A security framework developed by the U.S. Department of Defense (DoD) to protect sensitive government information within the defense supply chain. It establishes cybersecurity standards for contractors and subcontractors handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
- Defense Contracting: Requires all DoD contractors and subcontractors to meet specific cybersecurity standards to be eligible for government contracts.
- Cybersecurity Compliance: Aligns with security frameworks like NIST 800-171 to ensure organizations follow best practices for protecting sensitive data.
- Maturity Levels: Uses a tiered model (previously Levels 1-5, now transitioning to CMMC 2.0 with three levels) to categorize security requirements based on the sensitivity of information handled.
- Third-Party Certification: Requires independent assessments for higher security levels to verify compliance with DoD cybersecurity requirements.
- Small Business Impact: Affects companies of all sizes in the Defense Industrial Base (DIB), including subcontractors who must adhere to security guidelines.
- Supply Chain Security: Helps prevent cyber threats by ensuring that every organization handling DoD information maintains a strong security posture.
CMMC enhances national security by strengthening cybersecurity practices across the defense supply chain, ensuring that contractors protect sensitive government data from cyber threats.