What Is CMMC? A CMMC 2.0 Guide for Supply-Chain Manufacturers

The short answer
CMMC (Cybersecurity Maturity Model Certification) is the US Department of Defense's cybersecurity certification for its supply chain. It verifies that contractors properly protect defense contract information — and without the level your contract specifies, you can't win or renew that contract.

Key takeaways

• CMMC 2.0 has three levels — Level 1 (Foundational), Level 2 (Advanced) and Level 3 (Expert) — based on how sensitive the information you handle is.
• Level 2 is the target for most suppliers. It maps to the 110 requirements in NIST SP 800-171.
• Since November 10, 2025, CMMC requirements appear in new defense contracts. Phase 1 (self-assessment) remains in force.
• As of October 2026, Phase 2 (third-party assessments) was paused for review in July 2026 with no new date announced — which is no reason to stop preparing.
• Overseas manufacturers that sit anywhere in the US defense supply chain, including as subcontractors, can be required to comply by their prime contractor.

What is CMMC?

CMMC — the Cybersecurity Maturity Model Certification — was created by the US Department of Defense (DoD).

The problem it solves is simple. Hundreds of thousands of companies make up the US defense supply chain, and designs, specifications and contract information flow between them. For years the DoD only asked suppliers to self-attest that their security was adequate, and audits kept finding that many weren't. CMMC replaces self-attestation with assessment and evidence.

The two kinds of information CMMC protects

Rule of thumb: if you only handle FCI, you need Level 1; if you touch CUI, you need at least Level 2. The required level is ultimately stated in your contract.

From 1.0 to 2.0

CMMC 1.0 launched in November 2020 with five levels and some CMMC-specific practices; many smaller suppliers found it too complex. In November 2021 the DoD announced CMMC 2.0, which cut the model to three levels and aligned it directly with existing NIST standards.

Who needs CMMC?

• Prime contractors that hold DoD contracts directly.
• Their subcontractors and suppliers — including those overseas. Primes must flow CMMC requirements down to any supplier that handles FCI or CUI.
• The main exception: suppliers of commercial off-the-shelf (COTS) products only.

For an overseas manufacturer, the usual trigger is a US customer that's a defense prime starting to ask for your CMMC level or SPRS score as a purchasing condition.

What about cloud providers? Cloud services don't need CMMC certification themselves, but if they store CUI they must meet FedRAMP Moderate or equivalent requirements.

The three CMMC 2.0 levels

Terms: SPRS is the DoD's Supplier Performance Risk System, where self-assessment scores are recorded. A C3PAO is a third-party assessment organization authorized by the Cyber AB. DIBCAC is the DoD's Defense Industrial Base Cybersecurity Assessment Center.

The 14 Level 2 families

Access Control; Awareness and Training; Audit and Accountability; Configuration Management; Identification and Authentication; Incident Response; Maintenance; Media Protection; Personnel Security; Physical Protection; Risk Assessment; Security Assessment; System and Communications Protection; System and Information Integrity. Access Control alone accounts for 22 requirements and is usually the heaviest lift.

How scoring works

• Meet all 110 requirements and you achieve Final status, valid for three years.
• Score between 88 and 109 and you can receive Conditional status, but every open item must go into a plan of action and milestones (POA&M) and be closed within 180 days, or the status is revoked.
• Some critical requirements can't be deferred to a POA&M and must be met at assessment time.

Timeline (as of October 2026)

Phase 2 is paused. Should we still prepare?

Yes, for three reasons:

1. Phase 1 isn't paused. Level 1 and Level 2 self-assessment requirements are still in force and still appear in new contracts.
2. Preparation takes time. Going from zero to ready for a Level 2 assessment typically takes 6 to 18 months. If you wait for the restart, you'll be late.
3. Assessor capacity is limited. The US Government Accountability Office counted just 92 C3PAOs in December 2025, facing tens of thousands of suppliers that need Level 2. According to the Cyber AB in October 2025, fewer than 500 companies had achieved Level 2 certification.

This section changes quickly. Check the DoD CIO's official CMMC site for the latest.

How to prepare for CMMC: six steps

1. Confirm your level and scope: use contracts and customer requirements to decide between Level 1 and Level 2, and identify which systems, people and locations FCI or CUI pass through. Output: scoping document.
2. Draw your CUI boundary: concentrate CUI in as few systems as possible — a smaller scope dramatically lowers cost. Output: system boundary diagram.
3. Run a gap analysis: check your current state against all 110 requirements. Output: gap analysis, preliminary SPRS score.
4. Write your system security plan (SSP): describe how each requirement is met in your environment. It's the first document an assessor reviews. Output: SSP.
5. Close gaps and collect evidence: fix what's missing and prepare evidence for every requirement — configuration screenshots, scan reports, logs, training records, procedures. Output: evidence package, POA&M.
6. Assess and maintain: enter self-assessment results in SPRS, or engage a C3PAO if third-party assessment is required; then affirm annually. Output: assessment result, annual affirmation.

What it costs

The DoD's 2024 regulatory impact analysis estimates that a small business will spend roughly US$37,000 to US$120,000 over five years to achieve and maintain Level 2, depending on scope and starting maturity.

Common mistakes

• "We're not a US company, so this doesn't apply." CMMC flows through contracts, not nationality.
• "We've done NIST 800-171, so we've done CMMC." The requirements are the same, but CMMC needs them verified — your evidence has to stand up to an assessor.
• Getting scope wrong. Putting the whole company in scope can multiply effort and cost.
• Documents without operating records. Assessors want to see controls running over time, not paperwork written the week before.
• Overstating your self-assessment score. False compliance claims can trigger liability under the US False Claims Act, including treble damages.

How CMMC relates to other frameworks

Read more: What is ISO 27001, What is compliance

How Guidant AI helps

The three things at the heart of a Level 2 assessment — the system security plan, the evidence, and the POA&M — are the core objects Guidant AI manages.

• Built-in CMMC 2.0 framework: Level 1 and Level 2 controls and assessment objectives are ready to go.
• System security plan: record the implementation status and narrative for every control, and export it for your assessor.
• Tasks and evidence: every assessment objective maps to a task and an owner; uploaded evidence attaches to the right item, and AI suggests where each file belongs.
• Automated scanning: a detection agent in your environment runs vulnerability and configuration scans, and the reports become evidence automatically.
• Internal audit and POA&M: run an internal pre-assessment first; findings flow straight into a remediation plan with tracked due dates.
• On-premises: install it in your own data center, so CUI-related evidence never goes to an outside cloud.

Guidant AI is not a C3PAO and does not issue CMMC certifications. We help you get fully prepared — with all the evidence in place — before the assessment.

[Book a demo →]

See how Guidant AI maps to it →

FAQ