CMMC stands for Cybersecurity Maturity Model Certification. It’s a Department of Defense (DoD) framework that verifies whether contractors and subcontractors in the Defense Industrial Base (DIB) have the cybersecurity controls in place to protect two categories of sensitive information: Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). The DoD created CMMC after years of relying on companies to self-attest to their own cybersecurity — self-attestation didn’t hold up, and CMMC replaces it with actual verification.
FCI vs. CUI — Why the Distinction Matters
Federal Contract Information (FCI) is information provided by or generated for the government under a contract that isn’t intended for public release — routine contract data, deliverables, and communications. Controlled Unclassified Information (CUI) is more sensitive: technical data, specifications, and other information the government has determined needs safeguarding under law, regulation, or government-wide policy, even though it isn’t classified. Which CMMC level applies to your organization depends entirely on which category of information you handle — FCI-only contractors face a lighter compliance bar than those handling CUI.
The 3 CMMC Levels
- Level 1 (Foundational). Applies to contractors who handle FCI only. Covers 17 basic cyber hygiene practices drawn from FAR 52.204-21. Verified through an annual self-assessment — no third-party assessor required.
- Level 2 (Advanced). Applies to contractors handling CUI. Aligns with the 110 security controls in NIST SP 800-171. Depending on the sensitivity of the program, this level requires either a self-assessment or a third-party assessment conducted by a Certified Third-Party Assessment Organization (C3PAO).
- Level 3 (Expert). Applies to a smaller set of contractors supporting the DoD’s highest-priority programs, handling CUI at greatest risk from advanced persistent threats. Builds on Level 2 with additional controls drawn from NIST SP 800-172 and is assessed directly by the government (DIBCAC), not a C3PAO.
Self-Assessment vs. Third-Party Assessment
Not every CMMC level requires hiring an outside assessor. Level 1 is always a self-assessment, submitted annually by a company officer through the DoD’s Supplier Performance Risk System (SPRS). Level 2 splits: some contracts allow self-assessment, while others — generally those involving more sensitive CUI — require a formal C3PAO assessment leading to certification. Level 3 assessments are conducted by the government itself. Knowing which track applies to your specific contracts, before you start remediation work, avoids paying for a level of rigor your program doesn’t actually require.
Where CMMC Stands Today
The CMMC program rule has been finalized and the DoD has begun incorporating CMMC requirements into contract solicitations on a phased timeline — meaning it’s no longer a “someday” requirement for contractors in the affected phases. Because the rollout details (which contracts, which phase, which effective dates) continue to evolve, see our CMMC Resources hub and our post on what changed in the final CMMC rule for current specifics rather than relying on a single point-in-time summary.
Who Needs to Comply?
CMMC compliance is required for prime contractors and every downstream subcontractor in the supply chain that creates, receives, transmits, or stores CUI or FCI in connection with a DoD contract — not just the large defense primes. A small manufacturing shop that machines a single part for a subcontractor three tiers down the supply chain can still be in scope. If your business touches a DoD contract in any capacity, it’s worth confirming your CMMC obligations rather than assuming the requirement only applies to larger contractors.
How Kyber Security Helps
Kyber Security is a CyberAB-certified Registered Practitioner Organization (RPO) based in Trumbull, CT, guiding defense contractors and subcontractors throughout Fairfield County and beyond through CMMC readiness — gap analysis against your target level, control implementation, System Security Plan (SSP) and Plan of Action & Milestones (POA&M) documentation, and preparation for your C3PAO assessment. See our CMMC Compliance Services page for the full breakdown, or our CMMC Gap Review to see where your organization stands today.
Frequently Asked Questions
What’s the difference between CMMC and NIST SP 800-171?
NIST SP 800-171 is the underlying set of 110 security controls; CMMC Level 2 is the DoD’s verification framework for confirming an organization actually implements those controls, rather than just self-attesting to them.
Do I need a C3PAO if I only handle FCI, not CUI?
No. Organizations that only handle FCI are scoped to CMMC Level 1, which is satisfied through an annual self-assessment — a third-party assessor is not required at that level.
How long does CMMC certification take?
It depends heavily on your starting security posture and target level. A Level 1 self-assessment can be completed in weeks once controls are in place; a Level 2 certification involving a C3PAO assessment more commonly takes several months once remediation work and documentation are accounted for.
CMMC Compliance Support for Fairfield County Contractors
Kyber Security is a CyberAB-certified Registered Practitioner Organization based in Trumbull, CT, helping defense contractors and subcontractors throughout Bridgeport, Fairfield, Shelton, and the rest of Fairfield County prepare for CMMC assessment. See our CMMC Compliance Services for the full breakdown.