CMMC 2.0: What Federal IT Contractors Need to Know

CMMC 2.0 (Cybersecurity Maturity Model Certification) is the Department of Defense's mandatory cybersecurity framework for contractors who handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The final rule took effect in December 2024, and CMMC requirements are now being phased into DoD contracts through 2027.

If you pursue any DoD contract that involves FCI or CUI — and virtually all substantive DoD service contracts do — you must understand CMMC, where you stand, and what it takes to comply.

---

What CMMC Replaced (and Why It Exists)

Before CMMC, the DoD relied primarily on DFARS 252.204-7012 — a clause requiring contractors handling CUI to self-attest compliance with NIST SP 800-171, a 110-control cybersecurity standard. The problem: self-attestation with no third-party verification led to widespread non-compliance. Audits found that contractors were claiming compliance while having significant gaps.

CMMC was designed to add verification — third-party assessments for the most sensitive work, and annual self-attestations for lower-sensitivity work.

---

The Three CMMC Levels

Level 1: Foundational (Self-Attestation)

• Applies to: Contractors handling FCI (Federal Contract Information) only — not CUI
• Requirements: 17 cybersecurity practices from FAR 52.204-21 (basic safeguarding of federal contractor information)
• Verification: Annual self-attestation by a company senior official in the Supplier Performance Risk System (SPRS)
• Who this affects: Virtually all DoD contractors with access to any government information system or data

Level 2: Advanced (Third-Party Assessment for Most CUI Work)

• Applies to: Contractors handling CUI — the most common CMMC requirement for IT, professional services, engineering, and R&D contractors
• Requirements: All 110 practices from NIST SP 800-171
• Verification:
  • Triennial C3PAO assessment for contracts with critical CUI (defense, aerospace, intelligence)
  • Annual self-attestation for non-critical CUI (some administrative and support functions)
• C3PAO: CMMC Third-Party Assessment Organization — an accredited independent assessor

Level 3: Expert (Government-Led Assessment)

• Applies to: Contractors handling the most sensitive CUI in programs critical to national security
• Requirements: NIST SP 800-171 (110 controls) plus additional practices from NIST SP 800-172
• Verification: Government-led assessments by DCSA (Defense Counterintelligence and Security Agency)
• Who this affects: A small subset of prime contractors and key subcontractors on highest-priority DoD programs

For most small business DoD contractors: Level 2 is the target. If you handle CUI, you will need a C3PAO assessment (for critical CUI) or documented self-attestation (for lower-sensitivity CUI).

---

What Is CUI? (And Why It Matters for Contractors)

Controlled Unclassified Information (CUI) is government-created or government-controlled information that requires safeguarding but is not classified. CUI categories relevant to DoD contractors include:

• CTI (Controlled Technical Information): Engineering drawings, specifications, technical data
• Export Controlled: Information regulated under ITAR or EAR
• Naval Nuclear Propulsion Information
• Privacy information: Personnel records, PII
• Procurement and acquisition information

You likely handle CUI if you:

• Receive technical drawings, specifications, or design data from the DoD
• Work on software systems that process government data
• Handle any personnel or health information for military members
• Perform research and development under DoD contracts

If you are unsure whether your contract involves CUI, check whether your contract includes DFARS 252.204-7012. If it does, you handle CUI and CMMC will apply when the clause is updated to reflect CMMC.

---

NIST SP 800-171: The 110 Controls

CMMC Level 2 is built on NIST SP 800-171 Rev 2, which contains 110 security requirements organized into 14 control families:

1. Access Control (22 requirements)
2. Awareness and Training (3)
3. Audit and Accountability (9)
4. Configuration Management (9)
5. Identification and Authentication (11)
6. Incident Response (3)
7. Maintenance (6)
8. Media Protection (9)
9. Personnel Security (2)
10. Physical Protection (6)
11. Risk Assessment (3)
12. Security Assessment (4)
13. System and Communications Protection (16)
14. System and Information Integrity (7)

Most small businesses are missing 20–50 of these requirements when they first self-assess. Common gaps include:

• Multi-factor authentication (MFA) for all CUI systems
• System and network activity logging/monitoring
• Formal incident response plan with tested procedures
• Media sanitization procedures for retiring equipment
• Formal risk assessment documentation

---

How to Prepare for CMMC Assessment

Step 1: Scope Your CUI Environment

Define exactly which systems, personnel, and locations touch CUI. The smaller your "CMMC boundary" (the scope of your assessment), the less expensive and complex compliance becomes.

Many small businesses achieve significant scoping benefits by:

• Isolating CUI on dedicated systems (not mixed with commercial systems)
• Using a cloud service provider with FedRAMP authorization for CUI storage
• Limiting CUI access to a small subset of employees

Step 2: Conduct a Gap Assessment Against NIST 800-171

Hire a CMMC Registered Practitioner (RP) or Registered Practitioner Organization (RPO) to assess your current controls against all 110 NIST 800-171 requirements. They will produce a gap report identifying which requirements you do not currently meet.

Step 3: Create a System Security Plan (SSP)

Document your current cybersecurity practices in a System Security Plan. This is required by DFARS 252.204-7012 and CMMC — it is the authoritative description of how you implement each of the 110 NIST controls.

Step 4: Create a Plan of Action and Milestones (POAM)

For requirements you do not currently meet, document your remediation plan in a POAM. CMMC allows some POAMs (for limited categories of requirements) at the time of assessment — you do not need 100% compliance at assessment start for all 110 controls, but critical requirements must be met.

Step 5: Submit Your SPRS Score

Before your formal C3PAO assessment, calculate your SPRS (Supplier Performance Risk System) score — a numerical assessment of your NIST 800-171 compliance. Self-report this in SPRS. DoD contracting officers check SPRS scores during contract awards.

The maximum score is 110. Most contractors start with a negative score (each unmet requirement deducts points). A SPRS score below 70 is a significant red flag during source selection.

Step 6: Schedule Your C3PAO Assessment

Select an accredited C3PAO (CMMC Third-Party Assessment Organization) from the Cyber AB Marketplace. C3PAO assessments take 2–5 days on-site (plus planning and documentation review), cost $30,000–$150,000 depending on scope, and produce either a pass or conditional pass with a POAM.

---

CMMC Timeline: When Requirements Hit

The DoD is phasing CMMC into contracts between 2025 and 2027:

• 2025: CMMC requirements begin appearing in new DoD solicitations above the simplified acquisition threshold
• 2026: Requirements expand to the majority of new DoD acquisitions
• 2027: Full implementation — essentially all DoD contracts requiring CUI access will require CMMC compliance

If your current DoD contracts do not yet include CMMC requirements, they will be incorporated at renewal or modification. Do not wait for the clause to appear — start your compliance journey now.

---

Cost of Non-Compliance

Failing to meet CMMC requirements when required has serious consequences:

1. Proposal disqualification: Non-compliant firms will not be eligible for contract award if CMMC is a solicitation requirement.
2. Contract termination: If a contractor self-attests to compliance and is found non-compliant, the government can terminate the contract for default.
3. False Claims Act liability: Self-attesting compliance when you know you are non-compliant is a potential False Claims Act violation — with treble damages and civil penalties.
4. Cyberattack exposure: Non-compliant cybersecurity posture means real risk of data breach, which carries its own legal and financial consequences.

---

Key Takeaways

• CMMC 2.0 has three levels — most contractors handling CUI need Level 2 (NIST 800-171 compliance with C3PAO assessment).
• Self-attestation served until 2024 — now third-party assessments are required for critical CUI work.
• Scope your CUI environment aggressively — smaller scope means lower assessment cost and faster compliance.
• SPRS score in SPRS.mil is checked by contracting officers — submit an accurate score, then work to improve it.
• Gap assessment + SSP + POAM are the three foundational compliance documents — create them before pursuing DoD CUI contracts.
• Non-compliance has False Claims Act exposure — do not self-attest compliance you cannot demonstrate.

Track DoD contract opportunities and CMMC requirements with RFxNerd →