The Framework Explained
The Cybersecurity Maturity Model Certification (CMMC) is a unified security standard set by the Department of Defense (DoD). Its purpose is simple: to ensure that defense contractors are adequately protecting sensitive unclassified information that resides on their internal networks.
Instead of relying on self-attestation alone, CMMC introduces external assessments by Certified Third-Party Assessment Organizations (C3PAOs) to verify that the required security practices are actually in place and actively managed.
Understanding Your Data: FCI vs. CUI
The level of CMMC compliance you need depends entirely on the type of information you handle for the DoD.
Federal Contract Information (FCI)
Information provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It is information not intended for public release.
Impact: If you only handle FCI, you must meet CMMC Level 1 (17 foundational practices).
Controlled Unclassified Information (CUI)
Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.
Impact: If you handle CUI, you must meet CMMC Level 2 (110 advanced practices aligned with NIST SP 800-171).
The Timeline
The CMMC rule has been finalized and will be rolled out in a phased approach. The DoD will gradually begin including CMMC requirements in solicitations and contracts.
- Phase 1: Begins November 10, 2026. CMMC Level 1 or Level 2 self-assessments will be required as a condition of contract award.
- Phase 2: Begins six months after Phase 1. The DoD will begin adding Level 2 certification (C3PAO assessment) requirements to applicable contracts.
- Phase 3 & 4: Expansion of requirements across all DoD contracts, culminating in full implementation.
Why You Must Start Now
Preparing for CMMC is not a quick IT project—it requires a fundamental shift in how your organization handles security, policies, and evidence gathering.
For a Level 2 environment, a typical organization takes 12 to 18 months to fully implement the 110 controls, generate the necessary documentation, and build the history of evidence required to pass a C3PAO assessment.
Waiting until the requirement appears in your contract will be too late.