XL EagleCMMC (Cybersecurity Maturity Model Certification)
CMMC stands for Cybersecurity Maturity Model Certification. CMMC is the Department of Defense program that checks whether contractors actually protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It has three levels. Level 1 covers basic safeguarding of FCI, Level 2 aligns with the 110 NIST SP 800-171 requirements for CUI, and Level 3 adds more for the most sensitive work.
The DFARS rule implementing CMMC took effect on November 10, 2025, starting a phased rollout in which solicitations can require a CMMC status as a condition of award. Depending on the contract, a company may self-assess or need a third-party assessment. Later phases add more third-party assessments, and the schedule should be checked against current DoD guidance.
Why it matters to a small contractor
If you want defense work, start with Level 1, which most trade contractors handling basic contract information will need. It covers basics like passwords, antivirus, and controlling who can access your files. Enter your status in SPRS before you bid on contracts that require it.
Example
A small grounds maintenance company bidding on Army work sees the solicitation requires CMMC Level 1. They complete the annual self-assessment, affirm it in SPRS, and keep their documentation ready.
CMMC: common questions
When did CMMC become required?
The DFARS CMMC rule took effect November 10, 2025, beginning a phased rollout. Requirements show up contract by contract, so check each solicitation.
Does every defense contractor need CMMC Level 2?
No. Level 2 applies to contracts involving CUI. Many service and supply contracts only involve FCI and need Level 1.
Want the contract without the paperwork? Send XL Eagle your price on an open government job. We write and submit the bid under our registrations, free to you. Find open jobs →