What is Cybersecurity Maturity Model Certification?
CMMC, short for Cybersecurity Maturity Model Certification, is the Defense Department program that checks whether contractors and subcontractors protect the federal contract information (FCI) and controlled unclassified information (CUI) they handle. Level 1 covers FCI, Level 2 covers CUI with the 110 requirements of NIST SP 800-171, and Level 3 adds requirements for the most sensitive programs.
Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense program that verifies whether contractors and their suppliers protect the government information they handle. It applies to any company in the defense supply chain that stores or processes federal contract information or controlled unclassified information (CUI), from prime contractors to a machine shop that makes one part. CMMC ties contract awards to a recorded assessment and a senior official's affirmation that the requirements are met.
The current version, CMMC 2.0, has three levels. Level 1 covers basic safeguarding of federal contract information, such as limiting system access and keeping antivirus current, and means an annual self-assessment and affirmation against the 15 requirements in FAR 52.204-21. Level 2 applies to contractors handling CUI and covers the 110 security requirements of NIST SP 800-171 Revision 2. On July 13, 2026 the Department of War suspended Phase II, the stage that would have added assessments by authorized CMMC Third-Party Assessment Organizations (C3PAOs). The program is paused in Phase I, so Level 2 is met by a self-assessment every three years with an annual affirmation, and the Department enforces NIST SP 800-171 through self-assessments and select government-led assessments. Level 3, for the most sensitive programs, adds requirements from NIST SP 800-172 and is not part of Phase I. Results are recorded in the Supplier Performance Risk System. The pause does not remove the duty to protect covered information under DFARS 252.204-7012.
For a small manufacturer or engineering firm the hard part is rarely the technology. It is the documentation: a system security plan that describes every control and the evidence that each one operates, plus a plan of action and milestones for any gap. Scoping matters too. A company that isolates the systems and people that touch CUI into a defined enclave, often built on Microsoft 365 GCC High or a segmented network, can shrink the assessment to a fraction of its environment. Getting the scope wrong is a costly mistake, because every device in scope must meet every requirement.
NetSys's CMMC compliance service helps government contractors close the gap between their current environment and NIST SP 800-171, using its managed services for the controls that must run continuously, such as 24/7 monitoring, privileged access management, patching, and multi-factor authentication. The blog post on CMMC 2.0 compliance for small businesses explains the rollout, the Phase II suspension and what each level asks of a subcontractor.
Why it matters for a small business
If any part of your revenue comes from defense work, even as a third-tier supplier, CMMC decides whether you can keep it. Primes are already pushing the requirement down to their suppliers, and a missing self-assessment or affirmation can cost a bid regardless of how good your product is. The July 13, 2026 suspension of Phase II removed the third-party assessment step for now, not the underlying requirements. The requirements are achievable for a small firm, but they take months to implement and document. Starting now, with a clear scope and a gap assessment, is far cheaper than scrambling when a contract renewal depends on it.
Where NetSys handles this
Cybersecurity Maturity Model Certification (CMMC): FAQs
What is Cybersecurity Maturity Model Certification and who needs it?
CMMC is the Defense Department's program for checking that contractors protect the information the government shares with them. Any company that handles federal contract information or CUI under a defense contract needs it, including subcontractors. Today that means Phase I self-assessments and DFARS 252.204-7012; Phase II was suspended on July 13, 2026. This is general information, not legal advice.
What is the difference between CMMC Level 1 and Level 2?
Level 1 protects federal contract information and is met with an annual self-assessment and affirmation against the 15 requirements in FAR 52.204-21. Level 2 protects controlled unclassified information and covers the 110 requirements in NIST SP 800-171 Revision 2, self-assessed every three years and affirmed each year. Since the July 13, 2026 Phase II suspension, neither requires third-party certification.
Can a small business become CMMC compliant with Microsoft 365?
Yes, with the right configuration and the right edition. Microsoft 365 provides many of the technical controls NIST SP 800-171 asks for, including multi-factor authentication, device compliance through Intune, audit logging, encryption, and data loss prevention. Contractors handling CUI subject to export controls often need the GCC High environment rather than the commercial one, so confirm that requirement before migrating. The platform alone does not make you compliant; policies and documented evidence still have to be produced and maintained.
What does CMMC compliance mean?
It means a contractor can show it meets the CMMC level its contract requires on every system that handles the covered information. For Level 1 that is a yearly self-assessment and affirmation against the 15 requirements of FAR 52.204-21. For Level 2 it is a self-assessment against the 110 NIST SP 800-171 requirements every three years, scored in the Supplier Performance Risk System and affirmed each year by a senior official. Since the July 13, 2026 Phase II suspension, no third-party certificate is required. This is general information, not legal advice.
What is CUI in CMMC?
CUI, controlled unclassified information, is information that law, regulation or government-wide policy says must be safeguarded or have its dissemination controlled, even though it is not classified; the National Archives runs the CUI program. In defense work it usually arrives as drawings, specifications or technical data marked CUI by the prime contractor or the agency. Handling CUI is what moves a contract from CMMC Level 1 to Level 2 or higher.
How does a small contractor implement CMMC?
Start with the contract: find the CMMC level and the DFARS clauses it carries. Map where FCI or CUI is received, stored and shared, and shrink that scope where you can, for example by keeping CUI in a separate enclave used only by the people who need it. Assess the systems in scope, fix the gaps, write the system security plan and track open items in a plan of action, then post the self-assessment score in SPRS and have a senior official affirm it. An illustrative case: a 20-person machine shop that receives CUI drawings from one prime keeps them in a small GCC High enclave instead of bringing its whole network into scope.
More terms
Discuss cmmc 2.0 compliance services for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.