What is CMMC compliance? What DoD contractors and manufacturers need to know.

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's framework for verifying that defense contractors protect Controlled Unclassified Information (CUI) in their environments. It defines three levels of cybersecurity maturity (Level 1, Level 2, Level 3). Depending on the contract, it requires a self-assessment or a third-party certification. CMMC is built on the controls in NIST SP 800-171. It applies to virtually every company in the defense industrial base that handles federal contract information or CUI.

Every organization in the defense industrial base (DIB) that processes, stores or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) under a DoD contract must comply. The DoD estimates roughly 300,000 organizations (including prime contractors, subcontractors at any tier, and IT/cloud service providers) fall into scope. Subcontractors inherit the CMMC level of the prime contract they support. There is no minimum size threshold: a small machining shop with one DoD contract is subject to the same baseline as a Tier 1 prime.

Level 1 (Foundational) covers 17 basic safeguarding requirements drawn from FAR 52.204-21 and is verified through annual self-assessment. Level 2 (Advanced) requires implementation of all 110 NIST SP 800-171 Rev 2 controls and is verified through triennial third-party assessment by an authorized C3PAO. Level 3 (Expert) adds a subset of NIST SP 800-172 controls for the most sensitive contracts and is assessed by the DoD's DIBCAC. Most DIB contractors will fall under Level 2.

The CMMC 2.0 rule was published in October 2024 and enforcement phased into contracts through 2025 and 2026. In July 2026 the Department of War suspended Phase II and opened a 60-day reform review. Phase II was the step that would have required a third-party C3PAO assessment for Level 2. Phase 1 self-assessment and the NIST 800-171 obligations that protect CUI remain in force, so the technical requirements have not changed. The review covers how compliance gets verified. The duty to protect CUI stays.

NIST SP 800-171 is the underlying standard: a list of 110 security controls in 14 control families that protect CUI in non-federal systems. CMMC is the assessment and certification framework built on top of NIST 800-171. It adds maturity levels, formal third-party verification and an Affirming Official requirement. In practice, achieving CMMC Level 2 means implementing all 110 NIST 800-171 Rev 2 controls and producing the evidence to prove it to a C3PAO assessor.

Two categories of risk. (1) Contract risk: organizations without the required CMMC level cannot bid on or perform DoD contracts that require it, losing eligibility for the relevant pipeline. (2) False Claims Act exposure: submitting a CMMC score to the Supplier Performance Risk System (SPRS) that overstates your compliance is a federal misrepresentation. The DoD has stated it will use FCA enforcement for CMMC misrepresentation, with penalties including treble damages and per-claim fines.

Realistically 12 to 24 months for an organization starting from a baseline IT-only security program. Implementation breaks into roughly four phases: gap analysis (1-3 months), control implementation (6-12 months), evidence collection and System Security Plan (SSP) drafting (3-6 months), and the C3PAO assessment itself (1-3 months including remediation cycles). Organizations with significant legacy OT or specialized assets typically take longer because of compensating-control documentation requirements.

CMMC explicitly recognizes that some assets (PLCs, CNCs, HMIs, embedded controllers) cannot natively meet every NIST 800-171 control. The Enduring Exception and Specialized Asset categories let you document why a control cannot be implemented on a specific device. You then apply a compensating control that gives equivalent protection at the network or process layer. This is where most defense manufacturers struggle: the documentation is rigorous and the compensating controls must be technically verifiable.

A manufacturer that handles CUI under a DoD contract needs CMMC Level 2, which means the 110 controls of NIST SP 800-171. In a plant, CUI is usually technical data: drawings, CAD models, specifications and the CNC programs built from them. That data travels from engineering to the shop floor, so the machines and networks it reaches are in scope. PLCs, CNCs, HMIs and test equipment that cannot run modern security software are handled as specialized assets: you document them in the System Security Plan and protect them at the network layer.

CMMC 2.0 set three levels: Level 1 (Foundational), Level 2 (Advanced) and Level 3 (Expert). Level 2 maps directly to the 110 controls of NIST SP 800-171 Rev 2, with no CMMC-specific practices added. Self-assessment is allowed at Level 1 and for some Level 2 contracts. A Plan of Action and Milestones (POA&M) is allowed for a limited set of controls, with a fixed time to close each gap.

Yes, the controls are. The suspension paused the mandatory third-party C3PAO assessment for Level 2. If you handle CUI, DFARS 252.204-7012 still requires the 110 NIST SP 800-171 controls, and Phase 1 self-assessment and the SPRS affirmation still apply. A score in SPRS that overstates your implementation carries False Claims Act exposure whether or not an assessor ever visits.

Confirm the CMMC level in each contract, then run a gap assessment against the 110 NIST 800-171 controls. Write or update the System Security Plan, record each open gap in a POA&M, and submit an honest SPRS score. Close the technical gaps that take longest first: access control, audit logging and network segmentation around the machines that touch CUI. That work is required today and is the same work a C3PAO will check when assessments resume.