CMMC (Cybersecurity Maturity Model Certification)
Also known as: CMMC, CMMC 2.0, Cybersecurity Maturity Model Certification, DoD cybersecurity certification
CMMC, the Cybersecurity Maturity Model Certification, is the US Department of Defense program that requires defence contractors to meet specific cybersecurity standards, and in many cases prove it through assessments, before winning contracts.
While contractors were already supposed to follow these rules, self-reporting proved unreliable. CMMC replaces trust with verification, and it reaches Canadian suppliers in the US defence supply chain too.
CMMC (Cybersecurity Maturity Model Certification), explained at three levels
At home
Think of CMMC as a security inspection for companies that hold sensitive but unclassified US military information, like design drawings or contract details. Before a company can win certain defence contracts, it must show it locks that information down, sometimes by checking itself and sometimes by having an outside inspector verify it. That includes small suppliers far down the chain.
At work
CMMC is the US Department of Defense program that verifies contractors protect federal contract information and controlled unclassified information. Contracts now specify a required CMMC level, and suppliers must meet it before award, through a self-assessment or an independent assessment. Businesses care because without the required status they cannot win or keep the contract, and Canadian subcontractors in the US defence supply chain are covered too.
At home
CMMC has three levels tied to how sensitive the information is. Level 1 protects federal contract information with 15 basic safeguards, like controlling who can log in and running antivirus. Level 2 protects controlled unclassified information, such as technical drawings, using the 110 requirements in NIST SP 800-171. Level 3 adds selected requirements from NIST SP 800-172 to defend the most sensitive programs against advanced attackers.
At work
Assessment depends on the level and the contract. Level 1 requires an annual self-assessment. Level 2 requires either a self-assessment or a certified third-party assessment organization (C3PAO), every three years, as the contract specifies. Level 3 requires a Level 2 third-party certification first, then a government assessment. Results go into the Supplier Performance Risk System, a senior official must affirm compliance annually, and limited gaps can be closed under plans of action within 180 days.
At home
CMMC exists because attackers target the weakest link. A big defence prime contractor has a security team, but a 30-person machine shop holding the same drawings may not. CMMC forces those small suppliers up to a common baseline, which costs real money. In my view, that's both the program's fairness problem and its point: protecting the supply chain only works if every link meets the standard.
At work
Compliance work starts with scoping: identifying every system that stores, processes, or transmits controlled unclassified information, often isolating it in a dedicated enclave to shrink the assessment. Teams then implement NIST SP 800-171 controls, use cloud services at FedRAMP Moderate or equivalent, and prepare evidence for assessors. The contract rollout began on November 10, 2025, and phases in over several years. Senior officials' affirmations add legal exposure, including under the US False Claims Act for misrepresentations.
Real-world examples
At home
Fatima works at a small machine shop in Ontario that makes parts for a US defence contractor. When the contractor told suppliers CMMC Level 2 would appear in upcoming contracts, Fatima's employer started a project to secure the systems where technical drawings were stored.
At work
Jerome is the IT manager at a Canadian electronics supplier. To prepare for a CMMC Level 2 assessment, his team moved controlled unclassified information into a separate, secured cloud environment, documented a system security plan, and hired a consultant for a readiness review.
How it compares
| feature | Level 1 | Level 2 | Level 3 |
|---|---|---|---|
| Information protected | Federal contract information | Controlled unclassified information | Controlled unclassified information in high-priority programs |
| Requirements | 15 basic safeguarding requirements | 110 requirements from NIST SP 800-171 | Level 2 plus selected NIST SP 800-172 requirements |
| Assessment | Annual self-assessment | Self-assessment or third-party, every three years | Government assessment |
Each CMMC level adds requirements and stronger verification.
For analysts
For defence suppliers, CMMC is a market access requirement, not an IT project. I'd scope it narrowly by isolating sensitive information in one environment, which can cut the cost of compliance dramatically compared with securing the whole company to Level 2.
History & origin
US defence contractors have been required since 2017 to implement the security controls in NIST SP 800-171 to protect controlled unclassified information, but compliance was largely self-attested. The Department of Defense released CMMC 1.0 in January 2020 with five levels, then streamlined it to three levels in CMMC 2.0, announced in November 2021. The program rule (32 CFR Part 170) took effect on December 16, 2024, and the contracting rule that allows CMMC requirements in defence contracts took effect on November 10, 2025, starting a phased rollout over several years. Canada announced its own Canadian Program for Cyber Security Certification, aligned with CMMC, for its defence procurement. In my opinion, CMMC is overdue: years of self-attestation produced paperwork, not security.