CMMC 2.0 FAQs

CMMC 2.0 (Cybersecurity Maturity Model Certification 2.0) is the U.S. Department of Defense’s updated cybersecurity framework designed to protect sensitive government information within the defense industrial base (DIB). It establishes a standardized set of cybersecurity requirements that DoD contractors must meet to handle Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

CMMC 2.0 simplifies the original CMMC model by reducing the number of certification levels, aligning more closely with existing NIST standards, and clarifying assessment requirements.

CMMC 2.0 significantly streamlines the original framework by reducing five maturity levels down to three. It also removes many process documentation requirements that exceeded NIST standards and introduces greater flexibility through self-assessments for lower-risk contractors.

Key changes include:

• Fewer certification levels
• Reduced assessment burden
• Greater alignment with NIST SP 800-171
• Limited use of Plans of Action & Milestones (POA&Ms)

CMMC 2.0 consists of three compliance levels based on the sensitivity of information handled:

• Level 1 (Foundational):
  Focuses on basic safeguarding requirements for Federal Contract Information (FCI). Annual self-assessment required.

• Level 2 (Advanced):
  Applies to contractors handling Controlled Unclassified Information (CUI). Requires implementation of all NIST SP 800-171 controls. Some organizations must undergo third-party assessments.

• Level 3 (Expert):
  Reserved for contractors supporting the most critical national security programs. Requires advanced controls based on NIST SP 800-172 and government-led assessments.

• Federal Contract Information (FCI):
  Information provided by or generated for the government under a contract that is not intended for public release.

• Controlled Unclassified Information (CUI):
  More sensitive data that requires safeguarding under federal regulations, including export-controlled information and technical data.

Handling CUI triggers stricter cybersecurity requirements and typically places organizations at CMMC Level 2.

Yes. CMMC 2.0 Level 2 is directly aligned with NIST SP 800-171, requiring implementation of all 110 security controls.

Organizations already working toward NIST 800-171 compliance are well positioned for CMMC 2.0, though formal validation and documentation are still required.

Any organization that contracts directly with the Department of Defense — or serves as a subcontractor within the DoD supply chain — may be required to comply with CMMC 2.0.

Compliance requirements will depend on:

• The type of data handled (FCI or CUI)
• The contract requirements
• The assigned CMMC level

CMMC requirements are included in DoD contracts as of November 10, 2025. The Department of Defense (DoD) officially activated Phase 1 of the CMMC 2.0 rollout, making cybersecurity certification a mandatory requirement for winning new DoD contracts and renewals. Compliance is no longer voluntary, marking a shift from planning to active enforcement. 

DIB contractors hold and use sensitive government data to develop and deliver goods and services. CMMC compliance helps ensure that they secure this information the same way that military departments and government agencies do.

It depends on the CMMC level and contract risk designation:

• Level 1: Annual self-assessment

• Level 2:

  • Self-assessment for some contracts

  • Third-party assessment by a C3PAO for higher-risk contracts

• Level 3: Government-led assessments only

The DoD will determine assessment requirements at the contract level.

CMMC is a certification program introduced to improve supply chain security in the defense industrial base (DIB). By the end of 2025, the DoD will require all contractors to be certified to one of the three CMMC levels.

Becoming compliant involves identifying your required compliance level, conducting a gap assessment, and implementing the necessary cybersecurity controls. Organizations must document policies and undergo third-party assessments.

The timeline can vary depending on your organization’s preparedness and the level of compliance required. On average, the entire process can take anywhere from 12-18 months.

CMMC 2.0 certifications must be renewed every three years. Organizations are required to undergo a new assessment to ensure that they continue to meet standards for their compliance level. Significant changes such as mergers and acquisitions could trigger the need for a new third party assessment if changes to the assessed system take place. Additionally, Organizations will also need to complete an annual self-assessment.

CMMC 2.0 focuses on protecting Federal Contract Information and (FCI) and Controlled Unclassified Information (CUI).

As of November 10, 2025, the Department of Defense's (DoD) final rule for the Cybersecurity Maturity Model Certification (CMMC) program officially goes into effect.

This begins a phased implementation period that will integrate CMMC requirements into new defense contracts and solicitations.

The initial phase focuses on CMMC Level 1 and Level 2 self-assessments for applicable contracts involving Federal Contract Information (FCI) or less sensitive Controlled Unclassified Information (CUI). The DoD has the discretion to require a C3PAO (third-party certification assessment) for certain Level 2 contracts even during this phase.

Let our talented team of RP's help get your organization to reach Level 1 with our CMMC LevelUp process!

Organizations should monitor updates to ensure they meet compliance deadlines for specific contracts. To learn more, check out our timeline here.

More resources can be found on the official CMMC website managed by the DoD. Additional information can be found in the NIST 800-171 framework and through Certified Third-Party Assessment Organizations (C3PAOs). For a full breakdown, see our complete list of CMMC 2.0 requirements.

Related Resources:

CMMC 2.0 LevelUp Process

CMMC 2.0 Readiness Assessments

CMMC Terms Glossary

Official DoD CMMC pages

NIST 800-171 documentation

A C3PAo is a third-party certification assessment. The DoD has the discretion to require a C3PAO (third-party certification assessment) for certain Level 2 contracts.

CMMC 2.0 allows limited use of POA&Ms under specific conditions. Organizations must meet a minimum compliance threshold and remediate deficiencies within defined timelines.

Certain high-risk security controls are not eligible for POA&Ms and must be fully implemented before certification.