The Cybersecurity Maturity Model Certification program — CMMC — is the Department of Defense's framework for ensuring that defense contractors and subcontractors adequately protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). The program has been in development since 2019, and its final rule (CMMC 2.0) was published in late 2024, with contract requirements beginning to appear in DoD solicitations in 2025. For small businesses that are part of the Defense Industrial Base — either as prime contractors or as sub-tier suppliers — CMMC requirements are now contractual realities, not future planning concerns.
CMMC 2.0: The Three Levels
CMMC 2.0 simplified the original five-tier structure to three levels:
Level 1 (Foundational): 17 practices from NIST SP 800-171 that address basic cyber hygiene. Level 1 applies to companies that handle only Federal Contract Information (FCI) — information not intended for public release that is provided by or generated for the government under a contract. Level 1 requires annual self-assessment with an affirmation to the DoD. No third-party assessment required.
Level 2 (Advanced): 110 practices from NIST SP 800-171. Level 2 applies to companies that handle Controlled Unclassified Information (CUI) — information that requires protection under law, regulation, or government policy, including export-controlled technical data, For Official Use Only information, and similar categories. For most contracts, Level 2 requires a third-party assessment by a C3PAO (CMMC Third-Party Assessment Organization) every three years. Some less critical CUI programs may allow annual self-assessment at Level 2.
Level 3 (Expert): 110+ practices from NIST SP 800-171 plus additional practices from NIST SP 800-172. Level 3 applies to the most sensitive DoD programs and requires a government-led assessment. Level 3 is the least common requirement and typically applies to companies working on the most sensitive defense programs.
What Level 2 Actually Requires
The 110 practices of NIST SP 800-171 span 14 control families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.
For a small defense contractor, the most operationally demanding Level 2 requirements typically involve:
CUI scoping and data mapping. You must identify all CUI in your environment and document all systems that store, process, or transmit it. This is harder than it sounds for companies where CUI flows through email, shared drives, and portable media.
Multi-factor authentication. MFA required for all non-local access and for access to systems containing CUI. No exceptions for convenience.
System Security Plan (SSP) and Plan of Action & Milestones (POA&M). Documentation of your security controls and a plan for addressing any gaps. These documents are reviewed during a C3PAO assessment.
Incident response program. Documented IR capabilities, reporting of CUI incidents to US-CERT within 72 hours.
Managed change control, configuration management, and endpoint protection across all in-scope systems.
The C3PAO Assessment Process
Level 2 assessments must be conducted by a C3PAO — an assessment organization approved by the CMMC Accreditation Body (CyberAB). The assessment process involves: document review (SSP, POA&M, policies, evidence), interviews with key personnel, and technical testing of controls. Assessments are conducted against a defined period of evidence collection.
A Level 2 assessment for a small contractor typically takes 3–5 days of on-site or remote assessment time, plus significant pre-assessment preparation. The cost of a C3PAO assessment ranges from $20,000–$60,000+ depending on company size, number of in-scope systems, and assessor firm. That is the assessment cost alone — the remediation work to achieve compliance before assessment can be substantially more.
What CMMC-Focused IT Providers Offer
Several MSPs and IT consulting firms have developed CMMC-specific practices, offering services ranging from gap assessments to full CMMC readiness programs. What to look for in a CMMC-focused provider:
Registered Practitioner Organization (RPO) status from the CyberAB, indicating the organization employs CMMC Registered Practitioners who have been trained in the CMMC assessment methodology. Note that RPO status does not authorize the organization to conduct C3PAO assessments — those require separate certification. An RPO can help you prepare for an assessment and identify gaps, but you need a C3PAO for the actual certification assessment.
Familiarity with GovCloud or ITAR/EAR-compliant cloud environments. Many defense contractors are required to store CUI in FedRAMP Moderate or higher cloud environments — Microsoft Azure Government, AWS GovCloud, and similar — rather than standard commercial cloud. An MSP supporting defense contractors needs to be able to configure and manage these environments.
Frequently Asked Questions
Does CMMC apply to subcontractors?
Yes. The flow-down requirement means that prime contractors must include CMMC requirements in their subcontracts when the subcontractor will handle CUI. A small machining shop that is a sub-tier supplier to a prime defense contractor may be required to achieve Level 2 certification even if they never interact directly with the DoD.
Can a small business achieve CMMC Level 2 without a dedicated security team?
Yes, but it requires a qualified CMMC-focused MSP and a real investment in preparation. The 110 NIST SP 800-171 practices are achievable for a well-organized small business with appropriate tooling and documentation — but they require genuine operational changes, not just policy documentation. Self-assessment scores that show 110/110 without substantiating evidence do not survive C3PAO review.
What is the timeline for CMMC contract requirements?
Per the CMMC 2.0 final rule published in late 2024, CMMC requirements are being phased into DoD contracts beginning in 2025, with broader inclusion in FY2025 and FY2026 solicitations. Companies bidding on new DoD contracts should expect to encounter CMMC clauses and verify required certification levels before bidding. Existing contracts are not retroactively modified, but renewals and options may include CMMC requirements. Note: DoD suspended the planned Phase 2 mandatory third-party (C3PAO) certification requirement on July 13, 2026, pending a 60-day program review — see our full update on the Phase 2 suspension for what still applies today.
← PCI Compliance for Restaurants & Retail | AWS vs Azure vs GCP for Mid-Market →