CMMC Certification: A checklist to get you started

Regularly working with the Department of Defense (DoD) means you may have heard of the Cybersecurity Maturity Model Certification (CMMC) program. While it’s been under revision for several years to upgrade the DoD’s cybersecurity requirements, the final rule for the CMMC program passed in October 2024. With this, the DoD is beginning to enforce CMMC through implementation phases over the next three years.
‍

If you’re looking to secure your place in the future of DoD contracting, it’s time to get CMMC certified. Depending on where you are in your security and compliance journey, achieving CMMC certification may require implementing additional security standards, processes, and reporting mechanisms.
 

We created this checklist to make the process of becoming CMMC certified easier by focusing on why the CMMC certification matters, the steps to becoming certified, and how to successfully implement and maintain the certification. 

‍

What CMMC means for you 

What exactly is CMMC? It’s a program designed to ensure that defense contractors and subcontractors in the Defense Industrial Base (DIB) have the proper cybersecurity protocols to responsibly and safely handle sensitive unclassified information and government data.
  

What is the DIB?  

According to the Congressional Research Service, the DIB is “The network of organizations, facilities, and resources that provides the U.S. government—particularly the Department of Defense (DOD)—with defense-related materials, products, and services."
 

To help the DoD verify that its contractors are meeting cybersecurity standards, the CMMC program is organized into three levels. Each level has a corresponding set of requirements based on the type of data a company handles. And as you’ve probably already guessed: the more sensitive information you handle, the more stringent assessments and cybersecurity requirements your company must meet.

‍

Level 1: Basic safeguarding of FCI

Level 1 for CMMC deals with basic cyber hygiene and has the least amount of requirements. Its goal is to protect Federal Contract Information (FCI). This is information that isn’t intended for public release, such as contract details, communication records, or anything the government creates, uses, or shares for a contractor to develop or deliver a product or service. 

‍

Level 2: Broad protection of CUI 

The goal of level 2 is to protect Controlled Unclassified Information (CUI). CUI covers anything that’s sensitive government information but isn’t classified. What is or isn’t considered CUI can vary due to laws and regulations, but usually it’s information that’s created or possessed by the government. Some general examples include personally identifiable information (PII), critical technology, software documentation, and contractor performance evaluations. 

‍

Level 3: Higher-level protection of CUI against advanced persistent threats

Companies that deal with extremely sensitive CUI and are at risk for advanced persistent threats (APTs) are required to meet level 3 requirements. The DoD determines which type of CUI is most sensitive and at risk for APTs, but if you’re working on a high-priority contract or program for the DoD, you’re likely handling level 3-worthy CUI.
 

Pro tip: Knowing what level you need to achieve will depend on the type of contracts you handle. Your contracting officer can provide more information on your current contract’s level, but as CMMC phases are implemented, contracts will also contain CMMC level requirements. 

‍

Checklist: How to become CMMC certified 

The DoD is rolling out CMMC in four phases over the next three years. The phases are designed to add CMMC requirements incrementally to reduce the financial impact on contractors, avoid overwhelming them, and give them time to implement CMMC while ensuring the program runs smoothly. 
‍

• Phase one: Begins 60 days after the final rule becomes effective. Solicitations will require a level 1 or level 2 self-assessment when applicable. 
• Phase two: Begins 12 months after phase one starts. Solicitations will require level 2 certification when applicable. 
• Phase three: Begins 24 months after phase one. Solicitations will require a level 3 certification when applicable. 
• Phase four: Begins 36 months after phase one. All solicitations and contracts will include CMMC level requirements as a condition to winning a contract award. 
  ‍

While these phases give you time to assess your current security posture and determine your next steps, you don’t want to wait until the final phase to become certified. Even if you meet federal cybersecurity requirements of other programs, like FedRAMP, it doesn’t mean you’re fully compliant across all government agencies.
 

By following our checklist, you can confidently navigate the CMMC certification process and ensure your business is prepared to continue working with the DoD.

{{cmmc="/checklists"}}