Insights · Question
Do we need CMMC?
If you hold or expect to hold a US Department of Defense contract, or a subcontract under one, that involves Federal Contract Information or Controlled Unclassified Information, yes, at the level the contract specifies. Level 1 covers basic safeguarding of Federal Contract Information with an annual self-assessment. Level 2 applies the NIST SP 800-171 requirements to Controlled Unclassified Information, assessed by self-assessment or by an authorized third-party assessment organization depending on the contract. The level is determined by the information, not by preference, and prime contractors flow the requirement down. A contractor uncertain what information it handles should resolve that first.
In more detail
The reasoning.
Level 2 is a sustained program: a gap assessment against 800-171, a System Security Plan written to the real environment, an enclave that keeps CUI scope manageable, evidence an assessor can sample, and an assessment date. Contractors fail on a consistent set of requirements they believed they met.
Organizations outside the defense supply chain do not need CMMC, but customers in other sectors increasingly ask for 800-171 or CSF alignment, and the same work serves both.
See CMMC readiness, CMMC Level 1 versus Level 2, the government contractors page and what is CUI.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 90 days