CMMC Explained: What Defense Contractors Need to Know
If you work with the Department of Defense in any capacity, you have probably heard someone mention CMMC in a meeting and watched half the room nod like they understood while the other half pretended to take notes. The acronym stands for Cybersecurity Maturity Model Certification, and it is basically the DoD saying “we are tired of trusting contractors to secure their own networks, so now we are going to verify it.”
Fair enough. After years of high profile breaches hitting defense contractors, the government decided that self attestation was not cutting it. CMMC 2.0 is now rolling out in phases, and if your organization wants to keep bidding on DoD contracts, you need to understand what this means for your business.
By November 2028, all DoD contracts will require CMMC certification. No exceptions. The clock is ticking.
The Three Levels Explained Simply
CMMC 2.0 simplified the original five level framework down to three. Each level corresponds to the sensitivity of information you handle and how much verification the DoD requires.
Level 1 (Foundational) applies if you only handle Federal Contract Information, which is basically non public information provided by or generated for the government. This level requires 15 basic security practices from FAR 52.204-21 and allows self assessment. Think of it as “are you doing the absolute minimum to not be embarrassing?”
Level 2 (Advanced) is where most defense contractors land. If you handle Controlled Unclassified Information, you need to implement all 110 security controls from NIST SP 800-171. Depending on your contract, you will either self assess or undergo third party assessment by a certified assessor organization. Most contracts involving CUI will require third party verification starting in late 2026.
Level 3 (Expert) is reserved for contractors dealing with the most sensitive CUI and facing advanced persistent threats. This level adds controls from NIST SP 800-172 and requires assessment directly from the Defense Industrial Base Cybersecurity Assessment Center. If you need Level 3, you probably already know it.
The Timeline You Actually Need to Know
The DoD is rolling this out in four phases, and here is the part that matters for your planning:
Here is the thing people miss: getting compliant takes time. Most organizations need 6 to 24 months to fully prepare for assessment, depending on their current security posture. If you wait until CMMC shows up in a solicitation you want to bid on, you are already too late.
What This Means for Your Team
CMMC compliance is not just an IT problem. It requires coordination across your entire organization. You need people who understand the technical controls, people who can document everything properly, and leadership who will actually prioritize and fund the work.
The cybersecurity certifications that government contractors require have shifted accordingly. Security+ remains a solid foundation for team members who need to understand the basics. For those implementing and managing CMMC controls, deeper expertise in frameworks like NIST 800-171 becomes essential.
Subcontractors need to pay attention too. CMMC requirements flow down through the supply chain. If you are a subcontractor handling CUI, you face the same compliance requirements as the prime. This catches a lot of smaller companies off guard.
Getting Started Without Losing Your Mind
First, figure out what level you actually need. Look at your current contracts and the data you handle. FCI only? Level 1. CUI involved? Probably Level 2. Not sure what you have? That is your first problem to solve.
Second, do a gap assessment against NIST SP 800-171. Be honest about where you stand. The 110 controls cover everything from access control to incident response to system integrity. Most organizations have gaps they did not know about until they actually looked.
Third, build your documentation. You need a System Security Plan that describes how you implement each control and a Plan of Action and Milestones for anything you have not fully addressed yet. Assessors want to see evidence, not just promises.
Fourth, invest in your people. The technical controls matter, but having staff who understand essential cybersecurity skills makes implementation and maintenance sustainable. Compliance is not a one time project. It is an ongoing commitment.
