The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's mandatory framework for verifying that defense contractors adequately protect sensitive government information. If your company holds or works on DoD contracts, CMMC is not optional — it is a contract requirement that is actively being enforced.
Take the CMMC Assessment Tool Talk to an AssessorFor years, the DoD relied on defense contractors to self-certify that they were following cybersecurity requirements under DFARS clause 252.204-7012 and NIST SP 800-171. The problem: self-certification created no accountability, and adversaries — most notably nation-state actors — were actively exploiting unprotected contractors to steal sensitive defense technology, program data, and technical specifications.
CMMC was developed to solve this. Under CMMC 2.0, contractors must demonstrate compliance through verified assessments — not just sign a document saying they comply. The program requires contractors to be assessed by credentialed third-party organizations and assessors, ensuring that protections are actually in place.
Which CMMC level applies to you depends on what type of information your organization handles:
Information provided by or generated for the Government under a contract to develop or deliver a product or service. If you handle FCI, you need at minimum CMMC Level 1.
Examples: Contract deliverables, procurement data, pricing information
Government-created or government-handled information that requires safeguarding under law or policy, but is not classified. If you handle CUI, you need CMMC Level 2 or Level 3.
Examples: Technical specifications, export-controlled data, DoD program information, engineering drawings
CMMC 2.0 simplified the original five-level model into three levels, each with distinct requirements and assessment methods.
17 basic cybersecurity practices from FAR 52.204-21, focused on protecting Federal Contract Information (FCI).
110 security practices fully aligned with NIST SP 800-171, protecting Controlled Unclassified Information (CUI).
110+ practices including NIST SP 800-172 requirements, for the most critical DoD programs facing advanced persistent threats.
The vast majority of DIB contractors will require CMMC Level 2. This is the level TenGuard Security specializes in.
CMMC Level 2's 110 practices are organized across 17 domains derived from NIST SP 800-171:
CMMC requirements flow down through the supply chain. Even if you are a subcontractor or sub-tier supplier, if the prime's contract requires CMMC and you handle FCI or CUI, you must comply. Primes are responsible for ensuring their subcontractors meet CMMC requirements.
For Level 2 organizations requiring a third-party assessment, here is how the process typically works:
Define your assessment boundary — which systems, people, and locations handle CUI — and document your CUI data flows.
Evaluate your current security practices against all 110 CMMC Level 2 requirements. Identify what is compliant, partially compliant, or missing.
Implement required controls, develop your System Security Plan (SSP), and create a Plan of Action & Milestones (POA&M) for any remaining gaps.
A CMMC Third-Party Assessment Organization conducts the official assessment. The Lead Assessor reviews your documentation, interviews staff, and tests controls.
Assessment results are submitted to the Cyber AB's CMMC Enterprise Mission Assurance Support Service (eMASS). Upon approval, your certification is issued.
CMMC Level 2 certification is valid for three years. You must maintain your controls and documentation continuously and prepare for your next assessment cycle.
CMMC 2.0 was finalized as a federal rule and is being phased into DoD contracts. The phased rollout means that contract clauses are appearing in new solicitations and renewals at increasing frequency. The DoD has communicated a clear trajectory: CMMC requirements will be universal across all applicable defense contracts.
Many contractors are already seeing CMMC requirements appear in their RFPs and contract renewals. If you are waiting for "your contract" to require it, you may find yourself without time to prepare when it does.
The typical timeline to achieve CMMC Level 2 compliance from scratch is 6 to 18 months. Starting now protects your ability to compete for contracts.
TenGuard Security provides end-to-end CMMC support — from understanding where your organization stands today to achieving formal certification. As a Lead Certified CMMC Assessor (Lead CCA), Johnny Roye brings both the authority to conduct official assessments and the consulting expertise to help you prepare for them.
Whether you need a gap analysis to understand your compliance gaps, help developing your SSP and POA&M, guidance on scoping your CUI environment, or a pre-assessment review before your formal C3PAO assessment — TenGuard provides qualified, straightforward support tailored to small and mid-sized defense contractors.