starting in 2026. This requirement applies to prime contractors, subcontractors, and suppliers involved in the DoD supply chain. The DoD will determine the CMMC level required for each contract and will continue with a phased approach until all contracts include these requirements.
CMMC Level 1 is for contracts that only include Federal Contract Information (FCI) and involves an annual self-assessment attested to by a senior company official. CMMC Level 2 typically requires certification by a CMMC Third Party Assessment Organization (C3PAO), though some contracts may accept a CMMC Level 2 self-assessment attested to by a senior company official. CMMC Level 3, is reserved for the most critical defense programs, and requires a government-led CMMC Level 3 certification.
Why is CMMC Certification Important?
CMMC certification is your key to staying competitive in the defense industry. Without it, your organization risks losing eligibility to bid on or maintain DoD contracts. As a member of the DIB, your organization is a potential target for malicious actors, including ransomware gangs, foreign adversaries, and insider threats. Achieving CMMC compliance not only helps prevent these threats from impacting your organization but also ensures you meet the necessary cybersecurity requirements for contractual eligibility.
It’s also important to understand the legal risks associated with self-assessments. Misrepresenting compliance can lead to prosecution under the False Claims Act, which offers whistleblower protections and financial incentives for reporting non-compliance. By pursuing CMMC certification through a C3PAO, your organization demonstrates its commitment to robust cybersecurity practices, safeguarding both your operations and your reputation.
Strengthen your cybersecurity with CMMC certification.
Experience. The Difference.
Achieve Compliance with CMMC Certification
Choosing the right C3PAO is critical to the certification process. C3PAOs must meet strict requirements, including CMMC Level 2 certification and impartiality, and we maintain these high standards to provide you with a reliable evaluation. Our team is dedicated to providing clear communication and transparency throughout the assessment.
For organizations performing self-assessments, we offer mock assessments without consultation. Assessments are tailored to your needs, whether you require a comprehensive review or a focused assessment of specific controls. This independent evaluation helps you understand your cybersecurity posture and provides feedback on whether you meet or do not meet the control objectives included within the mock assessment.
Industry Involvement
CMMC Frequently Asked Questions
CMMC Level 2 is intended for organizations that process, store and transmit Controlled Unclassified Information (CUI) and requires implementation of all 110 security requirements from NIST SP 800-171. In contrast, Level 1 only includes 17 basic safeguarding requirements for Federal Contract Information (FCI).
Yes, most organizations seeking Level 2 certification must undergo a third-party assessment conducted by a CMMC Third-Party Assessment Organization (C3PAO). However, some contracts may only require a CMMC Level 2 self-assessment with affirmation. The Affirming Official shall submit a CMMC affirmation attesting to continuing compliance with all requirements of the CMMC Status Level 2 (Self).
The duration can vary depending on the scope of the environment, type of implementation, number of physical locations and amount physical controlled unclassified information (CUI). Typically, the assessment will cover a three-to-six-week time period. This includes the pre-assessment, assessing conformity of the security requirements and completing and reporting the assessment results. There is usually one week dedicated to interviews during the assessment of conformity.
Key steps include identifying the scope and boundaries, conducting a gap analysis against NIST SP 800-171, documenting a system security plan (SSP) performing a self-assessment. It is recommended that your chosen C3PAO is engaged to perform a Level 2 mock assessment several months prior to the Level 2 Certification assessment.
Once granted, CMMC Level 2 certification is valid for three years, with annual affirmations required to ensure continued compliance.
You’ll need comprehensive documentation, including a System Security Plan (SSP), network diagrams, asset inventories, controlled unclassified information (CUI) data flow diagram, self-assessment with Met/Not Met and explanation for all 320 security requirements, policies, procedures, and supporting evidence of implementation of the security requirements.
Any contractor or subcontractor in the Defense Industrial Base that processes, stores, or transmits Controlled Unclassified Information (CUI) will typically need to meet CMMC Level 2 requirements. The DoD contract will specify the CUI and the CMMC compliance requirements.
A CMMC Third-Party Assessment Organization (C3PAO) is an authorized assessor that assesses your organization’s CMMC Level 2 implementation and verifies whether you meet the CMMC Level 2 requirements before issuing a final or conditional CMMC Level 2 certification.
Yes, but the cloud service provider (CSP) must also meet FedRAMP Moderate (or equivalent) requirements if they process, store, or transmit controlled unclassified information (CUI). If they process store or transmit security protection data (SPD) without CUI and are in scope for the assessment, they are assessed as a security protection asset (SPA).
If your organization fails, you will receive a report of Met, Not Met, or N/A for all 320 security requirements. If a security requirement is Not Met, the report will include a clear explanation of why the security requirement was Not Met. You will be required to engage a C3PAO and go through the entire CMMC Level 2 Certification assessment process again. M&A recommends that you engage your selected C3PAO to perform a Mock Assessment of selected control objectives as part of preparation for the Level 2 Certification Assessment.
C3PAOs are forbidden from consulting on CMMC implementation and conducting the CMMC assessment for the same organization. A C3PAO can consult if they are not doing the assessment. A Registered Practitioner Organization (RPO) should be engaged to assist with CMMC implementation. We also recommend engaging your selected C3PAO to perform a Mock Assessment several months before the scheduled CMMC Level 2 Certification Assessment.
CMMC Certification Solutions
How Can We Help?
By leveraging our tiered cybersecurity services, you can prepare your organization to meet DoD and industry-related cybersecurity standards. Explore our suite of security audit and assessment solutions:
- CMMC
- CMMC Mock Assessment
