When is CMMC required?
The Cybersecurity Maturity Model Certification (CMMC) is required for contractors and subcontractors working with the US Department of Defense (DoD) on contracts that involve handling Controlled Unclassified Information (CUI) or Federal Contract Information (FCI).
CMMC applies primarily to the Defense Industrial Base (DIB), companies in the DoD supply chain that store, process and/or transmit CUI. Note - based on scoping, CMMC controls apply to assets that provide security protections for these in-scope assets.
The DoD is progressively integrating CMMC requirements into contract solicitations. Contractors must plan for CMMC early by conducting gap assessments, remediating deficiencies and undergoing third-party assessments. ComplianceForge offers editable CMMC policy templates to assist organizations in preparing for CMMC certification.