Who needs CMMC certification: Applicability, roles, data types, and compliance path

The Cybersecurity Maturity Model Certification (CMMC) is a U.S. Department of Defense (DoD) initiative designed to safeguard sensitive federal data shared across the defense supply chain. It ensures that contractors, subcontractors, and vendors handling Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) maintain the necessary cybersecurity standards.

This blog explains who needs CMMC certification, the roles and responsibilities of different stakeholders, the types of data covered, and the compliance path organizations must follow to achieve certification.

Understanding CMMC 2.0 and its phased rollout

CMMC 2.0 streamlines the original five levels into three tiers of cybersecurity maturity: Level 1 (Foundational), Level 2 (Advanced), and Level 3 (Expert), based on the sensitivity of data handled and the rigor of assessment required.

• Level 1: Annual self-assessment for contractors managing FCI.
  
• Level 2: Self-assessment for non-prioritized CUI; third-party assessment (C3PAO) for prioritized CUI.
  
• Level 3: Government-led assessment for the highest-security programs.
  

CMMC 2.0 implementation follows a phased approach:

• The CMMC Program Rule (32 CFR Part 170) was implemented on December 16, 2024.
  
• The DFARS CMMC Rule (48 CFR Parts 204, 212, and 252) was published on September 10, 2025, with enforcement beginning November 10, 2025 (Phase 1).
  
• Future phases will expand third-party assessments for Level 2, introduce Level 3 audits, and eventually mandate CMMC across all defense contracts.

Who requires CMMC certification?

Organizations within the DIB that handle FCI or CUI are required to obtain CMMC certification only if the DoD solicitation or subcontract includes the CMMC clause under DFARS 252.204-7021. The specific CMMC level required will be listed in the solicitation, and organizations must achieve certification at that level to be eligible for the contract. Organizations handling FCI or CUI without an explicit CMMC requirement in the solicitation are not automatically required to be certified.

DoD contractors

What are they?

DoD contractors are companies or entities that enter into direct contracts with the Department of Defense to provide goods or services. These contractors play a pivotal role in the defense supply chain, delivering everything from advanced weaponry to logistical support.

Examples for clarity:

• Lockheed Martin – a leading aerospace and defense company.
  
• Northrop Grumman – specializes in aerospace and defense technologies.
  
• General Dynamics – provides aerospace and defense systems.
  

Why do they require CMMC certification?

DoD contractors are required to obtain CMMC certification only if the contract they are pursuing specifies a required CMMC level. This certification ensures that organizations meet the cybersecurity standards necessary to protect CUI and FCI. The CMMC framework assesses an organization’s cybersecurity maturity across various levels, aligning with the sensitivity of the information handled. Without the appropriate CMMC certification for the specified level, contractors are ineligible for contract awards.

Vendors

What are they?

Vendors in the defense supply chain are third-party suppliers that provide products or services to DoD contractors. They may not have direct contracts with the DoD but are essential in the production and delivery of defense-related goods and services.

Examples for clarity:

• Small parts manufacturers supplying components for military equipment.
  
• Software developers providing specialized applications for defense systems.
  
• Logistics companies managing the transportation of defense materials.
  
  

Why do they require CMMC certification?

Vendors are required to obtain CMMC certification only if they are part of a contract that specifies a required CMMC level. This ensures their cybersecurity practices align with DoD requirements, particularly when handling CUI or FCI. The certification process helps mitigate risks associated with introducing vulnerabilities into the defense supply chain. Vendors without the necessary certification for a specified contract may be excluded from that supply chain, affecting their business opportunities.

Subcontractors

What are they?

Subcontractors are entities that enter into agreements with DoD contractors to perform specific tasks or provide services as part of a larger contract. They operate under the umbrella of the primary contractor but are integral to the completion of defense projects.

Examples for clarity:

• A cybersecurity firm hired to assess and enhance the security posture of a defense system.
  
• An engineering company tasked with designing components for military vehicles.
  
• A research institution conducting studies on defense technologies.
  
  

Why do they require CMMC certification?

Subcontractors are required to obtain CMMC certification if their work involves handling CUI or FCI under a contract that includes the CMMC requirement. Even if they do not have direct contracts with the DoD, their work often involves access to CUI or FCI. CMMC certification helps maintain the integrity and security of the entire defense supply chain.

Who does CMMC apply to in the Defense Industrial Base?

CMMC applies only to organizations within the Defense Industrial Base (DIB) whose DoD contracts explicitly require it. This includes contractors, subcontractors, vendors, or other entities involved in the development, production, or maintenance of defense systems and services, but only if the contract specifies a required CMMC level. The certification ensures that parties covered by the requirement adhere to consistent cybersecurity standards, thereby protecting sensitive information and supporting national security.

How long does CMMC compliance take?

Achieving CMMC compliance varies depending on the organization's current cybersecurity posture and the required certification level. On average, organizations may need several months to a year to implement necessary changes, conduct internal assessments, and prepare for the official certification process. The timeline can be influenced by factors such as the complexity of existing systems, resource availability, and the level of certification sought.

Is CMMC compliance mandatory?

CMMC compliance is mandatory only for organizations seeking to participate in DoD contracts that explicitly include a required CMMC level. The Department of Defense has established CMMC to ensure that entities covered by the requirement uphold robust cybersecurity practices. Organizations that fail to achieve the necessary certification for a specified contract are ineligible for contract awards, which can significantly impact their business operations.

What are the non-compliance consequences for CMMC?

Non-compliance with CMMC can lead to several severe consequences, including:

• Loss of contract eligibility: Organizations without the required CMMC certification are barred from bidding on or receiving DoD contracts that include a CMMC requirement.
  
• Financial penalties: While CMMC itself does not impose fines, organizations that misrepresent compliance on DoD contracts could potentially face consequences under laws such as the False Claims Act (FCA). The FCA allows for fines if a contractor knowingly misrepresents compliance or fails to meet contract requirements, but these penalties are not specific to CMMC certification.
  
• Reputation damage: Failure to comply can tarnish an organization's reputation, making it challenging to establish trust with potential partners and clients.
  
• Legal actions: Non-compliance may expose organizations to lawsuits and other legal repercussions.
  

What are important CMMC certification levels?

Introduction

CMMC 2.0 introduces a streamlined framework with three certification levels, each corresponding to the sensitivity of the information handled and the required cybersecurity practices. Organizations must achieve the appropriate level to be eligible for DoD contracts involving CUI or FCI.

Level 1 (Basic Cyber Hygiene)

This foundational level requires organizations to implement basic cybersecurity practices to protect FCI. It consists of 17 practices aligned with FAR 52.204-21.

Level 2 (Advanced Cyber Hygiene)

Level 2 builds upon Level 1 by incorporating additional practices to protect CUI. It aligns with NIST SP 800-171 and includes 110 practices.

Level 3 (Expert)

The highest level focuses on protecting CUI from Advanced Persistent Threats (APTs). It builds on Level 2 requirements, which already cover CUI protection, and adds enhanced practices drawn from NIST SP 800-172 for more robust defense against advanced threats.

To achieve Level 3, organizations must implement all 110 security controls from NIST SP 800-171, plus 24 additional "delta" controls from NIST SP 800-172, specifically designed to counter advanced cyber threats. Level 3 does not introduce new requirements for FCI, as FCI is already addressed at Level 1. Assessments for Level 3 are conducted directly by the DoD and are not conducted by a C3PAO or through self-assessment.

Simplify CMMC compliance with Scrut

Scrut helps defense contractors, vendors, and subcontractors manage CMMC requirements across all levels with clarity and control. The platform automatically maps your existing security controls to NIST SP 800-171, giving you real-time visibility into compliance progress and reducing the manual effort of tracking requirements.

It also auto-generates essential documentation such as the System Security Plan (SSP) and supporting policies tailored to your environment, saving both time and consulting costs.

When it’s time for assessment, Scrut makes evidence management simple. Teams can securely collect, organize, and share artifacts with Certified Third-Party Assessment Organizations (C3PAOs) for faster reviews. Continuous monitoring and automated remediation tracking then help you maintain compliance readiness long after the audit.

FAQs

Is CMMC required for all DoD contractors?

No. DoD contractors must obtain the appropriate CMMC certification only if the contract explicitly includes a CMMC requirement. Under CMMC 2.0, the Department of Defense plans for all contracts involving FCI or CUI to eventually require certification, but at present, it applies only to contracts that specify a required CMMC level.

Do I need CMMC if I only handle FCI?

‍Yes. Organizations that handle only Federal Contract Information (FCI) are required to achieve at least Level 1 certification.

What happens if a subcontractor does not have CMMC certification?

If a subcontractor lacks the required CMMC certification for a specific contract, they may be excluded from the defense supply chain, which can also impact the prime contractor’s eligibility or ability to fulfill contract requirements.

Does every vendor in the supply chain need CMMC?

Only vendors that handle Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) are required to obtain the appropriate CMMC certification. Vendors that do not process or access this data are not subject to the requirement.

How much does CMMC certification cost for small businesses?

Costs depend on the organization’s size, cybersecurity maturity, and required certification level. Expenses typically include gap assessments, remediation, documentation preparation, and third-party audits (for levels that require C3PAO assessment).

Can CMMC apply to nonprofits or academia?

‍Yes. Nonprofits, research institutions, and universities that handle CUI or FCI under DoD contracts are subject to CMMC requirements and must obtain the necessary certification.

What is the difference between NIST SP 800-171, DFARS, and CMMC?

• NIST SP 800-171 outlines security requirements for protecting CUI in non-federal systems.
  
• DFARS 252.204-7012 mandates that DoD contractors implement NIST SP 800-171 controls.
  

CMMC 2.0 builds on these requirements by introducing a certification program to verify that the necessary controls are implemented and maintained.