What CMMC is
The Cybersecurity Maturity Model Certification (CMMC) is a US Department of Defense program that requires contractors to prove they protect sensitive defense information. CMMC 2.0 has three levels; Level 2 is the one most contractors handling sensitive data need.
What Level 2 requires
Level 2 protects Controlled Unclassified Information (CUI). It requires implementing the 110 security requirements of NIST SP 800-171 — covering areas such as access control, incident response, and configuration management.
How you're assessed
Most Level 2 contractors that handle CUI must pass a third-party assessment by a Certified Third-Party Assessment Organization (C3PAO) every three years; some lower-risk cases may self-assess, depending on the contract. These requirements are being phased into DoD contracts.
Who needs it
Companies in the Defense Industrial Base (DIB) — prime contractors and subcontractors that handle CUI on DoD work.
How to prepare
Start with a NIST 800-171 gap assessment, then build a System Security Plan (SSP), a Plan of Action & Milestones (POA&M) for any gaps, and evidence for each of the 110 requirements.
How muVerity helps
We run the 800-171 gap assessment, build your SSP and POA&M, remediate gaps, and get you assessment-ready.