CMMC (Cybersecurity Maturity Model Certification): CMMC – Tutorial (about 60 minutes)

The Cybersecurity Maturity Model Certification (CMMC) is the United States Department of Defense programme that checks whether defense contractors actually protect the sensitive, unclassified information the government shares with them. It is used by prime contractors and by every tier of their suppliers, from aircraft manufacturers down to ten-person machine shops and software firms. CMMC does not invent new security controls; it takes existing federal requirements, sorts them into three levels and adds a formal way to assess, score and affirm compliance. After this tutorial you will be able to explain what CMMC is for, decide which level and assessment type applies to a contract, scope an environment, read a score, and plan a realistic path to a passing assessment.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: This tutorial teaches the current programme, often called CMMC 2.0, as codified in Title 32 of the Code of Federal Regulations, Part 170 (32 CFR Part 170). That rule was published in the Federal Register on 15 October 2024 and took effect on 16 December 2024. A companion acquisition rule in the Defense Federal Acquisition Regulation Supplement (DFARS) took effect on 10 November 2025, which started Phase 1 of a planned four-phase rollout. The programme owner is the DoD Chief Information Officer (the department has also used the name Department of War since September 2025). The level requirements come from FAR clause 52.204-21 (Level 1), NIST SP 800-171 Revision 2 (Level 2) and selected requirements of NIST SP 800-172 of February 2021 (Level 3). Important status change: on 13 July 2026 the department announced that the DoD CIO had suspended the move to Phase 2, which would have made third-party certification a common condition of award from 10 November 2026, together with the later phases, while a CMMC Reform Task Force reviews the programme. A DFARS class deviation dated 3 September 2026 reportedly tells contracting officers to remove third-party assessment requirements from solicitations and contracts for now, so Level 1 (Self) and Level 2 (Self) are what new contracts can currently require. The Task Force report was due in September 2026 but had not been published when this tutorial was checked, and changes such as a narrower Phase 2 or a move to NIST SP 800-171 Revision 3 have been discussed but not decided. Part 170 itself remains in force and unchanged in the electronic CFR, and the underlying contract duty to implement NIST SP 800-171 under DFARS 252.204-7012 still applies. Verified 2026-10-29 against the eCFR text of 32 CFR Part 170, the Federal Register, and reporting by Washington Technology, Nextgov and several law-firm alerts (the DoD CIO pages could not be read automatically). Always check the DoD CIO CMMC pages before acting, because this situation is moving.

Who it is for: IT and security managers, compliance and contracts staff, engineers, consultants and business owners at companies that sell, or want to sell, to the US defense supply chain, plus anyone outside the US whose company is a subcontractor to a US defense prime. No legal background is needed.

Prerequisites: none. A general idea of security controls (passwords, access rights, backups, logging) helps, and every CMMC term is explained when it first appears.

By the end of this tutorial:

You will be able to explain why the Department of Defense created CMMC and which kinds of information it protects.
You will be able to describe the three CMMC levels, where their requirements come from and how each one is assessed.
You will be able to scope an environment using the CMMC asset categories and explain why scoping drives cost.
You will be able to calculate and interpret a Level 2 score and tell whether a plan of action is allowed.
You will be able to outline the roles in the CMMC ecosystem, from the programme office to individual assessors.
You will be able to plan the main steps a small contractor takes to reach and keep a CMMC status.
You will be able to relate CMMC to NIST SP 800-171, DFARS 252.204-7012, FedRAMP and ISO/IEC 27001.

Lesson 1 – Origins, purpose and scope

The problem CMMC tries to solve

The Defense Industrial Base (DIB) is the network of companies that design, build, maintain and support military systems for the United States. It is very large: hundreds of thousands of organisations, most of them small businesses that never see a weapon system but make a bracket, write a piece of test software or translate a manual. To do that work they receive information from the government or create it for the government. Most of it is not classified, yet much of it is sensitive. A drawing of a missile fin, the maintenance schedule of a ship or a list of part numbers can help an adversary copy a design or plan an attack. Over two decades, investigators and intelligence agencies reported repeated theft of such information from contractor networks.

The department's first answer was contractual. Since the mid-2010s, a DFARS clause, 252.204-7012 ("Safeguarding Covered Defense Information and Cyber Incident Reporting"), has required contractors that handle covered defense information to implement the security requirements of NIST Special Publication 800-171 and to report cyber incidents to the DoD within 72 hours. The weakness was verification. Contractors largely declared their own compliance, and later spot checks by government assessors found that many declarations were optimistic. A company could sign the contract, never implement multi-factor authentication, and nobody would know until something went wrong.

CMMC adds what was missing: a defined assessment, a standard scoring method, a central record of results and, for the most sensitive work, assessments by independent or government assessors. The name contains the word "maturity", which comes from the first version of the model, but the current programme is better understood as a verification scheme for existing requirements than as a maturity model in the style of CMMI.

Two kinds of information

Everything in CMMC turns on two categories of information, and you should learn to spot them in a contract.

Federal Contract Information (FCI) is information that is not intended for public release and that is provided by or generated for the government under a contract. Almost every contract produces some FCI, for example pricing details, delivery schedules or internal correspondence about the work.
Controlled Unclassified Information (CUI) is a narrower and more sensitive set: information that a law, regulation or government-wide policy says must be safeguarded or disseminated only in controlled ways. Technical drawings with export-control markings, controlled technical information and certain operational details are typical examples. CUI is defined by a government-wide programme run by the National Archives, and documents are normally marked as CUI.

The rule of thumb is simple: FCI points to Level 1, CUI points to Level 2, and CUI tied to the department's most critical programmes may point to Level 3. The government, not the contractor, chooses the level when it writes the solicitation.

How the programme evolved

The first model, CMMC 1.0, was released in January 2020. It had five levels, mixed practices with "process maturity" expectations, and required third-party certification for every level. Industry warned that this was too expensive for small firms, and in November 2021 the department announced CMMC 2.0: three levels, requirements aligned exactly with existing NIST and FAR documents, self-assessment allowed at the lower levels, and limited, time-bound plans of action. Rule-making followed. The programme rule (32 CFR Part 170) became effective in December 2024, and the acquisition rule that lets contracting officers put CMMC requirements into contracts became effective on 10 November 2025.

Figure 1 – From self-declared compliance to CMMC 2.0 and the 2026 suspension of later rollout phases.

The phased rollout and its suspension

Part 170 describes four phases, each starting one year after the previous one. Phase 1 (from 10 November 2025) brings Level 1 and Level 2 self-assessments into applicable contracts. Phase 2 was meant to add Level 2 third-party certification as a normal condition of award. Phase 3 was meant to extend certification to option periods and add Level 3. Phase 4 was meant to put CMMC into all applicable contracts. In July 2026 the department paused everything after Phase 1 and formed a CMMC Reform Task Force to review the programme's cost and administrative burden and which requirements actually reduce risk. Self-assessments remain in use, the department said it would rely on them and on selected government-led assessments in the meantime, and false or careless declarations can still lead to False Claims Act cases brought by the Department of Justice. In practice, the security work CMMC requires is still expected; what is uncertain is who will check it and when.

Scope of the programme

CMMC applies to DoD contractors and subcontractors at all tiers that process, store or transmit FCI or CUI on their own (non-federal) information systems while performing a defense contract. It does not apply to federal systems that a contractor operates on behalf of the government; those follow federal system rules instead. Contracts solely for commercially available off-the-shelf (COTS) products and very small purchases at or below the micro-purchase threshold are excluded. Non-US companies are covered when they are in the supply chain and handle FCI or CUI.

Lesson 2 – Key concepts and vocabulary

CMMC has a dense vocabulary of acronyms. Learn these terms once and the rest of the programme becomes readable.

Organization Seeking Assessment (OSA) – the company (or the part of it) that is being assessed, whether by itself or by others.
Organization Seeking Certification (OSC) – an OSA that is going for a third-party or government certification assessment at Level 2 or Level 3.
Security requirement – one of the individual safeguards the model contains, such as limiting system access to authorised users. CMMC uses "requirement" rather than "control" because the text comes from NIST SP 800-171.
Assessment objective – one of the smaller, checkable statements that together make up a requirement. Objectives come from NIST SP 800-171A, the assessment companion to NIST SP 800-171. A requirement is met only when all of its objectives are met.
Domain – a family of related requirements, such as Access Control or Incident Response. CMMC uses the 14 requirement families of NIST SP 800-171 Revision 2.
CMMC Assessment Scope – the set of assets (systems, people, facilities and service providers) that will be assessed. Defining it is the single most important planning decision.
System Security Plan (SSP) – the document that describes the in-scope environment and explains how each requirement is implemented. Without an SSP an assessment cannot be completed.
Plan of Action and Milestones (POA&M) – a list of requirements not yet met, with the actions and dates to fix them. CMMC allows only a limited POA&M and only for a limited time.
CMMC Status – the result recorded for an assessment scope, for example "Final Level 2 (Self)" or "Conditional Level 2 (C3PAO)". The level and the assessment type always appear together.
CMMC Status Date – the date the status was achieved; validity periods and deadlines count from it.
Affirmation – a signed statement, entered electronically by a senior official, that the company has implemented the requirements and will keep them in place.
Affirming Official – the senior person in the company who is responsible for CMMC compliance and has the authority to make the affirmation.
SPRS – the Supplier Performance Risk System, the DoD database where self-assessment results, scores and affirmations are recorded and where contracting officers check them.
eMASS (CMMC instance) – the government system into which third-party assessors upload certification results; results flow from there into SPRS.
C3PAO – a CMMC Third-Party Assessment Organization, a company authorised or accredited to perform Level 2 certification assessments.
DCMA DIBCAC – the Defense Industrial Base Cybersecurity Assessment Center within the Defense Contract Management Agency, the government team that performs Level 3 assessments and other DoD assessments of contractors.
External Service Provider (ESP) – an outside company, such as a managed service provider or a cloud provider, that handles CUI or security protection data for the OSA. A Cloud Service Provider (CSP) is a special kind of ESP.
Customer Responsibility Matrix (CRM) – a document from a service provider that says which security responsibilities it carries, which the customer carries and which are shared.
Security Protection Data (SPD) – data about the security of the environment, such as logs, configuration settings and vulnerability scan results; a provider that handles it is in scope even if it never sees CUI.
Flow-down – the duty of a prime contractor to pass the right CMMC requirement to each subcontractor that will handle FCI or CUI.

Two status words also matter. A Conditional status means the company passed with a small, allowed POA&M that must be closed within 180 days. A Final status means all requirements are met (or were met after the POA&M was closed). Both let a company bid, but a Conditional status expires automatically if the deadline passes.

Lesson 3 – Structure of the CMMC model

Three levels built on existing documents

CMMC 2.0 is deliberately thin. Instead of writing its own catalogue, it borrows three existing sets of requirements and assigns each one to a level. Each higher level includes the lower ones for the same scope.

Figure 2 – The three CMMC levels, where each level's requirements come from, and how each level is assessed.

Level	Information protected	Requirement source	Assessment type	Frequency	POA&M allowed?
Level 1 (Foundational)	FCI	15 basic safeguarding requirements in FAR 52.204-21	Self-assessment	Every year, with annual affirmation	No
Level 2 (Advanced)	CUI	All 110 requirements of NIST SP 800-171 Rev 2	Self-assessment or C3PAO certification, as the contract states	Every three years, with annual affirmation	Yes, limited, closed within 180 days
Level 3 (Expert)	CUI on high-priority programmes	24 selected enhanced requirements of NIST SP 800-172 (with DoD-set parameters), on top of Level 2	DCMA DIBCAC assessment	Every three years, with annual affirmation	Yes, limited, closed within 180 days

Level 1 in plain terms

Level 1 covers basic hygiene that any business handling government information should have: allow only authorised users and devices, limit what they can do, verify and control connections to external systems, control what is posted publicly, identify and authenticate users, sanitise media before disposal, control physical access and escort visitors, protect the network boundary, separate publicly accessible systems, fix flaws promptly, use malicious-code protection and keep it up to date, and scan systems and files. NIST SP 800-171A objectives are used to check them, with "FCI" read in place of "CUI". Every Level 1 requirement must be fully met; there is no partial credit and no plan of action.

Level 2 and the 14 domains

Level 2 is identical to NIST SP 800-171 Revision 2. Its 110 requirements are grouped into 14 families, which CMMC calls domains: Access Control (AC), Awareness and Training (AT), Audit and Accountability (AU), Configuration Management (CM), Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Personnel Security (PS), Physical Protection (PE), Risk Assessment (RA), Security Assessment (CA), System and Communications Protection (SC) and System and Information Integrity (SI). Access Control is the largest family; Personnel Security is among the smallest. The requirements range from policy-level items (have a system security plan, train users) to technical ones (use multi-factor authentication, encrypt CUI with FIPS-validated cryptography, keep audit logs).

NIST divides these requirements into basic requirements, taken from the high-level security standard FIPS 200, and derived requirements, taken from the larger NIST SP 800-53 control catalogue. That distinction matters later, because it feeds the point values used in scoring.

Level 3

Level 3 adds a selection of 24 "enhanced" requirements from NIST SP 800-172, which is aimed at protecting CUI against advanced persistent threats, meaning well-resourced attackers who try to stay hidden for a long time. The selected requirements include items such as a round-the-clock security operations capability, an incident response team that can deploy quickly, threat hunting, threat-informed risk assessment, supply chain risk planning, penetration testing, and isolation of sensitive systems. For several of them the DoD fills in the organisation-defined parameters (for example, how often training must be refreshed), so the contractor does not choose those values.

How requirements are numbered

Every requirement has an identifier of the form DD.L#-REQ: a two-letter domain code, the level, and the source number. For example, IA.L2-3.5.3 is the Level 2 requirement in the Identification and Authentication domain that maps to NIST SP 800-171 requirement 3.5.3 (multi-factor authentication). Level 1 identifiers use the FAR paragraph number (for example, AC.L1-b.1.i), and Level 3 identifiers end in "e" for "enhanced" (for example, IR.L3-3.6.1e). Being able to read these codes lets you move quickly between the CMMC rule, the NIST documents and an assessor's report.

Requirements, objectives and evidence

Each requirement breaks down into assessment objectives. A typical access control requirement might have objectives such as "authorised users are identified", "processes acting on behalf of users are identified" and "system access is limited to them". The assessor checks each objective using three methods described in NIST SP 800-171A: examine (read documents, configurations and records), interview (talk to the people who run the controls) and test (try the mechanism, for example attempt a login without the second factor). Evidence must be final and approved; drafts and working papers do not count.

Lesson 4 – How CMMC works in practice

Step 1: understand the contract

Work starts with the solicitation. The requiring activity decides which CMMC status it needs, based on whether FCI or CUI will be handled, and the solicitation states it. The contractor must hold that status for every information system that will handle the information before award, and keep it during performance. For CUI work, the contract will also include DFARS 252.204-7012, which carries the incident reporting duty and the requirement to use cloud services that meet the FedRAMP Moderate baseline or an equivalent.

Step 2: find the information and define the scope

Next, the company traces where FCI and CUI actually travel: email, file shares, engineering workstations, CAD systems, shop-floor machines, laptops, backup systems, phones and people. This data-flow exercise produces the CMMC Assessment Scope. For Level 1, everything that processes, stores or transmits FCI is in scope. For Level 2, the rule defines five asset categories, and each category has different documentation and assessment expectations.

Figure 3 – A simplified decision path for sorting assets into the five CMMC Level 2 asset categories.

The categories work as follows. CUI Assets process, store or transmit CUI and are assessed against every Level 2 requirement. Security Protection Assets provide security to the scope (for example, a firewall, an identity provider or a log collector) and are assessed against the requirements relevant to what they do. Contractor Risk Managed Assets could handle CUI but are kept from doing so by policy and practice; they must be listed and explained in the SSP, and an assessor may make a limited check if the documentation raises doubts. Specialized Assets are things that cannot be fully secured, such as Internet of Things devices, operational technology, government-furnished equipment and test equipment; they are documented and managed by risk, not assessed against every requirement. Out-of-Scope Assets cannot handle CUI and do not protect CUI assets, usually because they are physically or logically separated, and the company must be able to justify that. Note that an asset that fits any in-scope category cannot be called out of scope. At Level 3 the treatment is stricter: Contractor Risk Managed Assets are treated as CUI Assets, and Specialized Assets are assessed.

Scoping is where most of the cost is decided. A company that lets CUI spread through its general office network must protect the whole network to Level 2. A company that confines CUI to a small, well-defined enclave (a separate set of systems, often a dedicated cloud tenant or virtual desktop environment) protects much less. A practical detail from the rule: an endpoint that only shows a virtual desktop, and is configured so that CUI never leaves the remote environment beyond keyboard, video and mouse traffic, is considered out of scope.

Step 3: deal with service providers

Few small companies run everything themselves. If a cloud service handles CUI, it must be FedRAMP Moderate authorised or meet an equivalent level as defined by DoD policy. If a managed service provider that is not a cloud provider handles CUI, its services are assessed as part of the company's own assessment. If a provider handles only security protection data (for example, a managed detection service that receives logs), its services are in scope as Security Protection Assets. In each case the relationship and the split of responsibilities must be described in the SSP and in the provider's CRM. Outsourcing moves work, but it never moves accountability.

Step 4: implement and document

With the scope fixed, the company performs a gap analysis against the requirements and their objectives, closes gaps, and writes the SSP. Typical artefacts include an asset inventory, a network diagram of the scope, policies and procedures for each domain, configuration baselines, training records, access reviews, audit log samples, incident response plans and test results, and records of visitors and physical access. Evidence must be retained for six years from the CMMC Status Date. For certification assessments, a cryptographic hash (a digital fingerprint) of each evidence file is recorded with the results, so that its integrity can be proven later.

Step 5: assess, record and affirm

The company then performs, or undergoes, the assessment required by the contract, records the result, and the Affirming Official affirms. Lesson 5 covers this in detail.

Step 6: keep it running and flow it down

CMMC is not a one-off project. Requirements such as log review, vulnerability scanning, account reviews and training are periodic; where the text leaves the interval to the organisation, the rule caps it at no more than one year. Affirmations are repeated every year. And because the requirements apply at every tier, a prime contractor must pass the right status down to each subcontractor that will handle FCI or CUI: Level 1 (Self) for FCI only; at least Level 2 (Self) for CUI; and Level 2 (C3PAO) for CUI when the prime contract itself requires Level 2 (C3PAO) or Level 3.

Lesson 5 – Assessment, certification and compliance

Who assesses

CMMC has three assessment types, matched to the levels. A self-assessment is performed by the company itself, at Level 1 or Level 2, using the NIST SP 800-171A objectives and the CMMC scoring method. A Level 2 certification assessment is performed by a C3PAO using certified assessors, and the results are uploaded to the CMMC instance of eMASS. A Level 3 certification assessment is performed by DCMA DIBCAC on behalf of the department, and can start only once the same scope already holds Final Level 2 (C3PAO) status with no open plan of action.

The CMMC ecosystem

Several organisations keep the system running. The CMMC Program Management Office inside the DoD CIO's office owns the programme and its policies. A single Accreditation Body, currently the non-profit known as The Cyber AB, authorises and accredits C3PAOs against the ISO/IEC 17020 standard for inspection bodies. The CMMC Assessor and Instructor Certification Organization (CAICO) trains, tests and certifies individuals. Individuals hold roles such as CMMC Certified Professional (CCP), who advises companies and can take part in Level 2 certification assessments under the oversight of an assessor who makes the final decisions, and CMMC Certified Assessor (CCA), who can conduct Level 2 certification assessments; every C3PAO assessment team has at least two CCAs, one of them a Lead CCA. Preparation help and assessment are kept apart: someone who consulted for a company to prepare it for CMMC may not take part in that company's certification assessment within three years, to avoid conflicts of interest.

Findings and scoring

Each requirement ends up with one of three findings. MET means all applicable objectives are satisfied by final evidence. NOT MET means at least one objective is not satisfied, and the assessor records why. NOT APPLICABLE means the requirement or objective does not apply in this environment (for example, separation of public-facing systems when there are none), and it counts the same as MET. Two subtleties often surprise people: an enduring exception that is described with mitigations in the SSP is treated as MET, and so is a temporary deficiency that is being actively worked in an operational plan of action. A POA&M entry, on the other hand, is never a substitute for a requirement; the requirement stays NOT MET until fixed.

Level 1 is simply all or nothing. Level 2 uses points. The maximum score is 110, one per requirement. For each NOT MET requirement a value of 5, 3 or 1 is subtracted, depending on how much harm its absence could cause, so a score can even become negative. The highest-weighted requirements are those whose absence could let attackers exploit the network or remove CUI. Two requirements allow partial credit: multi-factor authentication costs 3 points if it is in place only for remote and privileged users and 5 if absent; encryption of CUI costs 3 points if encryption is used but not FIPS-validated and 5 if absent. Level 3 is scored differently: every one of its 24 requirements is worth one point, and the Level 2 requirements must already be fully met for the scope.

Conditional status and the 180-day rule

A company that misses a few requirements can still obtain a Conditional status, but only if three conditions hold at Level 2. First, the score must be at least 80 percent of the maximum, which means 88 out of 110. Second, every item on the POA&M must be a one-point requirement, with a single exception: FIPS-validation of encryption may be listed when encryption is already in use. Third, a short list of requirements may never be deferred, including the system security plan itself, control of external connections, control of information posted publicly, and the physical protection items about escorting visitors, keeping access logs and managing physical access devices. Level 3 has its own list of requirements that cannot be deferred, such as the security operations centre, the incident response team and supply chain risk planning. Level 1 never allows a POA&M.

The POA&M must then be closed within 180 days of the Conditional CMMC Status Date by a closeout assessment that re-checks only the open items, performed by the same type of assessor (the company itself for Level 2 Self, a C3PAO for Level 2 certification, DIBCAC for Level 3). If the deadline passes, the Conditional status simply expires, the company is no longer eligible for new awards that need that status, and normal contractual remedies apply on existing contracts.

Figure 4 – Life cycle of a CMMC Level 2 or Level 3 status, from assessment through conditional and final status to reassessment.

Recording, affirming and validity

Self-assessment results go into SPRS with the level, status date, scope, the company's CAGE codes (the identifiers the government assigns to contractor locations) and, for Level 2, the score and any POA&M. Certification results go through eMASS into SPRS automatically. An affirmation is required after every assessment, after every POA&M closeout, and every year after a Final status; for Level 3 the company must affirm both its Level 2 (C3PAO) and its Level 3 status each year. A Level 1 self-assessment must be repeated annually. Level 2 and Level 3 assessments are repeated within three years, and a Level 3 renewal also requires a new Level 2 certification first.

The department keeps the right to check. Under DFARS 252.204-7020, DIBCAC can perform its own assessment of a contractor, and if it finds that the company did not achieve or maintain compliance, its result overrides the existing CMMC status. Combined with the False Claims Act, this is why the affirmation is a serious legal act and not a formality.

Is it a "certification"?

Only partly. A C3PAO issues a Certificate of CMMC Status after a Level 2 certification assessment, and DIBCAC does the equivalent at Level 3. Self-assessments produce a recorded status and an affirmation, not a certificate. Unlike ISO/IEC 27001, there is no option to be certified by any accredited body worldwide; the scheme is specific to the US defense supply chain. During the 2026 suspension, third-party certification is not being required in new contracts, while companies that already hold a Level 2 (C3PAO) status keep their recorded status.

Lesson 6 – Worked example: a precision machine shop prepares for Level 2

The company

Northfield Precision is a fictional 60-person machine shop that makes housings and brackets for a defense prime. Its customer sends export-controlled drawings marked as CUI, and Northfield sends back inspection reports that also contain controlled technical data. A new subcontract states that Northfield must hold at least CMMC Level 2 (Self) for the systems that handle this information. Today, the company has one office network for everyone, a cloud email service on a commercial plan, a shared file server, ten engineering workstations with CAD software, and computer-controlled machines on the shop floor. An outside IT company manages the servers and the firewall.

Step 1 – Map the data

The IT lead and the quality manager follow a drawing from the moment it arrives. It comes by email, is saved to the file server, is opened on CAD workstations, is turned into machine programs that are loaded onto the shop-floor machines, and the inspection report goes back by email. Sales staff sometimes forward the drawings internally. The map shows that CUI currently touches almost every system, which would put the whole company in scope.

Step 2 – Choose an enclave and scope it

The leadership team decides to shrink the scope. CUI will live only in a government-focused cloud tenant that meets the FedRAMP Moderate baseline, accessed through managed virtual desktops. The ten engineers and the quality team will use that environment; sales staff will no longer receive drawings. Using the asset categories:

The cloud tenant, the virtual desktops and the engineers' accounts are CUI Assets.
The identity service with multi-factor authentication, the firewall and the log collection service run by the outside IT company are Security Protection Assets, so the IT company's services fall inside the assessment.
The shop-floor machines receive programs derived from the drawings but cannot be fully secured, so they become Specialized Assets, documented, placed on their own network segment and managed by risk.
Office laptops that only display the virtual desktop, and cannot save or print from it, are treated as Out-of-Scope Assets, with the configuration documented to justify that.
The old file server is cleaned of CUI and removed from the CUI flow; until that is proven, it is treated as in scope.

Step 3 – Gap analysis and first score

Northfield's consultant scores the new enclave against all 110 requirements using the objectives in NIST SP 800-171A. The first result is 72. The largest deductions come from high-value gaps such as no regular audit log review, no tested incident response capability, and multi-factor authentication that covers administrators and remote access but not ordinary users. Several one-point items are also open, such as a formal policy for portable storage and documented maintenance procedures. Worse, there is no system security plan yet: without a current SSP a real assessment could not even be completed.

The team looks at what is allowed. A score of 72 is below the 88-point threshold, so no Conditional status is possible yet. Even if the score were higher, the missing SSP could never go on a POA&M, and the partial multi-factor authentication (a 3-point deduction) could not be deferred either, because only one-point items qualify. So the plan must fix the heavy items first.

Step 4 – Remediate

Over four months Northfield writes its SSP, turns on multi-factor authentication for every account in the enclave, configures the log collector to alert on failed logins and privilege changes with a weekly documented review, writes and tests an incident response plan, sets up quarterly access reviews, trains all enclave users and records the training, and obtains the provider's Customer Responsibility Matrix so that the SSP shows which requirements the cloud provider and the IT company cover. Evidence files are stored in one controlled folder, with hashes recorded, ready to be kept for six years.

Step 5 – Self-assessment and status

The formal self-assessment scores 106. Four one-point requirements remain NOT MET (for example, the media sanitisation procedure is approved but not yet followed by a full test). Because 106 is above 88, all four items are worth one point and none is on the forbidden list, Northfield achieves Conditional Level 2 (Self). It enters the score, scope and CAGE code into SPRS, and the managing director, as Affirming Official, submits the affirmation. The POA&M dates are set well within 180 days.

Step 6 – Close out and maintain

Two months later the team re-assesses the four items, records them as MET, posts the closeout result to SPRS and affirms again, reaching Final Level 2 (Self). It schedules an annual affirmation, a full self-assessment before the three-year mark, and an internal check every six months. Because the prime has signalled it may ask for third-party certification once the programme's direction is settled, Northfield keeps its evidence in a form a C3PAO could examine. Finally, Northfield checks its own suppliers: a heat-treatment company that only receives purchase orders (FCI) needs Level 1 (Self), and the company is told so in its purchase terms.

The example shows the typical shape of a CMMC project: most effort goes into scoping and documentation, the scoring rules decide what must be fixed before assessment, and the work never fully stops.

Lesson 7 – Relationship to other standards and frameworks

CMMC sits on top of other documents rather than beside them. Understanding the relationships prevents double work.

Figure 5 – How CMMC levels draw on FAR, NIST and DFARS documents and feed one record in SPRS.

Standard or framework	What it is	Relationship to CMMC
NIST SP 800-171 Rev 2	110 requirements for protecting CUI in non-federal systems	Level 2 is identical to it; DFARS 7012 already required it. Revision 3 was published by NIST in 2024, but CMMC still uses Revision 2 until a rule change says otherwise.
NIST SP 800-172	Enhanced requirements against advanced persistent threats	Level 3 uses 24 selected requirements with DoD-assigned parameters.
DFARS 252.204-7012	Contract clause on safeguarding covered defense information and reporting incidents within 72 hours	Sets the underlying obligation; CMMC verifies it. Its FedRAMP Moderate rule decides which clouds may hold CUI.
DFARS 252.204-7019 / -7020	NIST SP 800-171 DoD Assessment Methodology (Basic, Medium, High) and SPRS reporting	Older self-scoring and government checks; DIBCAC results under 7020 can override a CMMC status.
FedRAMP	US government authorisation programme for cloud services	A cloud service holding CUI must meet the Moderate baseline or an equivalent.
ISO/IEC 27001	International standard for an information security management system, certifiable worldwide	Helps build governance, risk and evidence habits, but a certificate does not grant any CMMC status; the requirements and scoring differ.
NIST Cybersecurity Framework 2.0	Voluntary outcome-based framework for managing cyber risk	Useful for strategy and board reporting; not assessable for CMMC purposes.

Two misunderstandings are worth avoiding. First, CMMC is not related to CMMI (the Capability Maturity Model Integration for process improvement) apart from the word "maturity" in the name. Second, implementing NIST SP 800-171 Revision 3 does not automatically satisfy CMMC Level 2: the requirement set, numbering and some parameters differ from Revision 2, and assessors check against Revision 2 as the rule stands. A move to Revision 3 has been discussed during the reform review, and a government-wide FAR rule on CUI was proposed in January 2025, so watch for alignment changes, but do not assume them until a rule or contract says so.

For a company that already runs an ISO/IEC 27001 management system, the best approach is to treat the 110 Level 2 requirements as an additional control set inside the existing system: scope the CUI enclave as part of the management system, map existing controls to the CMMC objectives, and fill the gaps (often FIPS-validated encryption, multi-factor authentication everywhere in scope, and US-specific incident reporting). There is currently no official mechanism that turns an ISO/IEC 27001 certificate into CMMC credit; any such change would have to come from the DoD.

Common pitfalls and best practices

Common pitfalls

Letting CUI spread across the whole company network, which forces every system and user into scope and multiplies cost.
Treating the affirmation as paperwork. A senior official is signing a statement the government relies on; inaccurate scores have led to settlements under the False Claims Act.
Assuming a cloud or IT provider "handles CMMC". Without a Customer Responsibility Matrix and an SSP that explains the split, nobody can show who meets which requirement.
Planning to defer heavy requirements with a POA&M. Only one-point items qualify, the score must reach 88, and a few requirements, including the SSP, can never be deferred.
Presenting draft policies or screenshots of settings that are not actually enforced. Evidence must be final, approved and in operation.
Calling an asset out of scope without being able to prove that it cannot process, store or transmit CUI.
Forgetting flow-down, so that a supplier handling CUI holds no status and puts the prime's contract at risk.
Stopping all work because of the 2026 suspension, even though the NIST SP 800-171 obligation and self-assessments remain in force.

Best practices

Start with a data-flow map of FCI and CUI, then design the smallest enclave that lets people do their jobs.
Write the SSP early and keep it current; it is the backbone of every assessment and the first thing an assessor reads.
Score yourself honestly with the official objectives, and fix the five-point and three-point gaps before anything else.
Choose cloud services that are FedRAMP Moderate authorised (or demonstrably equivalent) for CUI, and collect their responsibility matrices.
Build evidence collection into normal operations: scheduled log reviews, access reviews, training records and change tickets.
Name an Affirming Official who understands the programme and gets regular status reports, not just a form to sign once a year.
Keep evidence for six years and hash it for certification assessments, so its integrity can be proven later.
Track official DoD CIO announcements and contract wording, because levels, assessment types and dates are set by the contract, not by press reports.

Summary and key takeaways

CMMC is the DoD programme that verifies whether contractors protect Federal Contract Information and Controlled Unclassified Information on their own systems.
It has three levels: Level 1 (15 FAR requirements, annual self-assessment), Level 2 (the 110 NIST SP 800-171 Rev 2 requirements, self or C3PAO every three years) and Level 3 (24 NIST SP 800-172 requirements assessed by DIBCAC).
The contract sets the required status, written as a level plus an assessment type, and it must be in place before award for every system that handles the information.
Scoping with the five asset categories, ideally around a small enclave, is the decision that most affects effort and cost.
Level 2 scoring starts at 110 and subtracts 5, 3 or 1 point per unmet requirement; a Conditional status needs at least 88, only one-point items on the POA&M, and closeout within 180 days.
Results and annual affirmations by a senior Affirming Official are recorded in SPRS, and government assessments can override a self-reported status.
Since 13 July 2026, Phase 2 and later phases are suspended pending a Reform Task Force review; self-assessments and the underlying NIST SP 800-171 duty remain.
CMMC builds on NIST SP 800-171, NIST SP 800-172, DFARS 7012 and FedRAMP; ISO/IEC 27001 helps but does not replace it.

Reflection questions

Think of a company you know that works, or could work, in a defense supply chain. Which of its information would be FCI, which might be CUI, and which level would you expect a contract to require?
Sketch the data flow of one sensitive document through that company. Where would you draw the boundary of a CUI enclave, and which assets would fall into each of the five categories?
A self-assessment scores 95 with one three-point requirement and several one-point requirements unmet. What options does the company have, and what would you fix first?
How would you explain to a busy managing director what they are personally committing to when they submit a CMMC affirmation?
Given the 2026 suspension of later phases, how would you argue for continuing CMMC preparation work, and which investments would you postpone until the programme's direction is clear?