CMMC, without the maze.

What CMMC is for

Cybersecurity Maturity Model Certification (CMMC) is the defense supply chain program for checking implementation of required safeguards. Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) have different protection needs. The contract, information, and system boundary determine what applies.

Level 1 addresses basic FCI safeguards. Level 2 focuses on protecting CUI using NIST SP 800-171 Revision 2. Check the official overview ↗ (opens in a new tab) for current assessment routes and implementation changes.

Three questions to answer first

1. What information do we receive or create? Work with your customer and contracts team to identify FCI and CUI. Avoid treating every confidential business record as CUI.
2. Where does it go? Include people, devices, sites, cloud services, subcontractors, remote access, and the systems that protect them.
3. What must we demonstrate? Record the applicable clauses, required level, publication revision, and assessment or affirmation obligations.

Preparation and assessment are different jobs

A practitioner helps implement safeguards and develop the program. An assessor evaluates implementation using the applicable assessment process. Readiness support does not itself issue a certification. Preserve independence and address conflicts before selecting an assessment team.

A small working vocabulary

Scope

The defined people, assets, services, and information flows being considered.

SSP

System Security Plan: a description of the system, its boundary, and how requirements are implemented.

POA&M

Plan of Action and Milestones: a record of gaps and planned work. Its use for assessment status is limited by program rules.

Evidence

Records, interviews, and demonstrations that support what you say your organization actually does.

Next: turn the questions into a roadmap →