Achieve CMMC compliance faster

The Cybersecurity Maturity Model Certification (CMMC) is a Department of Defense (DoD) framework that requires contractors and suppliers to safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) across the defense supply chain. With the final CMMC 2.0 rule now published, new contract clauses go into effect on November 10, 2025, marking the start of a multi-year rollout through 2028.

Organizations that handle CUI must be certified at the appropriate CMMC level before they can win or renew DoD contracts. Preparation takes time—building evidence, completing self-assessments, and closing gaps—so contractors should begin now to avoid delays or disqualification when CMMC appears in solicitations.

NIST 800-171 is a set of cybersecurity controls focused on protecting FCI and CUI within non-federal systems, which many contractors already follow. CMMC builds on NIST 800-171 by adding verification requirements and multiple maturity levels, which assess not just the presence of controls but also the effectiveness and robustness of cybersecurity practices across organizations.

CMMC Level 3 builds on NIST 800-171 by incorporating the enhanced security requirements of NIST 800-172, designed to protect the most sensitive controlled unclassified information (CUI) from advanced persistent threats (APTs).

CMMC applies to all organizations within the DoD supply chain, including contractors, subcontractors, and any business handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as part of their work with the DoD.

NIST SP 800-171 provides recommended requirements for protecting the confidentiality of controlled unclassified information, or CUI, for government contractors and subcontractors. Therefore, if an organization is a part of the Department of Defense (DoD), General Services Administration (GSA), National Aeronautics and Space Administration (NASA), or other federal or state agencies’ supply chain, it must implement the security requirements included in NIST SP 800-171.

NIST 800-171 has 110 controls organized across 14 control families. These control families include:

• Access control: Determines who has access to data and whether or not they’re authorized
• Audit and accountability: Ensures your staff is adequately trained on the handling of CUI
• Awareness and training: Ensures you know who’s accessing CUI and who’s responsible for what
• Configuration management: Ensures you follow guidelines to maintain secure configurations
• Identification and authentication: Allows you to manage and audit all instances of CUI access
• Incident response: Ensures you prepare a response plan for breaches of CUI data
• Maintenance: Ensures ongoing security and change management in order to safeguard CUI
• Media protection: Secures the handling of external drives, backups, and other backup equipment
• Personnel security: Ensures you train your staff to identify and prevent insider threats
• Physical and environmental protection: Ensures only authorized personnel are in physical spaces where CUI lives
• Risk assessment: Helps you develop a risk profile for CUI breaches as well as evaluate your current level of risk
• Security assessment: Audits and verifies the effectiveness of your security procedures
• System and communications protection: Secures your comms systems and channels
• System and information integrity: Addresses new vulnerabilities and system downtime