CMMC, the Cybersecurity Maturity Model Certification, is the US Department of Defense program that checks whether contractors protect sensitive government information. It builds on NIST requirements and arrives through contracts. If your company sells to defense primes or agencies, find out which data you hold before anything else.
What does CMMC do?
Instead of trusting a contractor's word, CMMC requires assessment at a level that matches the information involved. The program defines three levels. Level 1 covers basic safeguarding of federal contract information. Level 2 covers controlled unclassified information (CUI) and aligns to NIST SP 800-171. Level 3 adds a further set of requirements for the most sensitive work. Whether a self assessment or a third party assessment is needed depends on the level and contract. The Department's own CMMC pages blocked our automated fetch, so confirm current rules, level definitions and phase in dates there.
How does NIST SP 800-171 fit?
NIST says SP 800-171 provides recommended security requirements for protecting the confidentiality of CUI when it sits in nonfederal systems, and that agencies use it in contracts and agreements with nonfederal organizations. Revision 3 is published. Which revision a given contract or the CMMC rule references is something to confirm, not assume.
What decisions come first?
Do you hold CUI at all? Many suppliers think they do and do not, or the reverse. Ask your contracting officer or prime which data in your contract is marked.
What is the boundary? CMMC assessments look at the systems that handle that data. A small, well drawn enclave is far cheaper to assess than the whole company network.
Which level does the contract require? It will be in the solicitation or contract clauses. Do not choose a level yourself.
Who is the owner? A named executive affirms compliance, so decide early who that is.
Which flow down applies? If you are a subcontractor, your prime may pass requirements to you.
A constructed example
A 40 person machine shop makes parts for a prime and receives drawings marked as CUI by email. The new security hire maps where those drawings travel: a shared mailbox, two laptops and a file server. Rather than securing every system, the company moves drawing handling into a separate enclave with its own accounts, multi factor login, logging and a documented boundary. The scoped environment is what gets assessed.
What does readiness work look like?
Expect to document policies and a system security plan, then gather evidence that controls operate: access control, authentication, audit logging, configuration management, incident response, media protection and others from the NIST requirements. Gaps are tracked in a plan of action, though rules limit what may stay open at assessment time, so check the current rule.
How to start
- Read your contract clauses and find every mention of CUI and CMMC.
- Ask the prime to confirm the required level.
- Inventory systems that touch that data.
- Draw a tight boundary or enclave.
- Compare current controls to the NIST SP 800-171 requirements.
- List gaps, owners and dates.
- Decide whether to hire a consultant or assessor early.
- Re-check official phase in dates quarterly.
Safeguard's compliance automation can help track controls and evidence and its SBOM and dependency scanning supports software supply chain practices. It does not certify you for CMMC.
What trips up first timers?
Unclear data classification is first: staff cannot protect what they cannot identify as CUI. Overbroad scope is second, pulling email, laptops and file shares into assessment when an enclave would do. Third is documentation that describes intentions rather than practice; assessors look for evidence that controls operate. Fourth is forgetting suppliers: if you pass CUI to a subcontractor, requirements flow down. Finally, timelines slip because remediation of things like multi factor authentication, logging and encryption touches many teams. Start with the boundary and the contract language, and ask your prime early.
Quick check
Is CMMC the same as NIST SP 800-171?
No. NIST SP 800-171 is the set of requirements. CMMC is the program that verifies a contractor meets them.
Can we choose our own level?
No. The contract sets the level based on the information involved.
Sources
- NIST SP 800-171 Rev. 3
- Department of Defense CIO CMMC pages blocked automated fetch; verify rule and dates there.
Last reviewed: 18 October 2026.
