Cam's Cyberspace

Recent Notes

CMMC and the Defense Industrial Base

Properties3
descriptionAt Level 2 the required controls are identical to NIST SP 800-171 Revision 2, so what the program adds is not security requirements but a verification method, a named affirming official, and an expiry date.
tagscs, law
aliasesCMMC

7 min read

A defense contractor reading about the Cybersecurity Maturity Model Certification for the first time usually asks what new controls it imposes. The regulation answers that question in one sentence, and the answer at the level most companies land on is: none.

The idea

“The security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2.” The program adds no control at that level. What it adds is everything around the control set: who assesses it, whether a third party is involved, who signs an affirmation, how long an assessment stays current, and what happens at every tier of the supply chain. CMMC is not a security standard. It is an assurance regime bolted onto one, which is a distinct kind of thing and solves a distinct problem.

What the program says it is for

The rule opens by describing itself. This part “describes the Cybersecurity Maturity Model Certification (CMMC) Program of the Department of Defense (DoD) and establishes requirements for defense contractors and subcontractors to implement prescribed cybersecurity standards for safeguarding Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).”

Then the sentence that gives away the actual motivation: “the CMMC Program provides DoD with a viable means of conducting the volume of assessments necessary to verify contractor and subcontractor implementation of required cybersecurity requirements.” Volume. The requirements already existed and already applied. The Department could not check them at the scale of its own supplier base, and the program is the answer to that logistics problem. It “provides a consistent methodology to assess a defense contractor’s implementation of required cybersecurity requirements.”

That framing puts CMMC in a recognizable lineage. It is a scheme that pairs an existing requirements document with an evaluation apparatus, which is the shape of every conformance regime and, in the security domain specifically, the descendant of graded assurance under the Orange Book. A published level means something because somebody outside the vendor checked.

The model, and where its contents come from

“The CMMC Model consists of domains that map to the Security Requirement Families defined in NIST SP 800-171 R2.” The domains are inherited, not invented.

The three levels draw on three different sources.

Level 1: “the security requirements in CMMC Level 1 are those set forth in 48 CFR 52.204-21(b)(1)(i) through (xv),” the basic safeguarding clause, which is the floor that applies to anyone handling federal contract information.

Level 2: identical to NIST SP 800-171 Revision 2, the publication that the covered defense information clause has pointed at for years.

Level 3: “the security requirements in CMMC Level 3 are selected from NIST SP 800-172 Feb2021,” the enhanced supplement, with organization-defined parameters filled in by the Department. Level 3 is the only level with genuinely additional technical content, and even there the content is selected from an existing publication rather than written fresh.

Requirement identifiers follow a scheme that makes the inheritance visible: a two-letter domain abbreviation, the level number, and the underlying requirement number from whichever source document supplied it.

What actually changes: assessment type

The levels differ less in what is required than in who says the requirement is met.

Level 1 is a self-assessment, and it is unforgiving in one specific way: “no POA Ms are permitted for CMMC Level 1.” No plan of action for a gap. Every requirement is met or the status is not achieved.

Level 2 comes in two flavors, a self-assessment and a certification assessment performed by a third-party assessment organization. The identical control set can therefore carry two different statuses depending on who looked at it, which is exactly the compliance-versus-conformance distinction made operational.

Level 3 is assessed by the Government’s own assessment center, and it stacks: “a CMMC Status of Final Level 2 (C3PAO) for information systems within the Level 3 CMMC Assessment Scope is a prerequisite to undergo a Level 3 certification assessment.”

The affirmation, and the expiry date

Two mechanisms keep an assessment from becoming a piece of paper in a drawer.

The first is a person. “An Affirming Official from each OSA, whether a prime or subcontractor, must affirm the continuing compliance of their respective organizations with the specified security requirement after every assessment, including POA M closeout, and annually thereafter.” The affirming official is defined as the senior representative responsible for compliance and holding the authority to affirm it. This is the same structural move as the authorization decision in the Risk Management Framework: the regime’s real output is a named human accepting responsibility on a dated record.

The second is currency. The contract clause that operationalizes all of this, “Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements (Nov 2025),” defines a status as “the result of meeting or exceeding the minimum required score for the corresponding assessment” and then defines what makes such a status current. A final Level 2 assessment, self or third-party, counts when “not older than 3 years for Final Level 2 (Self) assessments and Final Level 2 (C3PAO) assessments,” provided compliance has not changed and an affirmation not older than one year backs it. Assessments expire. Affirmations expire faster.

Flow-down, which is where the industry-wide effect comes from

“CMMC requirements apply to prime contractors and subcontractors throughout the supply chain at all tiers that will process, store, or transmit any FCI or CUI on contractor information systems in the performance of the DoD contract or subcontract.”

The level required is set by what the subcontractor touches rather than by its size or its distance from the Government. “If a subcontractor will only process, store, or transmit FCI (and not CUI) in performance of the subcontract, then a CMMC Status of Level 1 (Self) is required for the subcontractor,” and a subcontractor handling CUI faces a Level 2 floor.

That is the mechanism by which a program office’s requirement becomes a machine shop’s requirement. It is also the reason the program’s cost debate is not really about the controls. The controls were already owed. What is new is the assessment, the assessor, the affirmation, and the clock, at every tier.

Scope

This note describes the text of the CMMC Program regulation and a Department of Defense contract clause. It is a description of instruments, not legal advice or a compliance guide. It does not say what level applies to any contract or organization, does not interpret assessment scope, and does not describe how to prepare for or pass an assessment. Those are questions for counsel, for the contracting officer, and for the assessment ecosystem the regulation establishes.

Sources

Graph View

Backlinks