CMMC Certification: A checklist to get you started

If you’re planning to compete for Department of War (DoW) contracts moving forward, now is the time to get serious about CMMC certification.

‍

After several years of updates, the Cybersecurity Maturity Model Certification (CMMC) program was finalized in October 2024 to strengthen DoD cybersecurity requirements. The DFARS acquisition rule took effect on November 10, 2025, kicking off a phased rollout of CMMC requirements across contracts over the next three years.

‍

What this means for you depends on where you are today. Achieving CMMC certification may require new security controls, formalized processes, and ongoing reporting. To simplify that path, this checklist breaks down why CMMC matters, the steps to get certified, and how to implement and maintain compliance effectively.

‍

What CMMC means for you 

What exactly is CMMC? It’s a program designed to ensure that defense contractors and subcontractors in the Defense Industrial Base (DIB) have the proper cybersecurity protocols to responsibly and safely handle sensitive unclassified information and government data.
  

What is the DIB?  

According to the Congressional Research Service, the DIB is “The network of organizations, facilities, and resources that provides the U.S. government—particularly the Department of Defense (DOD)—with defense-related materials, products, and services."
 

To help the DoW verify that its contractors are meeting cybersecurity standards, the CMMC program is organized into three levels. Each level has a corresponding set of requirements based on the type of data a company handles. And as you’ve probably already guessed: the more sensitive information you handle, the more stringent assessments and cybersecurity requirements your company must meet.

‍

Level 1: Basic safeguarding of FCI

Level 1 for CMMC deals with basic cyber hygiene and has the least amount of requirements. Its goal is to protect Federal Contract Information (FCI). This is information that isn’t intended for public release, such as contract details, communication records, or anything the government creates, uses, or shares for a contractor to develop or deliver a product or service. 

‍

Level 1 requires:

• Annual affirmation and compliance with the 15 basic safeguarding requirements in FAR clause 52.204-21, Basic Safeguarding of Covered Contractor Information Systems
• Annual self-assessment that’s entered in the Supplier Performance Risk System (SPRS)

‍

Level 2: Broad protection of CUI 

The goal of Level 2 is to protect Controlled Unclassified Information (CUI). CUI covers anything that’s sensitive government information but isn’t classified. What is or isn’t considered CUI can vary due to laws and regulations, but usually it’s information that’s created or possessed by the government. Some general examples include personally identifiable information (PII), critical technology, software documentation, and contractor performance evaluations. 

‍

Level 2 requires:

• Annual affirmation and compliance with the 110 security requirements in NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
• Either a self-assessment or a C3PAO certification assessment—depending on contract requirements—performed every three years and recorded in SPRS or the CMMC Enterprise Missions Assurance Support Service (eMASS), as applicable

‍

Level 3: Higher-level protection of CUI against advanced persistent threats

Companies that deal with extremely sensitive CUI and are at risk for advanced persistent threats (APTs) are required to meet Level 3 requirements. The DoW determines which type of CUI is most sensitive and at risk for APTs, but if you’re working on a high-priority contract or program for the DoW, you’re likely handling Level 3-worthy CUI.

‍

Level 3 requires:

• Maintenance of final Level 2 status through a C3PAO certification assessment every three years
• Assessment by the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) every three years
• Annual affirmation and compliance with 24 identified requirements from NIST SP 800-172, Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171

‍

Knowing what level you need to achieve will depend on the type of contracts you handle. Your contracting officer can provide more information on your current contract’s level, but as CMMC phases are implemented, contracts will also contain CMMC level requirements. 

‍

Checklist: How to become CMMC certified 

The DoW is rolling out CMMC in four phases. The phases are designed to add CMMC requirements incrementally to reduce the financial impact on contractors, avoid overwhelming them, and give them time to implement CMMC while ensuring the program runs smoothly. 
‍

• Phase 1 (Nov. 10, 2025 – Nov. 9, 2026): Applicable solicitations may require Level 1 or Level 2 self requirements
• Phase 2 (Beginning Nov. 10, 2026): Applicable solicitations may require Level 2 C3PAO certification
• Phase 3 (Beginning Nov. 10, 2027): Applicable solicitations may require Level 3 certification‍
• Phase 4 / Full implementation (Beginning Nov. 10, 2028): CMMC becomes the default requirement for covered solicitations and contracts involving contractor systems that process, store, or transmit FCI or CUI, excluding COTS-only contracts
  ‍

While these phases give you time to assess your current security posture and determine your next steps, you don’t want to wait until the final phase to become certified. Even if you currently meet federal cybersecurity requirements of other programs, like FedRAMP, that does not automatically mean you satisfy CMMC requirements for DoW contracts.
 

By following our checklist, you can confidently navigate the CMMC certification process and ensure your business is prepared to continue working with the DoW.

‍

Here are the steps to become CMMC certified:

• Step 1: Confirm which CMMC level your business needs
• Step 2: Establish your CUI and FCI boundaries
• Step 3: Perform a gap assessment
• Step 4: Document plan of action and milestones and SPRS
• Step 5: Execute your plan of action and milestones 
• Step 6: Conduct assessment
• Step 7: Maintain certification 

‍

{{cmmc-2="/checklists"}}