By DeshCyber Team. Sources reviewed October 31, 2026.
A small supplier may never build a fighter jet. It might manufacture one component, maintain equipment, or provide engineering support. Yet the information on that supplier’s computers could still matter to national security.
That is the problem behind CMMC—the Cybersecurity Maturity Model Certification programme. The Department of Defense created it to verify that companies in its supply chain protect sensitive government information.
CMMC connects cybersecurity requirements with eligibility for applicable defense contracts. Its purpose reaches beyond having a policy document: companies need evidence that the required safeguards are actually in place. Government Accountability Office overview
Why did the DoD create CMMC?
Defense work depends on a large network of private businesses. Together, these companies form the Defense Industrial Base, often shortened to DIB.
Sensitive information moves through that network. An engineering company may receive technical specifications. A manufacturer may hold production drawings. A service provider may operate systems used to support government work. Attackers do not have to break into a military network if they can obtain useful information from a contractor.
The GAO reports that malicious cyber actors have targeted defense contractors’ systems to gain access to sensitive DoD data. CMMC was established to help verify that those companies meet cybersecurity requirements. GAO’s findings
Unlike a programme associated with one headline-making incident, CMMC grew from a continuing problem across the defense supply chain.
Didn’t contractors already have cybersecurity requirements?
Yes. Requirements to safeguard covered defense information existed before CMMC. The additional purpose of CMMC is verification: assessing whether contractors and subcontractors have implemented the protections required for the information they handle. The final programme rule explicitly distinguishes those existing safeguarding obligations from the assessment mechanism introduced through CMMC. CMMC final programme rule
Consider a simple example. A company might have a rule saying that former employees lose access immediately. Evidence would show whether accounts were actually disabled when people left. That difference—between a written requirement and demonstrated implementation—is central to preparing for an assessment.
A short history of CMMC
2020: The original programme. The DoD established CMMC with a five-level model and began incorporating its approach into acquisition rules. CMMC programme history
2021: CMMC 2.0 was announced. After reviewing the original approach, the department announced a simpler three-level model. The changes aimed to reduce unnecessary burden, align requirements with established standards, and adjust assessment arrangements. Official CMMC 2.0 announcement
2024: The programme rule was finalized. The final rule established CMMC in 32 CFR Part 170, taking effect on December 16, 2024. Final rule
2025: Contract implementation began. Phase 1 began on November 10, 2025, following the acquisition rule that brought CMMC requirements into applicable defense contracts. Official contractor briefing
2026: The next rollout phase was suspended. The department announced the suspension of Phase II on July 13, 2026. Current programme guidance states that implementation remains paused in Phase 1, with self-assessment requirements continuing.
The suspension does not remove existing obligations to safeguard covered defense information. Contractors should check current guidance and their actual contract requirements rather than rely on an older rollout calendar. Current official CMMC guidance
What information does CMMC protect?
Two terms explain most of the programme’s scope.
Federal Contract Information—FCI. This is nonpublic information supplied by, or generated for, the government under a contract. Publicly released information and simple transactional information needed to process payments are excluded.
Controlled Unclassified Information—CUI. This is government-related information that requires safeguarding or restrictions on sharing under applicable laws, regulations, or government-wide policies. It is unclassified, but that does not mean it is safe to publish or share freely. Official information definitions
A document is not automatically CUI just because it looks sensitive. Your team needs to understand the applicable categories, contract instructions, and information it receives or creates.
Who needs CMMC?
CMMC can apply to prime contractors and subcontractors whose work involves processing, storing, or transmitting FCI or CUI under applicable contractual requirements.
That can include small businesses as well as large defense suppliers. Working through a prime contractor does not automatically remove the obligation: relevant requirements can flow down into subcontracts. DFARS CMMC contract clause
For example, an engineering subcontractor receiving controlled technical information may need to meet requirements even though it never contracts directly with the government.
However, simply selling something to a defense customer does not automatically mean every CMMC level applies. Contracts solely for commercially available off-the-shelf items have an exclusion under the clause-prescription rules. The information involved and the contract terms matter. Acquisition.gov applicability rules
What are CMMC Levels 1, 2, and 3?
The established CMMC 2.0 framework has three levels:
- Level 1: Basic protection of FCI, with 15 safeguarding requirements.
- Level 2: Protection of CUI, with 110 requirements from NIST SP 800-171 Revision 2.
- Level 3: Enhanced protection for designated higher-risk work, with Level 2 requirements plus 24 selected requirements from NIST SP 800-172.
The framework includes self-assessments, third-party certification assessments, and government-led assessments, depending on the level and applicable requirements. Official framework briefing
The framework and the rollout are different things. Current official guidance describes the paused Phase 1 implementation as requiring Level 1 or Level 2 self-assessments. It would be misleading to tell every contractor that an external certification assessment is presently mandatory. Current implementation guidance
How should a business start preparing?
Begin with the contract and the information—not a software purchase.
- Read the requirements. Identify the relevant clauses, required level, and assessment arrangements.
- Locate the information. Understand where FCI or CUI enters, travels through, and leaves your business.
- Define the systems in scope. Include relevant people, devices, applications, and service providers.
- Check implementation. Compare required safeguards with what actually happens.
- Collect evidence and address gaps. Assign owners, keep records, and verify completed improvements.
Useful evidence might include access reviews, configuration records, staff training records, and incident-response exercises. The evidence needed depends on the requirement and assessment scope.
How DeshCyber can support your preparation
DeshCyber’s DECIMA platform is positioned to support compliance evidence collection and review, including CMMC-related work. Its role is to help teams connect requirements with records that can be examined. DeshCyber platform overview
For a contractor, the practical goal is a clearer view of what is implemented, what evidence supports it, and what still needs attention.
A readiness platform does not itself issue a CMMC certification or guarantee a contract award. Where a certification assessment is required, the appropriate authorized assessment body must perform that role.
Protect defense data. Build confidence in your readiness. Contact DeshCyber to discuss your information scope, evidence needs, and preparation priorities.
Topics: CMMC, CMMC 2.0, defense contractors, CUI, FCI, defense supply chain, NIST SP 800-171, DFARS 252.204-7021.
Related reading: Why SWIFT CSP started: lessons from the Bangladesh Bank heist.