Atch 3 - CMMC-Information..pdf

This is an informational document from the Department of Defense Chief Information Officer regarding the Cybersecurity Maturity Model Certification (CMMC) Program implementation.

The CMMC Program is a Department of War initiative designed to strengthen defense industrial base cybersecurity by assessing contractor compliance with information safeguarding requirements for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The program operates on a tiered model with three certification levels. Level 1 requires annual self-assessment and affirmation of compliance with 15 security requirements aligned with FAR clause 52.204-21. Level 2 mandates either a self-assessment or third-party assessment by an authorized C3PAO every three years, verifying compliance with 110 requirements from NIST SP 800-171 Revision 2, plus annual affirmation. Level 3 requires achieving Level 2 status first, undergoing assessment every three years by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), and providing annual affirmation of compliance with 24 requirements from NIST SP 800-172. All CMMC assessments must result in affirmations entered into the Supplier Performance Risk System (SPRS). Plans of Action and Milestones are permitted only at Levels 2 and 3 and must be closed within 180 days of achieving conditional status.

The phased implementation began November 10, 2025, with Phase 1 focusing on Level 1 and Level 2 self-assessments. Phase 2 begins November 10, 2026, introducing Level 2 certification requirements. Phase 3 commences November 10, 2027, adding Level 3 certification requirements. Phase 4 achieves full implementation by November 10, 2028, when all solicitations and contracts will include applicable CMMC level requirements as conditions of award. The Department may defer certification requirements to option periods during the phased rollout.