Glossary · C
CMMC
The Cybersecurity Maturity Model Certification is the US Department of Defense program that verifies contractors protect Federal Contract Information and Controlled Unclassified Information at the level their contracts require.
Extended definition
In more detail.
Level 1 covers basic safeguarding of Federal Contract Information with an annual self-assessment. Level 2 applies the NIST SP 800-171 requirements to Controlled Unclassified Information, assessed by self-assessment or by an authorized third-party assessment organization depending on the contract. Level 3 adds requirements from NIST SP 800-172 for the most sensitive programs. The level is set by the information in the contract and flows down to subcontractors.
In our work
Where it appears.
See CMMC readiness, the government contractors industry page and CMMC Level 1 versus Level 2.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days