.svg)
Most companies first hear about CMMC when a solicitation lands with a clause they have never seen before, or when a prime contractor asks a question they cannot answer. By that point, the timeline is already tight.
CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense's framework for verifying that contractors actually protect the sensitive information they handle. It replaced the old trust-based model where contractors self-attested to security practices with no verification. The DoD concluded that self-attestation without verification was not working, and CMMC is the result.
The program is live. Phase 1 started in November 2025, and contracting officers are now including CMMC clauses in new solicitations. This is not a future consideration. It is a current contract requirement.
The Three CMMC Levels
CMMC 2.0 simplified the original five-level model down to three, each aligned with a specific data type and assessment method:
Level 1 — Foundational
15 practices | Self-assessment | Protects FCI
Basic security hygiene derived from FAR 52.204-21. Annual self-assessment submitted to SPRS. No POA&Ms permitted: all 15 practices must be fully implemented. For a detailed breakdown, see our CMMC Level 1 implementation guide.
Level 2 — Advanced
110 practices | Self or C3PAO assessment | Protects CUI
Aligned to NIST SP 800-171. Assessment method depends on CUI sensitivity: self-assessment for lower sensitivity, third-party C3PAO assessment for higher sensitivity. This is where compliance effort escalates significantly in both control complexity and evidence requirements.
Level 3 — Expert
110+ practices | DIBCAC assessment | Protects sensitive CUI
Adds controls from NIST SP 800-172 beyond the 800-171 baseline. Assessment conducted by the Defense Industrial Base Cybersecurity Assessment Center. Few contractors need Level 3, but those who do are handling information where a breach has direct national security implications.
The key distinction
Level 1 protects FCI (contract-related information not intended for public release). Levels 2 and 3 protect CUI (information where unauthorized disclosure could harm national security). The level required for any given contract depends on what type of information the contractor handles, not the size of the company.
The Rollout Timeline
CMMC is deploying in four phases:
| Phase | Requirement |
| Phase 1 (Nov 2025) | Level 1 and Level 2 self-assessment requirements in new solicitations |
| Phase 2 (Nov 2026) | Level 2 C3PAO (third-party) assessments required |
| Phase 3 (Nov 2027) | Level 3 DIBCAC assessments required; Level 2 may apply to option periods |
| Phase 4 (Nov 2028) | Full implementation across all applicable DoD solicitations and contracts |
The phased approach gives the ecosystem time to build assessment capacity, but it does not give contractors time to delay. Companies responding to solicitations in Phase 1 need Level 1 or Level 2 self-assessment capability now.
Who Needs CMMC
The short answer: any company that handles FCI or CUI as part of a DoD contract or subcontract.
This includes prime contractors, subcontractors, and suppliers at any tier of the defense supply chain. CMMC requirements flow down contractually. If a prime contractor's solicitation includes a CMMC clause, every subcontractor handling the relevant information must meet the specified level.
The practical impact is that thousands of small and mid-sized companies that have been operating on informal security practices now face a binary choice: achieve and maintain CMMC compliance, or become ineligible for defense work.
This is not optional
CMMC compliance is a condition of contract award. Without the required level on record in SPRS, a company cannot win or retain DoD contracts, regardless of the quality or price of its products.
How CMMC Relates to SOC 2 and ISO 27001
Companies that already hold SOC 2 or ISO 27001 certifications have a significant head start on CMMC compliance:
SOC 2
SOC 2 Trust Services Criteria cover access controls (CC6.1), system operations (CC7.1), and change management (CC8.1) in ways that directly map to CMMC practices across access control, system integrity, and configuration management. The control objectives are similar; the evidence format and assessment methodology differ.
ISO 27001
ISO 27001 Annex A controls for access management (A.9), physical security (A.11), communications security (A.13), and operations security (A.12) align closely with CMMC Level 1 and Level 2 practices. ISO 27001's risk-based ISMS approach also provides the systematic framework that CMMC expects, particularly at Level 2.
The gap
Neither SOC 2 nor ISO 27001 addresses CMMC-specific requirements like SPRS submission, the DoD's assessment methodology, or CUI-specific handling and marking procedures. Companies with existing certifications still need CMMC-specific preparation, but the incremental effort is substantially lower than starting from scratch.
The efficient path
Build one security program and map multiple frameworks onto it, rather than treating each framework as a separate compliance project. Build the program once, map it many ways.
GRC Platforms and CMMC
Both Vanta and Secureframe now offer CMMC modules that map practices to automated evidence collection and track readiness across levels. For companies that also need SOC 2 or ISO 27001, these platforms serve as a single system of record across frameworks.
For Level 1, a platform is helpful but not strictly necessary given the small number of controls. For Level 2's 110 practices, a platform becomes significantly more valuable for managing the volume of evidence, tracking control ownership, and maintaining continuous readiness between assessment cycles.
The critical distinction
The platform manages evidence and tracks compliance status. It does not design the security program, write the policies, or operate the controls. That operational layer, the part that determines whether controls are actually effective, requires people and process alongside the technology.
Getting Started: What Matters First
Companies approaching CMMC for the first time consistently overestimate the technical complexity and underestimate the documentation and process work.
Four steps to get started
1. Determine your required level. Review your contracts and solicitations for CMMC clauses. Identify whether you handle FCI (Level 1) or CUI (Level 2+). If unsure whether specific information qualifies as CUI, your contracting officer or prime contractor can clarify.
2. Scope the environment. Define which systems, people, and facilities process the relevant information. Scoping decisions directly control the cost and complexity of compliance. A well-segmented environment is dramatically easier to assess than one where sensitive data flows through every system.
3. Assess current state. Map existing controls against the required practices. Companies with existing security programs, SOC 2 compliance, or compliance automation will find significant overlap. Companies without a formal program should expect gaps in documentation, access management, and evidence collection.
4. Build the program, not just the checklist. The companies that maintain CMMC compliance year over year build a security program as a permanent operating function. Annual assessments become routine outputs of a running program rather than annual scrambles.
Need Help With CMMC?
We help companies build security programs that map to CMMC, SOC 2, and ISO 27001.
Book a Strategy CallFrequently Asked Questions
What is CMMC 2.0?
CMMC 2.0 (Cybersecurity Maturity Model Certification) is the Department of Defense's framework for verifying that contractors protect sensitive information. It replaced the previous self-attestation model with a structured three-level certification program. Level 1 covers basic cyber hygiene for Federal Contract Information. Level 2 aligns with NIST SP 800-171 for Controlled Unclassified Information. Level 3 adds enhanced controls for the most sensitive CUI. The program became active in November 2025.
Who needs CMMC certification?
Any company that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as part of a DoD contract or subcontract needs CMMC certification at the appropriate level. This applies to prime contractors, subcontractors, and suppliers at every tier of the defense supply chain. The required level flows down through contract clauses.
How does CMMC relate to SOC 2?
CMMC and SOC 2 share significant control overlap in access management, system integrity, and configuration management. Companies with existing SOC 2 compliance will find many CMMC practices already in place. The key differences are the assessment methodology (CMMC uses NIST SP 800-171A), the reporting mechanism (SPRS submission), and CUI-specific handling requirements that SOC 2 does not address.
How does CMMC relate to ISO 27001?
ISO 27001 Annex A controls cover access management, physical security, communications security, and operations security in ways that align closely with CMMC practices. ISO 27001's risk-based ISMS approach also provides the systematic management framework that CMMC Level 2 expects. Companies with ISO 27001 certification have a strong foundation but still need CMMC-specific assessment preparation and SPRS submission.
Can I use Vanta or Secureframe for CMMC compliance?
Yes. Both platforms offer CMMC modules that map practices to evidence collection and track readiness. They are most valuable for Level 2, where 110 practices create significant evidence management complexity. For Level 1's 15 practices, a platform is helpful but not essential. The platform manages evidence and status tracking but does not replace the need for program design, policy development, and operational processes.
How long does CMMC certification take?
Timeline depends on existing security maturity. Companies with established security programs and existing SOC 2 or ISO 27001 compliance may need 3 to 6 months to address CMMC-specific gaps. Companies without a formal security program should plan for 9 to 18 months, covering program design, gap remediation, policy development, staff training, and assessment preparation.
What is the difference between FCI and CUI?
Federal Contract Information (FCI) is contract-related information not intended for public release, such as contract terms, project timelines, and performance reports. Controlled Unclassified Information (CUI) is government information that requires safeguarding because its unauthorized disclosure could cause harm. All CUI is also FCI, but not all FCI rises to the level of CUI. Level 1 protects FCI; Levels 2 and 3 protect CUI.
Not Sure Where to Start?
We'll help you determine your required level and build a plan to get there.
Book a Strategy CallAbout the Author
Ali Aleali, CISSP, CCSP
Co-Founder & Principal Consultant, Truvo Cyber
Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure.