CMMC Cybersecurity Compliance Certification

What "Getting CMMC Certified" Actually Means

CMMC certification is the Department of Defense's verification that a contractor's cybersecurity matches its data. Under the CMMC Program rule, 32 CFR Part 170 on eCFR.gov, no contractor may receive an award that requires CMMC until it holds the required certification at the required level. The governing clause is DFARS 252.204-7021: when it appears in a contract or solicitation, the contractor must have a current, valid certificate at the specified level before award.

Certification is tied to information, not to company size or contract value. If your contract handles only Federal Contract Information, Level 1 applies. If it handles Controlled Unclassified Information, Level 2 applies (see our plain-English CUI vs FCI comparison and our full guide to CUI marking and handling). The distinction drives everything: scope, assessment type, cost, and how long preparation takes.

The Three Levels at a Glance

CMMC 2.0 collapsed the original five-level model into three, and aligned Level 2 directly with NIST SP 800-171 Revision 2. That alignment matters: the work you do to satisfy the DFARS 800-171 clause is the same work a C3PAO later assesses. For more detail per level, see our CMMC Level 2 deep dive covering the 110 controls, costs, and the C3PAO.

• Level 1 - FCI only. The 15 basic safeguarding requirements from FAR 52.204-21, an annual self-assessment, and an annual affirmation by a senior official. Our Level 1 self-assessment guide walks the 15 practices step by step.
• Level 2 - CUI. All 110 practices of NIST SP 800-171 Rev 2 across 14 domains. Most programs require a C3PAO certification assessment every three years, plus an annual senior official affirmation. Some select programs allow a Level 2 self-assessment instead, which we cover in our CMMC Level 2 self-assessment walkthrough.
• Level 3 - CUI on critical programs. Selected requirements from NIST SP 800-172 layered on top of Level 2, assessed by the government itself (DCMA DIBCAC), not by a C3PAO. Our NIST SP 800-172 overview explains the enhanced requirements.

Once requirements phase into contracts, certification status is not a one-time event. Certificates are valid for three years, annual affirmations are required for all three levels, and the assessments that feed DoD's visibility live in SPRS. A practical rule for defense contractors: your CMMC posture is continuous, and our CMMC maturity model guide covers the ongoing obligations alongside the initial certification.

SPRS Submission and the Annual Affirmation

Certification is not the only reporting obligation. Two parallel requirements run alongside CMMC and apply before it ever reaches your contract: the SPRS score under DFARS 252.204-7019 and 7020, and the annual senior official affirmation.

Your SPRS Score

DFARS 252.204-7019 requires a current NIST SP 800-171 assessment summary score in SPRS when an offer is submitted; DFARS 252.204-7020 governs how that assessment is conducted and gives DoD access to verify it. The self-assessment score ranges from minus 203 to 110, with individual requirements weighted 1, 3, or 5 points. A perfect 110 signals full implementation; negative scores flag serious gaps and are visible to prime contractors during source selection. Calculate your current standing with our free SPRS calculator, and read our complete SPRS score guide for defense contractors for the scoring mechanics. A falsely reported score has real consequences: a defense contractor paid $507,144 under the DOJ Civil Cyber-Fraud Initiative after reporting an inaccurate SPRS score (see our analysis of that false SPRS score settlement).

The Annual Affirmation

Every level requires an annual affirmation by a senior official - an executive with authority to bind the company - filed in SPRS. The affirmation asserts that the company is implementing the applicable requirements. It is a personal, attested statement, not a checkbox. False affirmations carry False Claims Act exposure, as the DOJ settlements above demonstrate. Our CMMC compliance software overview covers how the affirmation cycle fits the rest of the program year.

POA&M Rules Under CMMC 2.0

A Plan of Action and Milestones (POA&M) documents requirements that are not yet fully implemented. Under CMMC 2.0, POA&Ms are permitted only for "not met" requirements within the limits of 32 CFR 170.21, with a 180-day closeout window. Certain critical requirements cannot be POA&M'd at all; a missing practice in that category means the assessment outcome fails, not a conditional certification.

Practical consequences for contractors:

• A POA&M is not a shield. Conditional certification at Level 2 still lets DoD award contracts, but every open item must be closed within 180 days or the certificate is at risk.
• The POA&M must be reviewed at least quarterly and treated as a living document; assessors examine whether milestones are being met, not just whether one exists.
• Poorly built POA&Ms are among the top reasons assessments fail. Our dedicated POA&M guide covers structure, milestones, and evidence, and our analysis of why SSPs and POA&Ms fail at assessment covers the rest.

POA&M discipline is one half of documentation readiness; the other half is an accurate System Security Plan. If yours needs a rebuild, our SSP generator structures the document against all 110 controls, and our NIST 3.12.4 SSP control page covers the documentation requirement.

Where Contractors Get Stuck

Scope creep. Without a deliberate boundary, the 110 controls appear to apply to the entire enterprise network. Enclaving CUI into a narrowly scoped boundary - for example a GCC High tenant or a dedicated cloud landing zone - keeps the controls from sprawling. Our CMMC enclave guide and GCC High comparison cover the options.

Encryption assumptions. NIST SP 800-171 requires FIPS-validated cryptography to protect CUI confidentiality; strong but unvalidated encryption does not meet the requirement. This is a frequent and expensive discovery late in remediation.

Forgotten fundamentals. Assessors routinely find gaps in access control basics such as multi-factor authentication, in media protection, and in CUI encryption on mobile devices. Inventory and asset management is the other recurring failure point - our IT asset management services address the root discipline.

People, not just technology. Requirements around personnel security and security awareness training fail when they exist only on paper. Evidence has to show activity, not intent. Training requirements also flow down: our DFARS flow-down clause guide explains what primes push to subs, and our supply chain risk management overview covers the NIST SP 800-161 side.

Incident response after certification. DFARS 252.204-7012 requires 72-hour incident reporting through dibnet.dod.mil with a medium assurance certificate obtained in advance. Our CMMC incident response guide covers the reporting path.

Evidence: What Assessors Actually Look At

Certification assessments are evidence exercises. A C3PAO assessor examines three artifact families for every in-scope requirement: what your documentation says (the SSP, policies, and procedures), what your systems show (configurations, logs, and screenshots), and what your people demonstrate (interviews with the staff who operate the controls). A control that exists in only one of the three fails.

Two disciplines make the difference between passing and failing. First, keep the System Security Plan current: it is a living document, and statements that contradict what assessors observe on the screen in front of them are treated as findings. Second, collect evidence continuously rather than in a pre-assessment scramble; quarterly POA&M reviews and recurring internal checks keep the evidence trail naturally current. Our NIST SP 800-171A assessment guide explains how the objectives behind each requirement are examined.

Finally, remember the clause set that predates CMMC still binds you. DFARS 252.204-7012 requires adequate security on every covered contractor information system, 72-hour incident reporting, 90-day evidence preservation after an incident, and FedRAMP Moderate baselines for cloud-hosted CUI. Certification does not replace these obligations; it layers verified proof on top of them. For the subcontractor angle, our flow-down clause guide shows which obligations move down the supply chain and our CUI decontrol explainer covers when data leaves CUI scope entirely.