Cybersecurity Maturity Model Certification
The Department of Defense is drafting a new standard called the Cybersecurity Maturity Model Certification. This standard will replace NIST 800-171 on DoD RFIs and RFPs beginning in mid-20201. The CMMC contains five levels, ranging from basic hygiene to state-of-the-art. Unlike NIST 800-171, the CMMC will not contain a self-attestation component. Every organization that does business with the Department of Defense will be required to undergo an audit by an authorized auditing entity before bidding on a contract or subcontracting to a prime.
1Ms. Katie Arrington OUSD(A&S), Professional Services Council “What Contractors Need To Know About DoD’s CMMC” Webinar, July 17, 2019
We’ve got the inside scoop on CMMC and the products to keep you ahead of the pack.
Contact us to learn more.
Request Beta Invite
CMMC Model Rev 0.6 Levels by the Numbers
Domains Capabilities Total Practices per Domain Practices per Level
Level 1 Level 2 Level 3 Level 4 Level 5
Access Control 4 ?* 4 12 6 ?* ?*
Asset Management 1 ?* 0 0 2 ?* ?*
Audit and Accountability 4 ?* 0 4 7 ?* ?*
Awareness and Training 2 ?* 0 2 1 ?* ?*
Configuration Management 2 ?* 0 6 3 ?* ?*
Identity and Authorization 1 ?* 2 5 4 ?* ?*
Incident Response 5 ?* 0 5 2 ?* ?*
Maintenance 1 ?* 0 4 2 ?* ?*
Media Protection 4 ?* 1 3 4 ?* ?*
Personnel Security 2 ?* 0 2 0 ?* ?*
Physical Protection 1 ?* 4 1 1 ?* ?*
Recovery 1 ?* 0 2 1 ?* ?*
Risk Management 2 ?* 0 3 3 ?* ?*
Security Assessment 3 ?* 0 3 2 ?* ?*
Situational Awareness 1 ?* 0 0 1 ?* ?*
System and Comms Protection 2 ?* 2 3 14 ?* ?*
Systems and Info Integrity 4 ?* 4 3 3 ?* ?*
  Total Practices Per Level 17 58 56 ?* ?*
*Levels 4 and 5 were not included in Draft v0.6
CMMC Process Pyramid
What type of solution are you looking for?
I need a hassle-free tool to assess my environment and generate all of the CMMC documentation needed for an audit.
I need an assessment tool that I can use to audit other organizations.
The Assessment Platform drives your team forward through the CMMC assessment process, auto-generates all documentation, and allows you to share your assessment results with auditors.
Compass CMMC Process Pyramid
I want to push a button and create a compliant environment, including documentation, that’s audited and certified at Levels 1, 2 or 3 without engaging expensive consultants.
A ComplyUp Cove™ is a protected, pre-configured, on-demand cloud environment built to comply with the requirements of the Cybersecurity Maturity Model Certification. Each Cove deployment includes a subscription to the Assessment Platform, which is automatically populated with technical compliance details for each CMMC requirement. A CMMC auditor receives notification of your Cove deployment and initiates an audit of your Cove.
ComplyUp CMMC Process Pyramid
A. Contractor performs self-assessment to identify which level (if any) they currently meet.
B. Contractor addresses deficiencies (software purchases, system configurations, third-party service providers).
C. Contractor searches marketplace for CMMC approved auditor and schedules audit.
D. Contractor submits self-assessment results and evidence to Auditor.
E. Auditor verifies contractor claims, makes a compliance determination and submits results to the government.
Contract Award Process
1. Contracting Officer reviews contract requirements to determine which CMMC Level will be required
2. RFI posted including required CMMC level for bidding (may contain various levels to account for subcontracting flow-downs)
3. RFP released
4. Contractors submit proposals including Audited CMMC Level of prime and subcontractors
5. Contracting Officer reviews proposals, verifies CMMC Level status in CMMC database, and rejects all proposals not meeting the minimum CMMC Level
Contact us to find out which solution best fits your needs.

Subscribe Now for Regulation Updates

Want to keep track of the latest CMMC developments?
We’re not spammy, and we’ll never sell your information. Promise.

CMMC Frequently Asked Questions
By Contractors

The Cybersecurity Maturity Model Certification is a new standard that will take the place of NIST 800-171 on DoD contracts. CMMC is not entirely derived from NIST 800-171; rather, it builds upon it along with many other regulations to create five levels of certification that will better reflect the type of cybersecurity that a contractor will need to attain for a particular contract.

The DoD plans to release version 1.0 in January 2020. This leaves contractors just six months to prepare before CMMC starts appearing in Requests for Information (RFIs) in June 2020.

Yes. Many of the same controls that are in NIST 800-171 will be included in CMMC along with controls from other standards such as ISO, FedRAMP, and various NIST frameworks.

CMMC also requires a 3rd party audit in order to gain certification, whereas 800-171 is a “self-certification”.


Existing DoD contracts that contains the 252.204-7012 DFARS clause will still require your organization to provide documentation proving compliance with 800-171. We don't know if Contracting Officers will be asked to modify active contracts to swap CMMC and 800-171. This may end up being a per-contract decision. CMMC is different than NIST 800-171, but the controls can be mapped from 800-171 to the levels of certification within CMMC.

Yes. All companies doing business with Department of Defense will need to obtain CMMC.

Even if you are a subcontractor.

We’re not sure yet. This will depend entirely upon what level of certification your contract requires and the sensitivity of the information you handle. We can say this: The entire point of CMMC is to make it more feasible for small to mid-sized business to become compliant while ensuring that any sensitive information or CUI your organization handles remains safe. This means that most companies will fall under Level 1 or Level 2 (which will map 64 controls from 800-171), while prime contractors can expect to become Level 3 certified (which will map all 110 controls from 800-171). Level 4 and 5 (which will map additional controls found in 800-171revB) are going to typically be required of the large primes like Lockheed Martin and Northrop Grumman.

Step one is to get NIST 800-171 documentation out of the way. This will help with mapping those controls and keep you compliant with the current DFARS clause.

The second step is to map your 800-171 assessment to the CMMC requirements once they're released. Be ready to address the gaps you find during mapping and implement solutions to remediate them.

The third step is to find an authorized 3rd party to audit your assessment and give you a certification for the level you need. You should have no trouble finding an auditor even before the requirements are released, since its very likely existing 800-171 service companies will transition to CMMC auditors.

We’re not sure yet. They are still considering that part.

We can’t say for sure. That depends entirely on the market. Ms. Katie Arrington and her team have made it clear that they are trying to keep the cost down and are encouraging industry to automate as much of this process as possible. ComplyUp is taking that approach and applying it to our business model. Our software is cost-effective and practical. Our existing 800-171 platform can get you your NIST 800-171 documentation, and when the time comes, we'll migrate you to the new CMMC standard at no additional cost. We've also screened several auditing organizations and selected our partners based on the promise that they keep their cost low when working with our clients. The cost and associated assessment will likely scale with the level requested.

By Auditors

You will need to become an accredited 3rd party commercial certification organization. We are not sure what the exact steps are on how to get this done right now. We do know that you will need to go through some sort of a vetting process to become an accredited auditor. Once you’ve become accredited you will be able to start auditing companies and handing out certifications.

We don’t quite know the answer to that question either right now. Here’s what we can say: The DoD is selecting a non-profit organization who is going to be doing the accrediting. This means that you will go through some process with that organization in order to become accredited. Once you’re accredited, you’ll be able to start doing audits.

No. They have made it quite clear that they do not want the organizations who are performing the audits to also be the ones implementing the CMMC requirements for the contractor.

There’s nothing definitive on what type of deliverables we’ll be looking at. However, one could probably surmise that the contractor will need to provide some sort of System Security Plan, similar to that of NIST 800-171, and the auditor will most likely need to provide a Report on Compliance, similar to that of PCI and FedRAMP.

Yes. If you want to be a successful CMMC auditor, it is important to keep the same goals in mind as the folks pushing CMMC. They want this to be cost-effective. That means we’re not dealing with a whole lot of “enterprise” customers here. We’re talking about the ENTIRE DoD supply chain, most of which are small businesses. In order to play ball, you’ll need to keep your cost low and keep the process somewhat automated.