CMMC 2.0 is the DoD's security certification for the Defense Industrial Base handling FCI and CUI.
Non-compliance risks lost contracts, financial penalties, reputational damage, and greater breach exposure.
Chainguard Containers significantly reduce the toil and time needed to reach CMMC 2.0 compliance.
CMMC 2.0, or Cybersecurity Maturity Model Certification, is a cybersecurity framework established by the U.S. Department of Defense (DoD). It aims to ensure that contractors and subcontractors within the Defense Industrial Base (DIB) comply with rigorous cybersecurity standards. CMMC 2.0 replaces the previous CMMC model with a streamlined and updated version that incorporates lessons learned and feedback from industry stakeholders.
If you are a contractor, subcontractor, or supplier contracting with the DoD, you will need to meet the requirements of CMMC 2.0 regardless of the size of your organization or the type of product or service you are providing. This guide will provide a comprehensive overview of CMMC 2.0, detailing its practices, the importance of compliance, and practical guidance on meeting its requirements. At the end of this guide, you will learn how Chainguard Containers can be used to significantly reduce the toil and time needed to achieve CMMC 2.0 compliance.
Who is required to be compliant?
CMMC 2.0 compliance is mandatory for all organizations involved in DoD contracts where Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) is handled. This includes:
Prime Contractors: Organizations directly awarded contracts by the DoD that must meet specific CMMC certification levels based on contract requirements.
Subcontractors: Companies providing goods or services to prime contractors, especially if they handle or access CUI or FCI.
Suppliers: Entities within the supply chain that interact with sensitive information relevant to DoD projects.
The DIB encompasses a wide variety of contractors and suppliers, including commercial firms, not-for-profit research centers and university laboratories, and government-owned industrial facilities. The products and services these entities provide are even more diverse, ranging from large sophisticated weapons platforms (e.g., missile defense systems) to highly specialized operational support (e.g., satellite communications) to general commercial products (e.g., medical equipment). Regardless of the type of organization or the product or service they provide, all contractors servicing the DIB must achieve compliance with CMMC 2.0. However, as we will discuss more below, the compliance requirements vary according to the specific CMMC maturity level required for the contract in question.
What are FCI and CUI?
FCI refers to information provided by or generated for the government under a contract that is not intended for public release. It includes data related to the performance of government contracts but does not involve classified or highly sensitive information. For example, an office furniture supplier providing delivery schedules and product specifications to a government agency under a contract would be handling FCI.
CUI is more sensitive and requires specific safeguarding and dissemination practices. CUI includes information that, while not classified, still requires protection under federal laws, regulations, or government-wide policies due to its potential impact on national security or other critical interests. A defense contractor managing blueprints for a new military vehicle that is not classified but still needs to be protected under export control laws would be handling CUI.
Impact of non-compliance
Failure to comply with CMMC 2.0 can have several significant impacts:
Contract Loss: Organizations that do not meet the required CMMC level will be ineligible for DoD contracts, leading to a loss of business opportunities and revenue.
Reputational Damage: Non-compliance can damage an organization’s reputation, affecting relationships with clients and partners and potentially deterring future business opportunities.
Legal and Financial Penalties: Organizations may face legal actions and financial penalties, especially if a security breach occurs involving sensitive information.
Increased Risk: Non-compliance increases the risk of data breaches and cyberattacks, which can compromise organizational and client data.
Achieving compliance with CMMC 2.0 is not just a regulatory requirement but a critical step in safeguarding national security and contracting with the DoD. To prepare your organization for CMMC 2.0, continue on to the maturity levels below, or read about how Chainguard Containers can help simplify fulfilling CMMC 2.0 requirements.
The Cybersecurity Maturity Model Certification (CMMC) 2.0 integrates various cybersecurity standards and best practices into a unified model that encompasses three maturity levels. Each level builds upon the previous one, with increasing rigor in cybersecurity practices and processes. In this article, we’ll provide an overview of the three levels of maturity and example practices that are representative of their requirements.
Level 1: Foundational
Contractors and subcontractors who handle only Federal Contract Information (FCI) typically need this level of certification. This is particularly relevant for small businesses that provide basic products or services without dealing with sensitive information. For example, a company supplying standard office supplies to a government agency would fall under this category. The focus at this level is on maintaining basic safeguards by implementing 17 fundamental cybersecurity practices. These practices are primarily derived from the Federal Acquisition Regulation (FAR) 52.204-21, a set of rules for government procurement in the United States. They are designed to protect FCI by ensuring that essential, straightforward protections are in place.
Documentation requirements
At Level 1, the documentation requirements are minimal, focusing on basic cyber hygiene through the implementation of 17 foundational cybersecurity practices. The purpose is to establish essential protections without the need for extensive documentation.
For example, organizations may maintain basic policies and procedures for access control, media protection, and physical security, along with records of security awareness training. The emphasis at this level is on demonstrating that these fundamental practices are in place, rather than producing detailed documentation, as required in higher levels.
Example level 1 practices
Limiting information system access to authorized users.
Conducting background checks on employees.
Implementing basic measures such as antivirus and firewalls.
Level 2: Advanced
Contractors and subcontractors who handle Controlled Unclassified Information (CUI) but are not involved in critical defense programs typically need Level 2 certification. This is relevant for companies involved in more complex projects that deal with sensitive, though not highly classified, data. For instance, a contractor providing technical support for military communication systems, where sensitive but not classified information is exchanged, would require this level.
Level two consists of implementing a subset of the security requirements specified in NIST SP 800-171, totaling 110 practices. This level is designed as a transitional step for organizations aiming to achieve Level 3, building upon the foundational practices established in Level 1.
Documentation requirements
At Level 2, the documentation requirements are moderate, reflecting the need for intermediate cyber hygiene and addressing a subset of the NIST SP 800-171 requirements. Organizations must maintain a System Security Plan (SSP) that outlines security strategies and vulnerability assessment and remediation plans. They must also create a Plan of Action and Milestones (POA&M) addressing any aspects of the organization which are not yet implemented.
Other Level 2 documentation requirements may include audit logs, incident response reports, inventory of the organization’s systems, location of Controlled Unclassified Information (CUI) in the organization’s environment, and other documents related to the implementation and management of cybersecurity practices.
Example level 2 practices
Implementing multifactor authentication.
Conducting regular vulnerability assessments.
Establishing and maintaining an operational incident-handling capability for organizational systems.
Level 3: Expert
Contractors handling highly sensitive CUI and involved in critical defense programs typically require this level of certification. This applies to large defense contractors developing advanced military technologies, such as a company designing next-generation fighter jets for the DoD. The focus at this level is on advanced and proactive cyber hygiene, requiring organizations to implement all 110 practices from NIST SP 800-171, along with additional practices from a subset of NIST SP 800-172.
This level demands advanced security measures to protect CUI against advanced persistent threats (APTs), such as cyber-espionage campaigns, zero-day exploits, and coordinated attacks targeting vulnerabilities in critical infrastructure. It requires three government-led assessments a year to maintain compliance.
Documentation requirements
Level 3 requires the same documentation requirements as Level 2, including the System Security Plan (SSP) and Plan of Action and Milestones (POA&M). Further documentation requirements will be clear once the DoD determines which additional practices from NIST SP 800-172 will also be required.
Example level 3 practices
At the time of publication, specific Level 3 practices are still being determined. However, the Department of Defense has indicated that they will be pulled from a subset of NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information.
Each CMMC level builds upon the previous one, ensuring that as organizations progress through the levels, their cybersecurity posture becomes more robust and capable of addressing increasingly sophisticated threats. This tiered approach allows organizations of varying sizes and capabilities to incrementally improve their cybersecurity measures while meeting the specific requirements necessary to handle sensitive information.
To learn more about the specific required practices of CMMC 2.0, continue to the Overview of CMMC 2.0 practice/control groups.
Browse all CMMC 2.0 articles
(Current article) What is CMMC 2.0? Maturity levels and requirements
Related articles