Does CMMC Apply?

The US Department of Defense (DoD) relies on thousands of outside companies, and an attack on one of them can weaken the DoD itself. The Cybersecurity Maturity Model Certification (CMMC), first released in 2020, sets the security level those companies have to meet. Who it applies to: organizations working under a DoD contract, and the subcontractors below them, since a prime contractor passes the requirement down to suppliers that handle the contract's information. The DoD includes the Army, Navy, Air Force, Marine Corps and Space Force, and agencies such as the Defense Intelligence Agency. Work for other departments (Veterans Affairs, Homeland Security, NASA, the IRS) does not bring in CMMC, and neither does a military-sounding link with no DoD contract behind it. The current version, CMMC 2.0, has three levels, and the contract says which one is needed. Level 1 covers basic safeguarding of Federal Contract Information and is a yearly self-assessment, the lesson's self-attestation. Level 2 covers Controlled Unclassified Information with the 110 requirements of NIST SP 800-171, assessed every three years by an authorized third-party assessor, or by the company itself where the contract allows. Level 3 adds requirements from NIST SP 800-172 and is assessed by the DoD's own assessors. The DoD began writing the levels into contracts in November 2025, phasing them in over three years. The lesson's enforcement point is the practical one: a company that does not meet its level can lose its DoD contracts.