What CMMC Is

CMMC is a cybersecurity framework created by the U.S. Department of Defense (DoD) to ensure companies in the defense supply chain properly protect sensitive government data, including Controlled Unclassified Information (CUI).

Background & History

CMMC was introduced in 2020 after repeated cyber incidents showed that weak security at contractors and suppliers posed national security risks. It builds on NIST 800-171, adding maturity levels and assessment requirements to standardize cybersecurity expectations across all DoD contractors.