A Department of Defense cybersecurity standard that requires federal contractors (particularly those handling sensitive unclassified information) to achieve and maintain certification at one of five maturity levels through third-party assessments.
CMMC stands for Cybersecurity Maturity Model Certification. It's the DoD's answer to cyber threats in the defense industrial base. The basic premise: contractors who work with DoD and have access to controlled unclassified information (CUI) need to have cybersecurity controls in place. CMMC establishes five maturity levels (1-5), with level 1 being basic cyber hygiene and level 5 being advanced persistent threat protection. A contractor must achieve the appropriate CMMC level to compete for DoD contracts that involve sensitive data.
Here's what makes CMMC mandatory for most DoD contractors: the DoD is writing CMMC requirements into their solicitations. By default, most contracts with DoD that involve CUI require at least CMMC Level 2. Some contracts (particularly those involving advanced technology or special access programs) require Level 3 or higher. If you can't demonstrate CMMC certification, you can't bid. This isn't a preference; it's a gate. Additionally, CMMC certification requires third-party assessment by an accredited C3PAO (Certified Third-Party Assessment Organization), not self-assessment. You must hire an external assessor, pay for the assessment, remediate any gaps, and then maintain certification annually.
For contractors, CMMC creates two major impacts. First, it's an investment: achieving CMMC Level 2 typically costs $10,000-$30,000 depending on your starting point and organization size. Larger companies might spend more. You need to implement security controls, document your practices, and pass an assessment. Second, it's a competitive barrier. Small contractors that can't afford CMMC assessment find themselves locked out of DoD work. This has created tension in the supply chain, as prime contractors struggle to find CMMC-certified subcontractors, particularly small businesses. If you're planning to bid on DoD contracts involving CUI, start your CMMC journey early. Plan for 6-12 months of preparation before you're assessment-ready.