Atch 3 - CMMC-Information.pdf

This document is an informational resource from the Department of Defense Chief Information Officer regarding the Cybersecurity Maturity Model Certification (CMMC) Program implementation.

The CMMC Program is a cybersecurity compliance framework designed to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within the defense industrial base. The program operates on a three-tier maturity model: Level 1 requires annual self-assessment of 15 basic safeguarding requirements aligned with FAR clause 52.204-21; Level 2 mandates either triennial self-assessment or independent certification by an authorized Third-Party Assessment Organization (C3PAO) against 110 NIST SP 800-171 Revision 2 requirements; and Level 3 requires triennial assessment by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) against 24 advanced requirements from NIST SP 800-172. All assessment results must be entered into the Supplier Performance Risk System (SPRS), and contractors must provide annual affirmations of compliance. Plans of Action and Milestones (POA&Ms) are permitted only for Level 2 and Level 3 assessments, with closeout assessments required within 180 days of conditional status.

CMMC implementation began November 10, 2025, following a phased four-year rollout through November 2028. Phase 1 (November 2025–November 2026) focuses on Level 1 and Level 2 self-assessments; Phase 2 (November 2026–November 2027) adds Level 2 Certification requirements; Phase 3 (November 2027–November 2028) introduces Level 3 Certification; and Phase 4 (November 2028 onward) mandates applicable CMMC Level requirements as a condition of contract award. The Department of War may accelerate Level 2 (C3PAO) or Level 3 requirements in select Phase 1 or Phase 2 procurements, potentially limiting competition and increasing costs.