The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's mandatory framework for verifying that defense contractors adequately protect sensitive government information. If your company holds or works on DoD contracts, CMMC is not optional — it is a contract requirement that is actively being enforced.
Take the CMMC Readiness Quiz Talk to a CMMC ExpertFor years, the DoD relied on defense contractors to self-certify that they were following cybersecurity requirements under DFARS clause 252.204-7012 and NIST SP 800-171. The problem: self-certification created no accountability, and adversaries — most notably nation-state actors — were actively exploiting unprotected contractors to steal sensitive defense technology, program data, and technical specifications.
CMMC was developed to solve this. Under CMMC 2.0, contractors must demonstrate compliance through verified assessments — not just sign a document saying they comply. The program requires contractors to be assessed by credentialed third-party organizations and assessors, ensuring that protections are actually in place.
Which CMMC level applies to you depends on what type of information your organization handles:
Information provided by or generated for the Government under a contract to develop or deliver a product or service. If you handle FCI, you need at minimum CMMC Level 1.
Examples: Contract deliverables, procurement data, pricing information
Government-created or government-handled information that requires safeguarding under law or policy, but is not classified. If you handle CUI, you need CMMC Level 2 or Level 3.
Examples: Technical specifications, export-controlled data, DoD program information, engineering drawings
CMMC 2.0 simplified the original five-level model into three levels, each with distinct requirements and assessment methods.
17 basic cybersecurity practices from FAR 52.204-21, focused on protecting Federal Contract Information (FCI).
110 security practices fully aligned with NIST SP 800-171, protecting Controlled Unclassified Information (CUI).
110+ practices including NIST SP 800-172 requirements, for the most critical DoD programs facing advanced persistent threats.
The vast majority of DIB contractors will require CMMC Level 2. This is the level TenGuard Security specializes in.
CMMC Level 2's 110 practices are organized across 17 domains derived from NIST SP 800-171:
CMMC requirements flow down through the supply chain. Even if you are a subcontractor or sub-tier supplier, if the prime's contract requires CMMC and you handle FCI or CUI, you must comply. Primes are responsible for ensuring their subcontractors meet CMMC requirements.
For Level 2 organizations requiring a third-party assessment, here is how the process typically works:
Define your assessment boundary — which systems, people, and locations handle CUI — and document your CUI data flows.
Evaluate your current security practices against all 110 CMMC Level 2 requirements. Identify what is compliant, partially compliant, or missing.
Implement required controls, develop your System Security Plan (SSP), and create a Plan of Action & Milestones (POA&M) for any remaining gaps.
A CMMC Third-Party Assessment Organization conducts the official assessment. The Lead Assessor reviews your documentation, interviews staff, and tests controls.
Assessment results are submitted to the Cyber AB's CMMC Enterprise Mission Assurance Support Service (eMASS). Upon approval, your certification is issued.
CMMC Level 2 certification is valid for three years. You must maintain your controls and documentation continuously and prepare for your next assessment cycle.
CMMC 2.0 was finalized as a federal rule and is being phased into DoD contracts. The phased rollout means that contract clauses are appearing in new solicitations and renewals at increasing frequency. The DoD has communicated a clear trajectory: CMMC requirements will be universal across all applicable defense contracts.
Many contractors are already seeing CMMC requirements appear in their RFPs and contract renewals. If you are waiting for "your contract" to require it, you may find yourself without time to prepare when it does.
The typical timeline to achieve CMMC Level 2 compliance from scratch is 6 to 18 months. Starting now protects your ability to compete for contracts.
TenGuard Security provides end-to-end CMMC compliance consulting — from understanding where your organization stands today to walking into your C3PAO assessment fully prepared. Engagements are led by a credentialed Lead Certified CMMC Assessor (Lead CCA), bringing assessor-level insight to every consulting engagement, so you know exactly what to expect and how to pass.
Whether you need a gap analysis to understand your compliance gaps, help developing your SSP and POA&M, guidance on scoping your CUI environment, or a pre-assessment review before your formal C3PAO assessment — TenGuard provides qualified, straightforward support tailored to small and mid-sized defense contractors.
Critically, we do not stop at telling you what is missing. CMMC compliance is largely an engineering problem — access control, logging, encryption, configuration management, and boundary protection all have to be genuinely implemented, not just described. We implement those controls, harden the systems behind them, and then produce the documentation and evidence that demonstrates each practice is met. See our full range of security services →
Because CMMC Level 2 maps directly to NIST SP 800-171, and overlaps substantially with ISO 27001 and the NIST Cybersecurity Framework, the work we do for CMMC carries over if your business also answers to those standards. We build the control set once and map it across every framework that applies to you.