CMMC
CMMC (Cybersecurity Maturity Model Certification)
The Defense Industrial Base — any contractor or subcontractor handling federal contract information or controlled unclassified information.
A DoD contract requires CMMC certification at a specific level, or a prime contractor flows down the requirement to its subcontractors.
Three levels (Foundational, Advanced, Expert). Third-party assessment required for Level 2+. NIST 800-171 control alignment.
Brings in contracts, legal, and government affairs. For smaller DIB contractors, often outsourced to a managed service or a CMMC Registered Provider Organization.
A market-access story for the DIB segment, similar to FedRAMP but cheaper and broader. Mid-tier defense suppliers are the largest under-served buyer pool.