UK companies supplying to the US Department of Defense must now meet CMMC 2.0 requirements. What each level requires and how to prepare.
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is now a contractual requirement for companies in the US Department of Defense supply chain. UK companies that supply to the DoD, directly or through prime contractors, must meet CMMC requirements. This guide explains the three levels, what each requires, and how to prepare for assessment.
CMMC is a framework developed by the US Department of Defense to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in the defence supply chain. CMMC 2.0, finalised in 2024, streamlined the original five-level model to three levels.
CMMC requirements are incorporated into DoD contracts. Companies that handle FCI or CUI must achieve the appropriate CMMC level before they can be awarded or continue to hold DoD contracts. Self-attestation is permitted for Level 1; Levels 2 and 3 require third-party assessment.
UK companies in the defence supply chain, including those supplying to US prime contractors, are subject to CMMC requirements if their contracts involve FCI or CUI.
Level 1 (Foundational) covers 17 practices from NIST SP 800-171 focused on protecting FCI. Annual self-attestation by a senior company official is required. This level applies to companies that handle FCI but not CUI.
Level 2 (Advanced) covers all 110 practices from NIST SP 800-171 and is required for companies handling CUI. Third-party assessment by a C3PAO (CMMC Third-Party Assessment Organisation) is required for most Level 2 contracts, though some allow self-attestation.
Level 3 (Expert) covers 110+ practices including requirements from NIST SP 800-172 and is required for companies handling the most sensitive CUI. Government-led assessment by the Defense Contract Management Agency (DCMA) is required.
NIST SP 800-171 is the foundation of CMMC Level 2. It contains 110 security requirements across 14 families, access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.
Many UK companies find that their existing ISO 27001 controls provide a strong foundation for CMMC Level 2 compliance. The overlap is significant, though CMMC has specific requirements, particularly around CUI handling, system and communications protection, and incident reporting to the DoD, that go beyond ISO 27001.
22 practices covering authorised access, least privilege, remote access, and CUI access restrictions.
9 practices covering audit log creation, protection, review, and reporting.
9 practices covering baseline configurations, change control, and least functionality.
11 practices covering user identification, authentication, and multi-factor authentication.
3 practices covering incident handling capability and reporting to the DoD.
16 practices covering network segmentation, CUI encryption, and communications monitoring.
Identify all CUI in your environment and map the systems, people, and processes that handle it.
Assess your current posture against all 110 NIST SP 800-171 practices and produce a System Security Plan (SSP).
Implement controls to address identified gaps, prioritising those with the highest risk to CUI.
Document any remaining gaps in a Plan of Action and Milestones (POA&M) with target remediation dates.
Engage a CMMC Third-Party Assessment Organisation for Level 2 assessment.
Receive CMMC Level 2 certification, valid for three years with annual affirmations.
Netru methodology