Cybersecurity Maturity Model Certification (CMMC) for the Department of Defense (DOD)

The CMMC will review and combine various cybersecurity standards and best practices and map these controls and processes across several maturity levels that range from basic cyber hygiene to advanced. For a given CMMC level, the associated controls and processes, when implemented, will reduce risk against a specific set of cyber threats.

X-Force cert

The CMMC effort builds upon existing regulation, that is based on trust by adding a verification component with respect to cybersecurity requirements.

Specific Existing Regulations:

  • 48 Code of Federal Regulations (CFR) 52.204-21
  • Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012
  • NIST SP 800-171 rev 1
  • NIST SP 800-171B (Draft)
  • United Kingdom’s Cyber Essentials
  • Australia’s Essential Eight [4,11,12,47]
  • The goal is for CMMC to be cost-effective and affordable for small businesses to implement at the lower CMMC levels.
  • The intent is for certified independent 3rd party organizations to conduct audits and inform risk.


Update coming. Stay tuned!

When will the final CMMC framework be released to the public?
Why is the CMMC being created?
What's involved with CMMC Certification?
How will my organization become certified?

The CMMC model framework categorizes cybersecurity best practices at the highest level by domains. Each domain is further segmented by a set of capabilities. Capabilities are achievements to ensure cybersecurity objectives are met within each domain. Companies will further demonstrate compliance with the required capabilities by demonstrating adherence to practices and processes, which have been mapped across the five maturity levels of CMMC. Under this context, practices will measure the technical activities required to achieve compliance with a given capability requirement, and processes will measure the maturity of a company’s processes. Within each domain, DIB companies will be accredited under the CMMC only if they can demonstrate compliance with the required practices and demonstrate mature processes as required for the given CMMC Level.

X-Force cmmc

The CMMC model has five defined levels, each with a set of supporting practices and processes, illustrated to the right.

Practices range from Level 1 (basic cyber hygiene) and to proactive and advanced Levels 4 and 5. In parallel, processes range from being performed at Level 1, to being documented at Level 2, to being optimized across the organization at Level 5. To meet a specific CMMC level, an organization must meet the practices and processes within that level and below.

Any organization that handles CUI will be a Level 3 – follows the NIST SP 800-171v1. All Sensitive programs will require Level 4/5. Level 4/5 will be a lot more expensive than the others.

X-Force cmmc
X-Force cmmc
X-Force cmmc

Cybersecurity Maturity Model Certification Domains

The CMMC model consists of 17 domains. The majority of these CMMC domains originated from the FIPS 200 security-related areas and the NIST SP 800-171 control families. The CMMC model also includes the Asset Management, Recovery, and Situational Awareness domains. These domains are shown in Figure 3 with their abbreviations as used in the model practice numbering system.

X-Force cmmc
X-Force cmmc