The Department of Defense (DoD) created the Cybersecurity Maturity Model Certification (CMMC) to strengthen the protection of sensitive defense information and ensure that every organization in the Defense Industrial Base (DIB) is practicing baseline cybersecurity. For companies that want to do business with the DoD, understanding and implementing CMMC is no longer optional.
Below, we’ll break down what CMMC is, who it applies to, the three levels of certification, and how implementation works.
What is CMMC 2.0?
The Cybersecurity Maturity Model Certification (CMMC) is a DoD program that requires defense contractors and subcontractors to meet specific cybersecurity standards before they can bid on or perform certain contracts.
CMMC 2.0, the streamlined version of the model released in 2021, reduces the framework to three levels of cybersecurity requirements and aligns closely with existing federal standards, especially NIST SP 800-171.
Who Does CMMC 2.0 Apply To?
CMMC applies to the entire Defense Industrial Base (DIB), a supply chain of over 220,000 companies that provide goods and services to the DoD. If your company handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you must comply with CMMC. This includes all prime contractors, subcontractors, and vendors down the chain.
CMMC ensures that even the smallest supplier in the defense ecosystem meets baseline cybersecurity protections, reducing the overall risk to national security.
What Are the Three CMMC Levels?
CMMC 2.0 has three tiers of cybersecurity requirements based on the sensitivity of information you handle:
-
Level 1:
- Applies to companies handling only Federal Contract Information (FCI).
- Requires 17 basic practices aligned with FAR 52.204-21 (e.g., antivirus, password policies, data access controls).
- Requires annual self-assessment.
-
Level 2:
- For companies handling Controlled Unclassified Information (CUI).
- Requires full compliance with all 320 assessment objectives spanning the 14 domains of requirements
- Combination of self-assessments and third-party assessments (C3PAO) for prioritized contracts.
-
Level 3:
- For the most sensitive DoD programs.
- Requires implementation of a subset of NIST SP 800-172 enhanced controls to defend against advanced cyber threats.
- Government-led assessments only.
CMMC Implementation: Four Phases and Key Dates
CMMC 2.0 will be integrated into DoD contracting via a structured four-phase timeline, anchored to the effective date of the DFARS “Clause Rule” that makes CMMC a contractual requirement.
-
Phase 1: November 10, 2025
- The DFARS amendments become effective, and on that same date, Phase 1 begins.
- DoD may start including CMMC Level 1 and Level 2 self-assessment requirements in solicitations and contracts as a condition of award.
- In certain cases, DoD may require Level 2 third-party assessments even in this initial phase.
-
Phase 2: November 10, 2026
- Begins one year after Phase 1.
- Adds the requirement that Level 2 certification assessments conducted by C3PAOs are used for applicable contracts that handle CUI.
- DoD may delay requiring certification in some option periods or legacy contracts.
-
Phase 3: November 10, 2027
- Begins one year after Phase 2
- DoD will require Level 2 certification assessments conducted by C3PAOs not just for new awards, but as a condition for exercising option periods in contracts awarded post-November 10, 2025.
- Level 3 (government-led) assessments will begin to appear in select high-security solicitations.
-
Phase 4: November 10, 2028 (Full Implementation)
- Begins one year after Phase 3.
- CMMC requirements will be standard in all applicable DoD solicitations and contracts (except for purely COTS).
- At this point, all contractors in the DoD supply chain must hold the required CMMC level for their contract.
How NeQter Labs Helps
Navigating CMMC can be overwhelming, especially for small and mid-sized contractors with limited cybersecurity staff. That’s where NeQter Labs comes in:
- CMMC Expertise – Our team has worked with hundreds of companies to work towards CMMC compliance, meeting them wherever they are in the process
- Compliance-Centric Software – The NeQter Labs SIEM, inventory, and vulnerability scanning software was built specifically to help businesses achieve NIST, CMMC, and DFARS compliance
- Streamlined Documentation – Our system security plan builder helps prepare your organization for self-assessments, third-party assessments, or government reviews.
