The Cybersecurity Maturity Model Certification (CMMC) framework is the Department of Defense’s bulwark against cybersecurity threats among its contractors. But defense contractors can find it a challenge to fulfill the CMMC’s 134 controls across multiple levels, jeopardizing contract eligibility. Our research offers structured guidance to help you engage with CMMC requirements by protecting the right things and weaving compliance into your operations before you even place a bid.

The CMMC framework’s recent change to a three-level structure can pose a challenge to organizations already struggling to map its requirements onto existing security controls, while also contending with budget, resource, and expertise shortfalls. IT leaders must build compliance with the required CMMC level into core business functions using a proactive, risk-based approach that demonstrates trustworthiness in handling sensitive defense data.

1. Focus only on what you need to.

When it comes to CMMC, you don’t have to secure the whole house – just lock the vault. Identify CMMC-regulated information and isolate it in a controlled environment to achieve compliance faster, reduce costs, and minimize risk, without having to overhaul your entire IT ecosystem.

2. Take a surgical approach to compliance.

Defining the right CMMC assessment scope before you start is critical. Strategically enclave your architecture and the boundary of certification to balance requirements with security, efficiency, and cost considerations.

3. Secure your subcontractors too.

The CMMC framework delegates subcontractor compliance to the prime contractor. If you engage subcontractors in your work, it will be your responsibility to ensure they are CMMC-compliant, according to the required CMMC level. If you are a subcontractor who employs further subcontractors, it is in your best interest to ensure proactive CMMC compliance to maintain trust with the prime contractor.

Use this step-by-step guide to take a strategic approach to CMMC compliance

Our research offers a guided framework for understanding the requirements of CMMC at every level and methodically laying the groundwork to meet them. Use this approach to proactively engage with CMMC mandates to maximize your organization’s competitiveness while bidding for defense contracts.

Establish a CMMC readiness roadmap by developing a documented compliance strategy with clear ownership, priorities, and timelines.
Prepare a CMMC-compliant security posture by implementing and validating security controls to be ready for CMMC certification with minimal disruption.
Strengthen supply chain security by maintaining compliance, monitoring risks, and enforcing supply chain accountability.

Achieve CMMC Compliance Effectively Research & Tools

1. Achieve CMMC Compliance Effectively Deck – A clear guide to understanding and preparing your organization to meet CMMC requirements.

Use this deck to begin building a structured, efficient, and effective CMMC compliance approach that helps you achieve compliance faster by protecting the right things to ensure maximum competitiveness for defense contract bids.

Understand the challenges and obstacles standing in the way of achieving CMMC compliance.
Uncover insights into how to efficiently prioritize and optimize your compliance efforts.
Understand and plan the process flow for each of the CMMC’s three levels.

Member Testimonials

After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve. See our top member experiences for this blueprint and what our clients have to say.

10.0/10

Overall Impact

$2,466

Average $ Saved

Average Days Saved

Client

Experience

Impact

$ Saved

Days Saved

Testimonial

ESS Tech, Inc

Guided Implementation

10/10

$2,466

Best - discussion on our progress and how that applies for future CMMC efforts Worst - did not see NERC on the list of standards considered

Achieve CMMC Compliance Effectively

Take a structured approach to Cybersecurity Maturity Model Certification.

Analyst perspective

Strengthen cyber resilience, enhance competitive advantage, and ensure contract readiness.

The Cybersecurity Maturity Model Certification (CMMC) represents a strategic shift in how the defense industrial base manages cybersecurity risks. The rise in cyberthreats targeting defense contractors has made it clear that a standardized, enforceable framework is necessary to protect controlled unclassified information and ensure the resilience of the supply chain.

For defense contractors, noncompliance is not an option. Failure to obtain the required CMMC certification jeopardizes contract eligibility. More importantly, organizations that proactively invest in cybersecurity readiness gain a competitive advantage by strengthening their ability to bid on Department of Defense contracts and demonstrating trustworthiness in handling sensitive defense data.

The path to CMMC compliance requires a proactive, risk-based approach that integrates security into daily operations. Those who start early will gain a competitive edge in the defense sector. CMMC should not be viewed as a regulatory burden but rather as an opportunity to strengthen cybersecurity resilience and build trust. Organizations that treat CMMC as a core business function will be better positioned to secure defense contracts.

Safayat Moahamad

Research Director
Security and Privacy
Info-Tech Research Group

Executive summary

Your Challenge

Understanding CMMC requirements. Organizations struggle with mapping requirements to their existing security controls.

Resource and budget constraints. Controls such as MFA and encryption often require additional tools, skilled personnel, and training.

Managing compliance across the supply chain. Contractors must ensure that subcontractors meet CMMC requirements, leading to complex compliance dependencies.

Common Obstacles

Legacy systems and technical debt. Older systems may not support modern security controls, requiring expensive upgrades or compensating controls.

Expertise and workforce gaps. Organizations may lack specialized cybersecurity skills in risk management, threat detection, and compliance auditing.

Adapting to change. Keeping pace with new mandates as regulations evolve pose significant impediments to business and IT leaders.

Info-Tech’s Approach

Establish a CMMC readiness roadmap. Develop a documented compliance strategy with clear ownership, priorities, and timelines.

Implement and validate security controls. Be prepared with a CMMC compliant security posture, ready for certification with minimal disruption.

Strengthen supply chain security. Maintain compliance, monitor risks, and enforce supply chain accountability.

Info-Tech Insight

Instead of securing the whole house, just lock the vault. Isolate CMMC-regulated information in a controlled environment to Achieve compliance faster, reduce costs, and minimize risk without overhauling the entire IT ecosystem.

Your challenge

This research is designed to help organizations who are facing these challenges:

Understanding and interpreting evolving CMMC requirements
Accurately defining CMMC scope and asset inventory
Resource constraints, such as budget, personnel, and expertise
Navigating the third-party assessment process
Managing supply chain compliance
Maintaining continuous compliance and annual affirmations

"DoD will include CMMC requirements in solicitations and contracts. Contractors who process, store, or transmit FCI or CUI must achieve the appropriate level of CMMC as a condition of contract award.”

– Pentagon qtd. in DefenseScoop, 2024.

80%

80% of respondents stated they experienced a loss from a cyber incident.

4%

Only 4% of respondents believe their company is completely ready for CMMC certification.

60%

More than 60% of respondents find it very difficult to achieve and maintain CMMC compliance.

Source: Merrill Research, 2024.

Common Obstacles

These barriers are challenging for many organizations:

Lack of executive buy-in and organizational alignment
Unclear roles and responsibilities for CMMC implementation
Vendor and external service provider (ESP) dependencies
Legacy IT systems and technical debt
Complicated and time-consuming assessment preparation
Unclear path for organizations moving from Level 2 to Level 3

“We continuously have our data taken by advanced persistent threats. We have contractors that get targeted by malicious actors trying to extort money.”

– Stacy Bostjanick, chief of defense industrial base cybersecurity, qtd. in “DOD Simplifies Process for Defense Contractors,” US Department of Defense, 2024.

40%

Less than 40% are actively working on SSPs, POAMs, required controls, and ongoing compliance plans.

50%

Over 50% highlighted significant cost impacts due to ongoing changes and necessary tools.

40%

Approximately 40% rated DFARS reporting an 8 out of 10 or higher in terms of difficulty.

Source: Merrill Research, 2024.

Cybersecurity Maturity Model Certification

The CMMC is a mandatory compliance requirement for the US Department of Defense (DoD) contractors and subcontractors. The framework is aimed to ensure protection of federal contract information (FCI) and controlled unclassified information (CUI).

The defense industrial base (DIB) experiences frequent and complex cyberattacks. The CMMC mandates that companies managing sensitive DoD information adopt increasingly sophisticated cybersecurity measures.

Through CMMC assessments, the DoD ensures compliance with these standards. Consequently, DoD contractors and subcontractors must meet a designated CMMC level to be eligible for contract awards.

CMMC Level	Controls	Assessor	Applicability
LEVEL 1	15	Self	All DoD Contractors
LEVEL 2	110	Self or Accredited 3rd Party 1 2	Contractors Handling CUI
LEVEL 3	134	DIB Cybersecurity Assessment Center	Critical Defense Programs

1 As specified by the DoD solicitation
2 Accredited 3rd Party = Certified Third-Party Assessor Organization (C3PAO)

Info-Tech Insight

Defining the right CMMC assessment scope is critical. Strategically enclave your architecture and the boundary of certification to balance requirements with security, efficiency, and cost considerations.

Scoping: Identifying in- & out-of-scope assets

OSAs must identify and categorize their information systems based on the level of certification sought and whether they process FCI or CUI, including systems or services provided by external service providers (ESPs). Within these information systems, for Level 2 and Level 3, the assets should be further broken down into asset categories.

CMMC Level	In-Scope	Assessment Scope	Out-of-Scope	Asset Categories
LEVEL1	Assets that process, store, or transmit FCI	Fully assessed against Level 1 security requirements	All other assets, including specialized assets	FCI Assets: Systems handling FCI required for contract execution
LEVEL2	CUI assets Security protection assets Contractor risk managed assets (CRMAs, capable but not intended to handle CUI)	CUI & security protection assets fully assessed CRMAs subject to limited checks	Non-CUI assets	CUI Assets: Handle CUI Security Protection Assets: Provide security functions (e.g., firewalls, SIEM) CRMAs: Can handle CUI and are protected by contractual controls
LEVEL3	All CUI assets Security protection assets Specialized assets	Fully assessed, but specialized assets may use intermediary devices	Non-CUI assets	Specialized Assets: Devices like IoT, OT, GFE that handle CUI but may have limited security capabilities

CMMC level selection

An organization seeking assessment (OSA) will choose the desired CMMC level it aims to achieve and implement the compliance program. However, a DoD solicitation will indicate the minimum CMMC status necessary to qualify for an award. One of four CMMC statuses will be specified:

LEVEL 1 Self-Assessment
To protect FCI handled during contract fulfillment. The OSA must fully comply with the 15 security requirements outlined in FAR clause 52.204-21, with no exceptions permitted.
LEVEL 2 Self-Assessment
To protect CUI handled during contract fulfillment. The OSA must adhere to the 110 Level 2 security requirements based on NIST SP 800-171 R2.
LEVEL 2 C3PAO Assessment
C3PAO Assessment differs from Level 2 Self-Assessment in that compliance is verified by an accredited 3rd Party. OSAs can find C3PAOs on the CMMC Accreditation Body (AB) Marketplace.
LEVEL 3 DIBCAC Assessment
Involves an assessment conducted by the DIBCAC on 24 additional control requirements from NIST SP 800-172. This is done in addition to a LEVEL 2 C3PAO Assessment.

For Level 3, an OSA must firstAchieve the Level 2 C3PAO certification. Afterward, the OSA should request a Level 3 certification assessment by emailing the Defense Contract Management Agency (DCMA)’s DIB Cybersecurity Assessment Center (DIBCAC).

Subcontractor relationships

Flow-Down Requirements: Prime contractors must ensure that subcontractors, including MSPs, MSSPs, CSPs and ESPs, comply with the applicable CMMC level. Subcontractors at all tiers are subject to these requirements. The DoD does not track subcontractor certification progress but expects contractors to manage it.
Prime Contractor Responsibility: Prime contractors are responsible for ensuring compliance and determining the correct CMMC level based on the prime contract's requirements.
Subcontractor Compliance: Subcontractors must submit their own assessments and certifications. Any cloud service providers (CSPs) used by the contractor to handle CUI must meet Federal Risk and Authorization Management Program (FedRAMP) Moderate Baseline or the equivalent requirements.
DoD Expectations: The DoD expects compliance with CMMC levels for all contractors handling CUI and FCI. Contractors are encouraged to only share necessary CUI with subcontractors and work to minimize unnecessary burden.
CMMC Level 2 Certification: The minimum level for subcontractors in contracts requiring CUI processing is Level 2. CMMC assessments are required as part of pre-award requirements, and contractors should verify subcontractor compliance.

Annual affirmations

OSAs and organizations seeking certification (OSCs) must complete assessments and affirmations to achieve and maintain CMMC compliance. The process differs based on the CMMC level, involving self-assessments, third-party certifications, or government-led evaluations.

LEVEL 1 Self-Assessment
- Must meet all 15 Level 1 controls
- Conditional status not allowed
- Annual affirmation in Supplier Performance Risk System (SPRS)
LEVEL 2 Self-Assessment
- Must meet all 110 NIST SP 800-171 R2 controls
- 80% minimum score required for conditional status
- Plan of action & milestones (POA&M) closed in 180 days
- Reassessed every three years
- Annual affirmation in SPRS
LEVEL 2 C3PAO Assessment
- Must meet all 110 NIST SP 800-171 R2 controls
- 80% minimum score required for conditional status
- POA&M closed in 180 days then reassessed by C3PAO
- Reassessed every three years
- Annual affirmation in SPRS
LEVEL 3 DIBCAC Assessment
- Must meet 24 NIST SP 800-172 controls (in addition to Level 2)
- 80% minimum score required for conditional status
- POA&M closed in 180 days then reassessed by DIBCAC
- Reassessed every three years
- Annual affirmation in SPRS

A POA&M is a management tool used to identify, prioritize, and track the progress of corrective actions needed to address security deficiencies.

Achieve CMMC Compliance Effectively visualization

Take a structured approach to Cybersecurity Maturity Model Certification.

About Info-Tech

Info-Tech Research Group is the world’s fastest-growing information technology research and advisory company, proudly serving over 30,000 IT professionals.

We produce unbiased and highly relevant research to help CIOs and IT leaders make strategic, timely, and well-informed decisions. We partner closely with IT teams to provide everything they need, from actionable tools to analyst guidance, ensuring they deliver measurable results for their organizations.

What Is a Blueprint?

A blueprint is designed to be a roadmap, containing a methodology and the tools and templates you need to solve your IT problems.

Each blueprint can be accompanied by a Guided Implementation that provides you access to our world-class analysts to help you get through the project.

Table of Contents

Achieve CMMC Compliance Effectively Storyboard
CMMC Process Flow

Talk to an Analyst

Our analyst calls are focused on helping our members use the research we produce, and our experts will guide you to successful project completion.

Book an Analyst Call on This Topic

You can start as early as tomorrow morning. Our analysts will explain the process during your first call.

Get Advice From a Subject Matter Expert

Each call will focus on explaining the material and helping you to plan your project, interpret and analyze the results of each project step, and set the direction for your next project step.

Author

Safayat Moahamad

Contributors

Gary Gregory, Chief Information Officer, Wiss, Janney, Elstner Associates
Aftab Pradhan, Manager, IT Security, Wiss, Janney, Elstner Associates