CMMC
Also known as Cybersecurity Maturity Model Certification
The Department of Defense programme that verifies contractors meet required cybersecurity practices before award.
Level 1 covers basic safeguarding of federal contract information with annual self-assessment. Level 2 aligns to the 110 requirements of NIST SP 800-171. The rule builds toward assessment by an accredited third party, but that phase was suspended on 13 July 2026, and contracts today can only require Level 1 or Level 2 self-assessment.
The shift the programme was built to make is from self-attestation to verification, which turns a compliance statement into something with real contractual and legal weight behind it. That shift is currently paused rather than cancelled, and the underlying DFARS obligation to protect CUI did not pause with it. Treat the suspension as breathing room on the assessment, not on the controls.
Where this comes up
CMMC sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.