Glossary / Security
Cybersecurity Maturity Model CertificationCMMC
The Cybersecurity Maturity Model Certification (CMMC) program is DoW's approach to verifying that defense contractors and subcontractors implement cybersecurity controls for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). CMMC defines three levels: Level 1 (an annual self-assessment against the 15 basic safeguarding requirements of FAR 52.204-21), Level 2 (the 110 requirements of NIST SP 800-171 Rev 2, self-assessed or assessed by a third party depending on the contract), and Level 3 (selected NIST SP 800-172 requirements, assessed by the government). The program rule (32 CFR Part 170) took effect in December 2024, and the DFARS rule that puts CMMC into contracts took effect November 10, 2025, with requirements phased in over the following years.
Why it matters to your pipeline
CMMC is becoming a pass/fail gate for DoW work. If you touch CUI and cannot document your CMMC Level 2 posture, you will be unable to bid on affected contracts. Preparation can take many months for a small firm, covering SSP documentation, POA&M remediation, technical control implementation, and assessment, so it pays to start early. Primes also flow down CMMC requirements, so subcontractors face the same deadlines.
When this term shows up in an opening GovSmith finds for you, your vCM explains what it means for that pursuit and does whatever it calls for. You decide; we do the work.
Example
A 40-person engineering firm on a Navy contract receives CUI. It spends 14 months implementing NIST 800-171 controls, generates an SSP, and completes a C3PAO assessment. Its Level 2 certification is recorded in SPRS before the next task order is issued, unblocking a $6.5M re-compete.
Find out what applies to you
Some terms will matter to your business right away and some won’t for years. A vCM can tell you which are which.