%20(66)-1.jpg)
Disclaimer: This article was originally published on May 25, 2023 and has since been updated to reflect the final CMMC guidelines.
The Cybersecurity Maturity Model Certification (CMMC) is required for any business that works with the Department of Defense (DoD). If your company handles sensitive government data, you must get CMMC certification to bid on DoD contracts.
Many defense contractors worry about new cybersecurity rules. If you don't follow them, you could lose important government contracts. The certification process may be confusing.
Without proper guidance, you may risk falling behind companies who are already certified.
Intelligent Technical Solutions (ITS) helps businesses meet these security requirements. With over 20 years of experience, our certified CMMC experts have helped hundreds of companies get approved.
This article explains who needs CMMC and how to get certified. With the help of ITS Chief Security Risk Officer, Sean Harris, we’ll uncover answers key questions like:
After reading, you'll learn what government information requires CMMC and which level your business needs to keep contracts.
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is a cybersecurity program created by the Department of Defense. It protects vendors, contractors, and suppliers that work with the DoD.
The program was created to solve the problem involving hackers attacking government contractors. These attacks let hackers steal important government information.
According to the Federal Register, the final CMMC rule started on December 16, 2024.
Which Businesses Need CMMC Compliance?
The DoD says over 300,000 organizations will need to follow CMMC standards. You need to know if your business is one of them.
All businesses that work with the DoD and handle government data must comply. This includes contractors and subcontractors who provide products or services.
Harris explains: "Any organization that wants to do work with the Department of Defense or any vendor that's doing work for the Department of Defense is going to be subject to CMMC. So, at the very least, they'll be subject to identifying and scoping if their data is subject to it."
Your industry or business size does not matter. If you handle data for DoD, you need CMMC certification.
What Level of CMMC Certification Do You Need?
The CMMC framework has three levels, with each level having stricter cybersecurity rules.
Level 1: Basic Safeguarding of FCI
Level 1 is for companies that handle Federal Contract Information (FCI). FCI is contract information given by the government.
Businesses must follow 17 basic cybersecurity rules. You can get Level 1 certification through self-assessment, which you need to do yearly.
Read More: Can You Perform a CMMC Self-Assessment?
Level 2: Broad Protection of CUI
Level 2 is for businesses that handle Controlled Unclassified Information (CUI). CUI is information created by the government that needs special protection.
Level 2 has 110 cybersecurity practices. There are two ways to do Level 2 assessments:
- Level 2 (Self) - You assess your own company every three years and enter the results into a system called SPRS.
- Level 2 (C3PAO) - A certified third-party assessor checks your company and certifies your compliance.
Level 3: Higher-Level Protection of CUI Against Advanced Persistent Threats
Level 3 is the highest level of security in CMMC. It protects CUI in the DoD's most important programs against advanced persistent threats or serious cyber attacks.
You cannot assess yourself or hire a third-party assessor for this level. Instead, a government agency called DCMA DIBCAC (Defense Contract Management Agency Defense Industrial Base Cybersecurity Assessment Center) conducts all Level 3 assessments every three years.
To achieve Level 3 certification, you must meet all 110 Level 2 requirements from NIST SP 800-171, plus 24 additional enhanced security requirements from NIST SP 800-172. These extra 24 requirements provide stronger protections against sophisticated cyber threats.
In addition, you must already have Level 2 (C3PAO) certification before you can get Level 3.
Read More: What CMMC Level Do I Need? (A 5-Step Guide to CMMC Maturity)
Understanding FCI and CUI
The type of government data you handle decides your CMMC level.
Federal Contract Information (FCI) includes data given by the government for a contract. Examples are documents, emails, and reports.
Controlled Unclassified Information (CUI) is more sensitive. It needs protection based on laws or government rules. Examples include export-controlled data and private business information.
If you only handle FCI, Level 1 is enough. If you work with CUI, you need Level 2 or Level 3.
What Happens If You Don't Get CMMC Compliance?
Ignoring CMMC can have serious consequences for your business.
For one, not getting certified completely blocks you from the DoD supply chain. This means you cannot bid on contracts that need certification.
The lack of compliance also puts your company at risk. Without good cybersecurity, your business and client data face bigger threats. Defense contractors who fail to get certification often lose business to competitors.
Ready to Get CMMC Certified Today?
CMMC compliance is required for businesses working with the Department of Defense. Certification protects your ability to bid on government contracts.
The three-level framework gives clear requirements. Level 1 covers basic protections for FCI. Level 2 uses advanced cybersecurity for CUI. Level 3 handles expert-level protections for priority programs.
ITS has the knowledge to help you meet CMMC requirements easily. We have helped hundreds of organizations get compliance.
Starting early gives you an advantage over competitors.
Want to know which CMMC Level works best for your business? Schedule a meeting with ITS compliance experts or download our eBook on CMMC compliance to start preparing for your certification assessment today.
To learn more about CMMC compliance, discover these free resources (and more) in our Learning Center:
- How Much Does CMMC Compliance Cost? (& Is It Worth It?)
- CMMC Compliance and MSPs: Do They Need It? (+ 8 Security Standards)
Frequently Asked Questions (FAQs) About CMMC Compliance
Q: Who is required to get CMMC certification?
A: Any business that works with the Department of Defense and handles government information must get CMMC certification. This includes all contractors, subcontractors, and service providers in the defense supply chain.
Q: What is the difference between Level 1 and Level 2 CMMC?
A: Level 1 requires 17 basic security controls and allows you to assess your compliance every year. Level 2 requires 110 advanced controls and needs either a third-party assessment or a self-assessment every three years depending on the contract.
Q: How long does CMMC certification last?
A: Level 1 certification needs a self-check every year. Level 2 and Level 3 certifications last three years before you need another check.
Q: Can small businesses achieve CMMC compliance?
A: Yes, small businesses can get CMMC compliance. The level you need depends on what type of government data you handle, and not how big your company is.
Q: What happens if I lose my CMMC certification?
A: If you lose certification, you cannot bid on or keep DoD contracts that require it. You must pass a new assessment before you can work on those contracts again.
Topics:
