CMMC (Cybersecurity Maturity Model Certification)
Also known as: CMMC, CMMC 2.0, Cybersecurity Maturity Model Certification, DoD cybersecurity certification
CMMC, the Cybersecurity Maturity Model Certification, is the US Department of Defense program that requires defence contractors to meet specific cybersecurity standards, and in many cases prove it through assessments, before winning contracts.
While contractors were already supposed to follow these rules, self-reporting proved unreliable. CMMC replaces trust with verification, and it reaches Canadian suppliers in the US defence supply chain too.
CMMC (Cybersecurity Maturity Model Certification), explained at three levels
At home
Companies that work on US military projects handle sensitive information. CMMC is the rulebook that makes sure they protect it, and in many cases they need an independent check to prove they do.
At work
If your business supplies the US Department of Defense, directly or as a subcontractor, CMMC requirements can appear in your contracts. You'll need to meet a set level of cybersecurity and either assess yourself or get assessed by an approved third party.
At home
CMMC has three levels. Level 1 covers basic security for less sensitive contract information. Level 2 covers controlled unclassified information, using 110 security requirements. Level 3 adds more advanced protections for the most sensitive programs.
At work
Level 1 allows annual self-assessment. Level 2 requires either self-assessment or a certified third-party assessment organization (C3PAO), depending on the contract, every three years. Level 3 requires government assessment. Contractors also need a system security plan, documented policies, and, in limited cases, plans of action to close gaps within set timelines.
At home
The biggest effect falls on small suppliers, who may not have dedicated security staff. In my view, that's both the program's fairness problem and its point: attackers often target the weakest link in the supply chain, which is rarely the big defence prime contractor.
At work
Compliance work usually involves scoping the environment where controlled information lives (often isolating it in a dedicated enclave), implementing NIST SP 800-171 controls, using cloud services that meet FedRAMP Moderate or equivalent requirements, and preparing evidence for assessors. Senior officials must affirm compliance, adding legal exposure, including under the US False Claims Act for misrepresentations.
Real-world examples
At home
Fatima works at a small machine shop in Ontario that makes parts for a US defence contractor. When the contractor told suppliers CMMC Level 2 would appear in upcoming contracts, Fatima's employer started a project to secure the systems where technical drawings were stored.
At work
Jerome is the IT manager at a Canadian electronics supplier. To prepare for a CMMC Level 2 assessment, his team moved controlled unclassified information into a separate, secured cloud environment, documented a system security plan, and hired a consultant for a readiness review.
How it compares
| feature | Level 1 | Level 2 | Level 3 |
|---|---|---|---|
| Information protected | Federal contract information | Controlled unclassified information | Controlled unclassified information in high-priority programs |
| Requirements | 15 basic safeguarding requirements | 110 requirements from NIST SP 800-171 | Level 2 plus selected NIST SP 800-172 requirements |
| Assessment | Annual self-assessment | Self-assessment or third-party, every three years | Government assessment |
Each CMMC level adds requirements and stronger verification.
For analysts
For defence suppliers, CMMC is a market access requirement, not an IT project. I'd scope it narrowly by isolating sensitive information in one environment, which can cut the cost of compliance dramatically compared with securing the whole company to Level 2.
History & origin
US defence contractors have been required since 2017 to implement the security controls in NIST SP 800-171 to protect controlled unclassified information, but compliance was largely self-attested. The Department of Defense released CMMC 1.0 in January 2020 with five levels, then streamlined it to three levels in CMMC 2.0, announced in November 2021. The program rule (32 CFR Part 170) took effect on December 16, 2024, and the contracting rule that allows CMMC requirements in defence contracts took effect on November 10, 2025, starting a phased rollout over several years. Canada announced its own Canadian Program for Cyber Security Certification, aligned with CMMC, for its defence procurement. In my opinion, CMMC is overdue: years of self-attestation produced paperwork, not security.