CMMC in plain English for small defense contractors

What CMMC is

CMMC, the Cybersecurity Maturity Model Certification, is the Department of Defense's way of checking that contractors and subcontractors protect certain types of information. It applies across the defense supply chain, not just large primes.

This is general information, not legal advice. Requirements are specific to your contracts, so confirm your obligations with your contracting officer or a qualified compliance advisor. [VERIFY CURRENT PHASE-IN TIMELINE]

Level 1: basic safeguarding

Level 1 applies to contractors who handle Federal Contract Information, sometimes called FCI. This is information the government gives you or that you generate for the government under a contract, that isn't meant for public release.

• A defined set of basic safeguarding practices, like limiting access and using passwords
• An annual self-assessment, done by the company itself
• No third-party audit required at this level

Level 2: the 110 requirements

Level 2 applies to contractors who handle Controlled Unclassified Information, or CUI. This is more sensitive than FCI and includes things like technical drawings, certain export-controlled data, or specific program details.

Level 2 is built on NIST SP 800-171, a set of 110 security requirements covering areas like access control, incident response, Multi-factor authentication (MFA) (show definition), Patching (show definition), and system monitoring. Depending on the contract, this can require a self-assessment or a third-party assessment.

SPRS scores

The Supplier Performance Risk System, or SPRS, is where contractors record their current score against the NIST SP 800-171 requirements. A negative score is common for companies that have not started; the point is documenting where you stand and what your plan is to close gaps.

• Your score should reflect controls you actually have in place, not aspirational ones
• A System Security Plan and a Plan of Action and Milestones support the score
• Scores can be checked by contracting officers, so accuracy matters

Where a small contractor should start

1. Confirm what type of information you handle, FCI or CUI, based on your actual contracts
2. Identify which level applies to you
3. Do a gap assessment against the relevant requirements
4. Write a System Security Plan describing your current environment
5. Build a Plan of Action and Milestones for anything not yet in place
6. Update your SPRS score to reflect reality