The Cybersecurity Maturity Model Certification is mandatory for US Department of Defense contractors. CMMC 2.0 streamlines the framework to three levels, with third-party assessment required for most contracts handling CUI.
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is a US Department of Defense programme designed to protect the defence industrial base from cyber threats. CMMC 2.0, finalised in 2024, streamlines the original five-level model to three levels and aligns requirements with NIST 800-171.
CMMC certification will be required as a condition of contract award for all DoD contractors. Level 2, the most common requirement, mandates a third-party assessment by a CMMC Third Party Assessment Organisation (C3PAO) for contracts involving CUI.
With CMMC requirements now being phased into DoD contracts, organisations that have not begun their compliance journey risk losing contract eligibility.
Compliance requirements
CMMC 2.0 defines three levels of cybersecurity maturity, each building on the previous level with additional practices and assessment rigour.
17 practices from NIST 800-171 covering basic cyber hygiene. Self-assessment permitted. Required for all DoD contractors handling Federal Contract Information (FCI).
110 practices aligned to NIST 800-171 Rev 2. Third-party assessment (C3PAO) required for most contracts. Required for contractors handling Controlled Unclassified Information (CUI).
110+ practices based on NIST 800-172. Government-led assessment required. Reserved for contractors working on the most sensitive DoD programmes.
Limit system access to authorised users and processes acting on behalf of authorised users, and to the types of transactions and functions authorised users are permitted to execute.
Establish an operational incident-handling capability for organisational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
Periodically assess the risk to organisational operations, assets, and individuals resulting from the operation of organisational systems and the associated processing, storage, or transmission of CUI.
Audit process
Netru manages the complete CMMC certification journey, from determining your required level through to C3PAO assessment management.
We review your DoD contracts to determine which CMMC level is required and identify all systems in scope for the assessment.
We assess your current controls against all applicable CMMC practices, producing a scored gap analysis and SPRS score.
We draft your SSP documenting how each practice is implemented, and a POA&M for any deficiencies.
Your compliance manager guides implementation of required controls, with evidence collection throughout the remediation period.
We conduct a mock assessment to verify readiness before the formal C3PAO assessment, identifying any remaining gaps.
We manage the C3PAO assessment process, prepare evidence packages, and handle all assessor queries on your behalf.
Upon successful assessment, your CMMC certification is registered in the DoD's eMASS system, enabling contract award.
How Netru delivers it
Our team includes CMMC Registered Practitioners with deep experience in DoD compliance. We guide you from initial contract review through to C3PAO assessment, ensuring you achieve and maintain certification without disrupting your operations.
Talk to our teamBefore you talk to anyone