CMMC guide

What Is CMMC?

CMMC stands for Cybersecurity Maturity Model Certification, DoD's program to verify that contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) (32 CFR Part 170). It has three levels, with different requirements and assessment paths.

By Doug Majewski, President, Athena Consulting Group, LLC · Last reviewed: October 19, 2026

CMMC consulting Free Quick Score

What people mean by the revised CMMC model

“CMMC 2.0” is an informal name for the revised three-level model codified in October 2024 in 32 CFR Part 170. The regulation calls it the CMMC Program. Start with the levels comparison and check which contract requirements apply to you.

Compliance is not the same as certification

Compliance describes implementing the applicable security requirements. CMMC status describes the assessment and affirmation path in 32 CFR 170.4; a policy, checklist, or consultant report alone does not grant that status.

  • Level 1 produces a self-assessment status with affirmation (170.15).
  • Level 2 (Self) produces a self-assessment status with affirmation (170.16).
  • Level 2 (C3PAO) produces a certification assessment status following an authorized third-party assessment (170.17).
  • Level 3 produces a certification assessment status following DCMA DIBCAC assessment (170.18).

A self-reported tool score is preparation, not verified evidence or an official CMMC status.

What your contract requires

DFARS 252.204-7021 connects the stated CMMC level and assessment type to contract performance. Read the solicitation and signed contract rather than treating every contractor as having the same deadline. The July 13, 2026 Phase 2 suspension limits current designations to Level 1 (Self) and Level 2 (Self), as explained in the DoD suspension memo and CMMC status tracker.

A practical starting point

For example, a contractor handling only FCI starts with the 15 Level 1 FAR items; an organization handling CUI reviews the contract designation and 110 Level 2 requirements (170.15; 170.16). Identify your boundary before buying tools. Then document implementation, gather objective-level evidence, and address gaps using the preparation steps.

CMMC guides

Levels, requirements and checklists

SSP, POA&M, SPRS and evidence

Scoping, enclaves and CUI

DFARS and NIST

Consulting, RPOs and C3PAO preparation

More CMMC guides

Free tools

More assessment tools — access requirements apply

Frequently asked questions

What does CMMC stand for?

Cybersecurity Maturity Model Certification, the DoD program defined in 32 CFR Part 170.

What is CMMC compliance?

Implementing the security requirements applicable to your contract and assessed environment. An official CMMC status also requires the applicable assessment and affirmation.

What is CMMC certification?

A certification assessment status follows a Level 2 C3PAO or Level 3 DCMA DIBCAC assessment. Level 1 and Level 2 (Self) use self-assessment statuses, not third-party certification.

Is a free readiness score a certification?

No. A self-reported readiness score does not verify evidence, submit to SPRS, or grant CMMC status.

Further reading

Related Athena pages and authoritative external references.

On Athena

Authoritative external sources

Ready to act on this?

Run the free Quick Score, then walk through the Assessment Pack.

Free CMMC Quick ScoreSee the Assessment PackReadiness assessment