Loading...
Cybersecurity Maturity Model Certification 2.0 (32 CFR Part 170)
CMMC 2.0 establishes cybersecurity requirements for the Defense Industrial Base, replacing the previous self-attestation model with verified assessments. The final rule (32 CFR Part 170) became effective December 16, 2024, with phased contract rollout from November 2025. Three levels align with NIST SP 800-171 and 800-172, covering approximately 338,000 DoD contractors.
3
Certification Levels
110
Level 2 Controls
14
Control Families
Dec 2024
Rule Effective
Protects Federal Contract Information (FCI). 17 practices from FAR 52.204-21. Annual self-assessment only. POA&M not permitted — all controls must be fully implemented.
Protects Controlled Unclassified Information (CUI). 110 controls from NIST SP 800-171 Rev 2 across 14 families. Self-assessment or C3PAO certification (3-year validity) depending on CUI priority.
Protects CUI critical to national security. All 110 NIST 800-171 controls plus 24 additional from NIST SP 800-172. Government-led assessment by DCMA DIBCAC every 3 years.
Access Control, Awareness & Training, Audit & Accountability, Configuration Management, Identification & Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System & Comms Protection, System & Info Integrity.
Identify which CMMC level is required based on the type of information you handle: FCI (Level 1) or CUI (Level 2/3). Review contract requirements.
Assess your current security posture against NIST SP 800-171 Rev 2’s 110 controls across 14 families. Generate your SPRS score.
Develop your System Security Plan (SSP) documenting how each control is implemented. Create Plans of Action & Milestones for any gaps (Level 2: must achieve 80% minimum).
Implement required controls: access management, encryption, audit logging, incident response, configuration management, and physical security.
For Level 2 C3PAO assessment: engage a Cyber-AB accredited Third-Party Assessment Organisation. Prepare evidence and documentation for the 3-year certification.
Submit annual affirmations in SPRS. Maintain controls, monitor for changes, and address any POA&M items within the 180-day conditional window.