What Is CMMC 2.0 and Who Needs It?

CMMC 2.0 is the Department of Defense's cybersecurity certification framework for contractors who handle federal contract information or controlled unclassified information. Here's what every defense contractor needs to know about the three levels, who's affected, and when it goes into effect.

Background: Why CMMC Exists

The Department of Defense introduced the Cybersecurity Maturity Model Certification (CMMC) program to combat the persistent theft of sensitive defense information from its contractor base. For years, adversaries — primarily state-sponsored actors — successfully exfiltrated controlled unclassified information (CUI) and federal contract information (FCI) from small and mid-sized contractors who lacked the cybersecurity controls of large defense primes. CMMC was designed to change that by making cybersecurity a contractual prerequisite, not just a self-reported checkbox.

The original CMMC 1.0 framework, released in 2020, required third-party assessments across five maturity levels. CMMC 2.0, finalized in late 2021 and codified into the Defense Federal Acquisition Regulation Supplement (DFARS) in late 2024, streamlined the model to three levels and reduced the assessment burden for most contractors while preserving rigorous third-party oversight for the highest-risk work.

The Three Levels of CMMC 2.0

Level 1 — Foundational

Level 1 applies to contractors who handle Federal Contract Information (FCI) — information provided by or generated for the government under a contract, but not intended for public release. Level 1 requires compliance with 17 basic safeguarding practices drawn from FAR clause 52.204-21. Annual self-assessment is permitted, and contractors affirm their compliance through a senior official attestation submitted to the Supplier Performance Risk System (SPRS).

Level 2 — Advanced

Level 2 is the most significant tier for the majority of the defense industrial base. It applies to contractors who handle CUI — a category of sensitive government information that is not classified but still requires protection under law, regulation, or policy. Level 2 maps directly to the 110 security requirements in NIST Special Publication 800-171.

There are two paths under Level 2. Contractors handling CUI on non-prioritized programs may conduct a self-assessment and submit results to SPRS with a senior official attestation. Contractors on programs that the DoD designates as handling CUI for critical programs or high-value assets must undergo a triennial assessment by a Certified Third-Party Assessment Organization (C3PAO). The C3PAO assessment results are uploaded directly to SPRS by the assessor.

Level 3 — Expert

Level 3 targets contractors supporting the DoD's most critical programs — those likely to be targeted by advanced persistent threats (APTs). It incorporates all 110 NIST 800-171 requirements plus a subset of controls from NIST SP 800-172. Level 3 assessments are conducted by the Defense Contract Management Agency (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), not by C3PAOs. Level 3 represents a small fraction of the defense industrial base.

Who Is Affected?

Any company that holds or seeks DoD contracts must pay attention to CMMC. The practical trigger is whether your contracts involve FCI or CUI. If you receive any information created for or by the government in the performance of a contract, you handle FCI. If any of that information falls into a CUI category (technical specifications, export-controlled data, privacy information, etc.), you handle CUI and almost certainly need Level 2 compliance.

Subcontractors are not exempt. If a prime contractor passes CUI down to a subcontractor, that subcontractor must meet the same CMMC level required by the prime's contract. The obligation flows to every tier of the supply chain that touches covered information.

Timeline and Contract Rollout

CMMC requirements are being phased into DoD solicitations beginning in 2025. The DoD committed to including CMMC Level 2 requirements in a subset of contracts in the first year of the rule, scaling to full implementation across all applicable contracts over subsequent years. By fiscal year 2028, virtually all contracts that involve CUI are expected to include CMMC Level 2 or higher as a contract award prerequisite.

The practical implication: contractors who begin their assessment preparation now have a meaningful head start. C3PAO capacity is limited, and lead times for scheduled assessments have already extended to several months in many regions. Waiting until CMMC appears in a specific solicitation is a strategy that risks losing contract eligibility.

What You Should Do Now

Start by determining what level applies to your contracts — review your contract language for references to DFARS 252.204-7012, CUI, or specific CMMC levels. Conduct a gap assessment against NIST 800-171 and document your findings in a System Security Plan (SSP). Calculate and submit your SPRS score. If you need a C3PAO assessment, begin the vendor selection process well in advance of your contract deadlines.