What Is CMMC?

The Cybersecurity Maturity Model Certification programme requires defence contractors and their suppliers to demonstrate specified security practices before receiving contracts involving sensitive government information.

Its significance is that it converted self-attestation into verified assessment. Contractors previously asserted compliance with the underlying control requirements; the programme introduces third-party verification for the levels that matter.

The levels

Level 1 covers basic safeguarding of federal contract information through a small set of practices, validated by annual self-assessment with senior affirmation.

Level 2 covers controlled unclassified information and aligns with an established federal control catalogue for protecting that information in non-federal systems. Most contracts at this level require assessment by a certified third-party organisation. Level 3 applies to the highest-priority programmes and is government-assessed.

What triggers which level

The type of information involved. Federal contract information — non-public information provided under a contract — brings Level 1. Controlled unclassified information brings Level 2.

Contractors frequently underestimate which they hold. Technical drawings, specifications, research data and export-controlled material commonly qualify as controlled unclassified information, and the marking is not always present or correct.

Scope reduction is the main lever

Requirements apply to the systems that store, process or transmit the relevant information. Isolating those into a defined enclave — rather than treating the whole corporate environment as in scope — is what makes assessment affordable for a small contractor.

That enclave approach is well established and is the difference between a manageable programme and one that consumes the whole technology budget.

It flows down the supply chain

Prime contractors must ensure subcontractors meet the appropriate level for the information they receive. Small suppliers with no direct government relationship therefore face the requirement through their customers.

This is where most of the affected population sits, and where the cost is hardest to absorb. Suppliers that address it early frequently find it a competitive advantage as primes consolidate toward compliant vendors.

Plans of action and the score

The underlying control requirements permit a plan for items not yet implemented, with a self-assessed score reflecting the gap. Certification limits which requirements may remain on a plan and for how long.

Submitting an inflated score has become a serious exposure. Enforcement actions have treated false compliance assertions as fraud against the government, with consequences well beyond losing a contract.

Shared responsibility with cloud and managed providers

Controlled information held in a cloud service means the provider’s controls are part of your assessment, and government cloud offerings exist specifically because commercial equivalents do not meet the requirements for this data.

The same applies to managed service providers with administrative access to the enclave: their practices fall within scope. A responsibility matrix stating precisely which controls each party operates is what an assessor will ask for, and assembling it late is a common source of delay.

Where to start

Establish whether you hold controlled unclassified information, and where. Contractors regularly discover it in engineering shares and email long after assuming they were Level 1.

See Level 1 versus Level 2 and the compliance guide. GuardsArm delivers CMMC compliance.