What is CMMC Compliance?

Here’s a scenario we see a lot with Connecticut manufacturers. A new DoD contract comes through, legal skims it, and buried in the clauses is a requirement for CMMC. Nobody in the building is quite sure what it means, when it kicks in, or how far behind they already are. If that’s you, this is the plain version.

Connecticut has a deep defense supply chain, from the big primes down to the small machine shops and suppliers in Fairfield County and across the state. A lot of those smaller firms handle sensitive government data without realizing the bar they’re now held to. Let’s clear it up.

What is CMMC compliance?

CMMC stands for Cybersecurity Maturity Model Certification. It’s a US Department of Defense program that requires defense contractors and their subcontractors to meet specific cybersecurity standards before they can handle government contract data. Compliance is verified either through a self-assessment or a third-party assessment, depending on the level your contracts require.

The point of it is simple, even if the paperwork isn’t. The Pentagon got tired of sensitive information leaking out through small, under-secured suppliers, so it made proof of security a condition of doing the work.

Who has to be CMMC compliant?

Any company in the defense industrial base that handles federal contract information (FCI) or controlled unclassified information (CUI) under a DoD contract. That includes subcontractors and suppliers, not just the primes. If your contracts carry the DFARS cybersecurity clause and you touch CUI, CMMC applies to you.

This is the part that catches Connecticut shops off guard. You don’t have to be a defense company in the way you’d picture one. If you machine a part, write software, or provide a service somewhere in that supply chain and CUI passes through your systems, you’re in scope.

What are the CMMC levels?

CMMC 2.0 has three levels, and which one applies depends on the data you handle.

Level 1 (Foundational) covers 15 basic security practices for firms that handle only FCI. It’s an annual self-assessment. Level 2 (Advanced) is the one most contractors land on. It aligns with the 110 controls in NIST SP 800-171 and applies when you handle CUI, and depending on the contract it requires an assessment by a certified third party, a C3PAO. Level 3 (Expert) adds controls from NIST SP 800-172 for the highest-priority programs.

For most Connecticut suppliers, the real work is getting to Level 2.

What is the CMMC compliance deadline?

This is where people want a single date, and there isn’t one clean answer. The CMMC program rule took effect in December 2024, and the Department of Defense is phasing the requirement into contracts over roughly three years. The level and timing that apply to you depend on your specific contracts as they come up for award and renewal.

So the honest, practical answer: if you handle CUI, start now. Reaching Level 2 is not a one-weekend project, and waiting for the clause to show up in a contract you want to win is how firms get locked out of bids. The contractors moving early are the ones who’ll still be eligible when the clause lands.

What does CMMC compliance actually require?

At Level 2, you’re implementing and documenting the 110 controls of NIST SP 800-171. In practice that means enforced multi-factor authentication, access controls, encryption, audit logging, incident response, and a long list of specific technical and process safeguards.

Two documents matter as much as the controls themselves. A System Security Plan (SSP) describes how your environment meets each requirement. A Plan of Action and Milestones (POA&M) documents the gaps you’re still closing and when. You’ll also report a score to the DoD’s SPRS system. Assessors look at whether all of this is real and credible, not whether it merely exists on paper.

How long does it take, and how do you get ready?

For a contractor starting from standard, non-security-focused IT, Level 2 readiness typically takes several months. The sequence is a gap assessment to find what’s missing, remediation to close those gaps, finalizing the SSP, and then scheduling the assessment. Each of those takes real time, which is the whole argument for starting before you’re forced to.

This is work Kyber does directly. We’re a CyberAB-certified Registered Practitioner Organization (RPO), authorized to provide CMMC gap assessments, SSP development, technical remediation, and assessment preparation for Connecticut and Rhode Island defense contractors. It’s the same security-first approach we bring to managed IT, applied to a framework with real consequences for getting it wrong.

If CMMC language has started appearing in your contracts, or you supply someone whose contracts carry it, talk to our team in Trumbull. We’ll tell you honestly where you stand and what it takes to get compliant, before a bid depends on it.

Frequently asked questions

What is CMMC compliance?

CMMC (Cybersecurity Maturity Model Certification) is a US Department of Defense program that requires defense contractors and subcontractors to meet set cybersecurity standards before they can handle federal contract information (FCI) or controlled unclassified information (CUI). Compliance is verified through a self-assessment or a third-party assessment, depending on the level.

Who needs to be CMMC compliant?

Any company in the defense industrial base that handles FCI or CUI under a DoD contract, including subcontractors and suppliers. If your contracts include the DFARS cybersecurity clause and CUI passes through your systems, CMMC applies to you.

What are the three CMMC levels?

Level 1 (Foundational) covers 15 basic practices for FCI with an annual self-assessment. Level 2 (Advanced) aligns with the 110 controls of NIST SP 800-171 for CUI and may require a third-party C3PAO assessment. Level 3 (Expert) adds controls from NIST SP 800-172 for the highest-priority programs.

What is the CMMC compliance deadline?

The CMMC program rule took effect in December 2024, and the Department of Defense is phasing the requirement into contracts over roughly three years. The exact timing depends on your specific contracts, so contractors handling CUI should begin now rather than wait for the clause to appear in a bid.

How long does it take to become CMMC compliant?

For a contractor starting from standard IT, reaching Level 2 readiness typically takes several months: a gap assessment, remediation of missing controls, finalizing the System Security Plan, and scheduling the assessment each take real time.