Glossary term
CMMC
Cybersecurity Maturity Model Certification — DoD's tiered cybersecurity verification program for the defense industrial base.
CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense's program to verify that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). CMMC 2.0 has three levels: Level 1 (Foundational, self-assessment), Level 2 (Advanced, aligned with NIST SP 800-171, third-party assessment for critical programs), and Level 3 (Expert, DIBCAC-led). CMMC becomes a contract requirement as clauses roll out through DFARS 252.204-7021.
Categories
- compliance
- cybersecurity
- dod
Related terms
- DFARSDefense Federal Acquisition Regulation Supplement — DoD-specific additions to the FAR.
- NIST SP 800-171The security standard for protecting Controlled Unclassified Information in non-federal systems.
- Controlled Unclassified Information (CUI)Government information that requires safeguarding but is not classified.