CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense's framework for protecting Controlled Unclassified Information across the defense supply chain. If you handle CUI, you'll need certification to keep your contracts.
Any contractor or subcontractor that handles Controlled Unclassified Information for the DoD. That's roughly 80,000 companies across the defense industrial base.
Most contractors need CMMC Level 2 — implementation of all 110 controls in NIST SP 800-171, verified by a third-party assessor (called a C3PAO).
A System Security Plan (SSP), a Plan of Action and Milestones (POA&M), and a SPRS self-assessment score uploaded to the DoD's Supplier Performance Risk System.
Without certification, you can't bid on or renew DoD contracts that involve CUI. Primes are already requiring CMMC compliance from their subcontractors.
Controlled Unclassified Information is government-owned or government-created information that requires protection under federal law, regulation, or policy — but isn't classified. If you're handling something sensitive on behalf of the federal government, but it doesn't carry a classified marking, it's likely CUI.
The CUI program is governed by 32 CFR Part 2002 and managed by the National Archives (NARA), which maintains a registry of every approved CUI category. There are over 100 specific categories. For DoD contractors, the categories that come up most often are:
Engineering drawings, specifications, technical reports, source code, and other data with military or space application.
Data covered by ITAR or EAR — defense articles, defense services, and dual-use technology subject to export restrictions.
Source selection information, proposals, contract data, and pricing information that's sensitive to the procurement process.
Personal information about federal personnel, contractors, or other individuals collected under federal authority.
If you're not sure what categories apply to your contract, the contract itself, the DD Form 254 (for cleared work), or your contracting officer can confirm. The full registry is maintained at archives.gov/cui.
Federal Contract Information is information not intended for public release that's provided by or generated for the federal government under contract — but doesn't carry the safeguarding requirements of CUI. If you do work for the government and produce contract artifacts that aren't sensitive enough to be CUI, you're handling FCI.
The FCI definition comes from FAR 52.204-21, the Federal Acquisition Regulation clause that requires basic safeguarding for contract information. This clause is the foundation of CMMC Level 1.
FCI is everyday contract information: invoices, basic deliverables, work orders, routine emails about a contract. CUI is the sensitive subset that requires explicit protection — engineering drawings, technical specifications, source selection data, and other categories the government has formally designated.
Most defense contractors handle FCI on every contract. Only some handle CUI — typically those whose contracts involve technical, scientific, or otherwise sensitive material.
The contract clauses are the source of truth. Contracts requiring CMMC Level 1 typically include only FAR 52.204-21. Contracts requiring CMMC Level 2 add DFARS 252.204-7012, which governs CUI handling. If your contract has only the FAR clause, you're an FCI/Level 1 shop. If it has the DFARS clauses too, CUI is in scope and Level 2 applies.
CMMC 2.0 has three levels, scaled to the sensitivity of the information involved. The level that applies to you is set by your contract, not by you. Most defense contractors handling CUI fall into Level 2.
The program you'll be assessed against today is CMMC 2.0. It's a meaningful simplification of the original framework, and understanding what changed helps explain why the program looks the way it does.
The original framework had five maturity levels and added DoD-specific practices on top of NIST 800-171. It also required third-party assessment for nearly every contractor handling CUI, with no allowance for partial compliance at certification time.
The DoD streamlined the framework after extensive industry feedback. Five levels collapsed to three. The DoD-specific practices were dropped — Level 2 now aligns directly with NIST 800-171 Rev 3, no additions. Some contractors can self-assess at Level 2 if their contract allows it. POA&Ms are now permitted at certification time for select controls, with closure required within 180 days. The result: a tighter, more achievable framework that contractors and assessors find easier to work with.
The Department of Defense is rolling CMMC requirements into contracts gradually. Here's where things stand and what's coming.
CMMC Level 2 doesn't ask for a single document — it asks for a coordinated set of artifacts that, together, describe your security posture and your plan to address gaps.
If you're new to CMMC, the alphabet soup of organizations and credentials can be confusing. Here's a quick guide.
Take the guided readiness interview. Walk away with a score, a gap list, and a draft of the documents CMMC requires.