The Cybersecurity Maturity Model Certification (CMMC) is a framework developed by the U.S. Department of Defence (DoD) to enhance the protection of sensitive unclassified information, particularly Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) within the Defence Industrial Base (DIB). The CMMC ensures that contractors implement adequate cybersecurity practices when handling such information.

Initially released in 2020, CMMC aimed to standardize cybersecurity requirements across all DoD contractors. In response to industry feedback, the DoD introduced CMMC 2.0 in November 2021, streamlining the model to increase clarity and reduce compliance burdens while maintaining national security standards.

CMMC 2.0 consists of three certification levels, replacing the original five-tier system:

• Level 1 (Foundational): Requires annual self-assessments and focuses on basic safeguarding of Federal Contract Information (FCI) using 17 practices from FAR 52.204-21.
• Level 2 (Advanced): Aligns with NIST SP 800-171 and includes 110 practices to protect CUI. Some contractors will need a third-party assessment every three years, while others can self-assess annually.
• Level 3 (Expert): Still in development, this level is expected to align with a subset of NIST SP 800-172 and will require government-led assessments. It targets companies working with highly sensitive DoD programs.

Unlike earlier cybersecurity compliance models, CMMC is a certification process which contractors must demonstrate compliance with before being awarded contracts. Third-party assessments are performed by CMMC Third-Party Assessor Organizations (C3PAOs) accredited by the Cyber AB (the CMMC Accreditation Body).

CMMC 2.0 reinforces the importance of accountability, standardization, and risk reduction across the supply chain. It represents a proactive step by the DoD to defend against increasingly sophisticated cyber threats by ensuring defence contractors adopt and maintain strong cybersecurity postures.

The DoD is gradually implementing CMMC requirements through contract solicitations, with full enforcement expected later this year. All contractors, both national and international, seeking to work with the DoD on relevant contracts will eventually need to obtain the appropriate CMMC level certification.

Amethyst Risk Management has been tracking this regulation closely and has moved proactively to attain certification as CMMC Register Practitioners (RP’s) for several of its Cyber Security Consultants. We can now support organisations in preparing for CMMC certification.