CMMC Guide: What CMMC 2.0 Actually Requires
If you sell to the Department of Defense, or you sell to someone who sells to the Department of Defense, CMMC is probably the reason you're reading this page. Here's the short version, without the acronym soup.
CMMC — the Cybersecurity Maturity Model Certification — is the DoD's way of verifying that contractors actually protect the sensitive information they're trusted with, instead of just promising to. It applies to Federal Contract Information (FCI) and, at the higher levels, Controlled Unclassified Information (CUI) — the categories of non-classified-but-still-sensitive data that flow through the defense supply chain. CMMC 2.0 has three levels. Level 1 is basic cyber hygiene for contractors handling only FCI — self-assessed, a modest set of practices. Level 2 is the big one for most contractors: it maps to the 110 controls in NIST SP 800-171, and depending on the contract, it requires either a self-assessment or a third-party assessment by a certified assessor (a C3PAO). Level 3 adds a layer on top for the highest-risk information and involves government-led assessment. Which level applies to you is set by your contract, not by your preference.
Where companies actually get stuck
The gap is rarely "we have no security." It's usually that security exists but isn't documented the way an assessor needs to see it — no System Security Plan, no Plan of Action and Milestones for the gaps you know about, policies that live in someone's head instead of on paper, or a scope boundary for CUI that was never cleanly drawn so now half your network is technically in scope. Those are fixable, but they take real time, and they're much cheaper to fix before an assessor is in the room than after.
How I'd approach getting you ready
I start by mapping what CUI or FCI actually touches your environment and drawing a defensible scope boundary — getting that wrong is the single most expensive mistake companies make, because it drags systems into scope that never needed to be there. From there it's an honest gap assessment against the 110 controls, a prioritized remediation plan that fixes the things that matter most first, and the documentation — System Security Plan, POA&M — that turns "we do this" into something an assessor can verify. I'll tell you plainly where you stand and what it will take, not what's comfortable to hear.
Defense-supply-chain deadlines don't move for anyone's internal schedule. If a contract clause has you staring down a CMMC requirement, reach out and let's figure out where you actually stand.