The Cybersecurity Maturity Model Certification program, known as CMMC, is the Department of Defense's framework for verifying that contractors protect sensitive information. Its requirements began phasing into defense contracts in late 2025, and they will reach more contracts over the following years. For small suppliers, it is one of the most important compliance changes in a generation.
This explainer covers what CMMC is, what each level requires, how the rollout is scheduled and how a small company can prepare without wasting money. It is written for owners and managers of small defense suppliers, not for cybersecurity specialists.
Where CMMC came from
CMMC did not create the underlying security requirements. Since the late 2010s, contractors handling controlled unclassified information have been required under DFARS 252.204-7012 to implement the security requirements of NIST SP 800-171 and to report cyber incidents to the Department of Defense within 72 hours of discovery. The problem was verification. For years, many contractors attested to compliance without anyone checking.
CMMC adds the check. The program rules are set out in 32 CFR Part 170, which took effect in December 2024. A separate DFARS rule, effective November 10, 2025, puts CMMC requirements into contracts. Together they mean that, for covered contracts, a supplier must have the required CMMC status before award and maintain it during performance.
What it covers
CMMC focuses on two kinds of information. Federal contract information is information provided by or generated for the government under a contract and not intended for public release. Controlled unclassified information is more sensitive information that requires safeguarding under law, regulation or policy. The level of CMMC a contract requires depends on which kind of information the supplier will handle.
For many small suppliers, controlled unclassified information arrives in ordinary ways: a drawing with a distribution marking, a specification from a prime, an email thread about a part's performance. Recognizing it, and knowing where it goes once it arrives, is the starting point for everything else.
The levels, simply
- Level 1 covers basic safeguarding of federal contract information, drawn from the 15 requirements in FAR 52.204-21, and is met through an annual self-assessment.
- Level 2 covers controlled unclassified information and aligns with the 110 security requirements of NIST SP 800-171. Depending on the contract, it requires either a self-assessment or an assessment by an authorized third-party assessment organization, known as a C3PAO, generally every three years.
- Level 3 adds enhanced requirements drawn from NIST SP 800-172 for the most sensitive programs and is assessed by the government, through the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center.
At each level, a senior official of the company must affirm compliance, and results are recorded in the Department of Defense's Supplier Performance Risk System. Affirmations are not a formality. A company that affirms compliance it has not achieved takes on real legal risk.
How the rollout is phased
The Department of Defense is introducing CMMC requirements into contracts over four phases rather than all at once:
- Phase 1 began November 10, 2025, and focuses on Level 1 and Level 2 self-assessments.
- Phase 2 is scheduled to begin November 10, 2026, when Level 2 third-party assessments by C3PAOs begin to be required in applicable contracts.
- Phase 3 is scheduled to begin in November 2027 and adds Level 3 requirements for applicable programs.
- Phase 4, scheduled for November 2028, brings full implementation across applicable contracts.
The phases describe when the department expects to include requirements, but contracting officers and program offices can include higher requirements earlier. Primes also flow CMMC requirements down to their subcontractors, so a small supplier may feel the pressure from its customers before it sees a clause in its own contract.
CMMC is not a one-time audit. It is a way of running the company's systems every day.
What it costs, and who pays
The cost of CMMC varies widely with the size and complexity of the company and, above all, with how many systems handle controlled information. For a small supplier, the main costs usually fall into a few buckets: remediation of gaps in its IT environment, new tools or services such as a secured cloud enclave, the staff or adviser time to write and maintain documentation, and, for Level 2 certification, the assessment itself.
There are also costs that are easy to overlook. Controls change how people work. Multifactor authentication, restrictions on removable media, logging and review, and limits on who can see which drawings all take time to adopt. A small company should budget for that friction, not only for the technology.
These costs are generally borne by the supplier. Some can be recovered through overhead rates on cost-type contracts, but for many small companies working on fixed-price subcontracts, the investment comes out of margin. That is one reason cybersecurity maturity has become, in effect, a condition of market access rather than an optional improvement.
How to prepare
The first step is to understand what information the company actually handles and where it lives. Many small suppliers find that controlled information has spread across email, shared drives and personal devices. Reducing the systems that touch it, sometimes by moving it into a dedicated, well-controlled environment, can make compliance far more manageable.
From there, a supplier needs a written system security plan, a gap assessment against the required controls, a plan to close the gaps and the evidence to show that the controls work in practice. Specialized advisers and managed service providers can help, but the company remains responsible for the result.
A practical sequence for a small company looks something like this:
- Map the information: which contracts involve federal contract information or controlled unclassified information, who receives it and where it is stored.
- Define the boundary: decide which people, systems and locations will handle controlled information, and keep that boundary as small as the work allows.
- Assess the gaps: compare current practice against each required control, candidly, and score the results.
- Close the gaps in order of risk, and document how each control is implemented.
- Collect evidence as a habit, not as a project before the assessment.
- Plan for the assessment itself, including scheduling with a C3PAO well ahead of contract deadlines.
A worked illustration
Consider a hypothetical thirty-person machine shop that receives controlled drawings from two primes. Today the drawings arrive by email, get saved to a shared drive, are printed on the shop floor and are sometimes opened on a manager's laptop at home. Every one of those systems is in scope.
If the shop instead receives drawings in a dedicated, secured environment, limits access to the people who need them, controls printing and keeps them off personal devices, the set of systems that must meet Level 2 shrinks considerably. The controls do not get easier, but there are fewer places to apply them. For a small company, that decision about scope is often the most important one it makes.
Common mistakes
Several mistakes come up again and again. The first is treating CMMC as an IT project. It touches contracts, engineering, the shop floor, human resources and physical security. The second is assuming a tool or a cloud product delivers compliance by itself. Products can help, but they must be configured and operated correctly, and the company still owns the result.
The third is waiting. Assessor capacity is limited and remediation takes time. The rules allow a conditional status with a plan of action and milestones in limited cases, but open items must be closed within 180 days, and not every requirement is eligible. A supplier that starts late may find that its customers have moved to someone ready sooner. The fourth is letting controls lapse after the assessment. CMMC is not a one-time audit. It is a way of running the company's systems every day.
Outside help needs the same care. Small suppliers often depend on it, and before hiring an adviser or managed service provider, it is worth asking whether they have supported companies through a CMMC assessment, how they will define the assessment boundary, whether their own services fall within the company's scope and what evidence they will produce. A provider that handles controlled information on the company's behalf may itself need to meet the relevant requirements. The company should also confirm that its contracts with providers make responsibilities clear, so that nothing falls between them at assessment time.
Why ownership matters
For a small company, meeting CMMC can require investment that is hard to justify alone. A parent with shared compliance and technology services can spread that cost and bring experience from one supplier to the next. That is part of what UpManagement Bastion, a platform in formation, is being built to provide.
UpManagement's shared-services platform covers finance, compliance, legal, technology and operations. For defense suppliers, Bastion is being built to offer industrial security, trade compliance and CMMC readiness as portfolio shared services, so that each company benefits from work done once and maintained well. Bastion's facility clearance and related approvals are not yet in place, and it will not represent otherwise.
This note is general information, not legal or compliance advice; suppliers should confirm their specific obligations with qualified advisers.
Published by UpManagement. This article is general information about the sectors in which the UpManagement companies operate. It is not legal, tax, investment or compliance advice, and it is not an offer to sell or a solicitation of an offer to buy any security. Where a company is described as a platform in formation, its approvals are not yet in place.
