Information security
CMMC
Cybersecurity Maturity Model Certification (CMMC)
CMMC is the US Department of Defense programme that verifies defence contractors protect federal contract information and controlled unclassified information. We take you from gap to assessment readiness against the level your contracts require.
What CMMC is
CMMC is the Cybersecurity Maturity Model Certification programme run by the US Department of Defense for companies in its supply chain. It requires contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to meet defined cybersecurity practices before they can be awarded or keep certain contracts.
The model has tiered levels. Lower-level requirements can be met through a self-assessment, while higher levels, which are built on the NIST SP 800-171 controls for protecting CUI, require assessment by an accredited third-party assessment organisation, known as a C3PAO. The required level is set by the contract and the type of information involved.
The structure of the standard
Level 1 · Foundational
Covers basic safeguarding of Federal Contract Information through a defined set of practices that a contractor confirms by annual self-assessment.
Level 2 · Advanced
Aligns with the full set of controls in NIST SP 800-171 for protecting Controlled Unclassified Information and is met by self-assessment or by a C3PAO assessment depending on the contract.
Level 3 · Expert
Builds on Level 2 and adds a subset of controls drawn from NIST SP 800-172, assessed by the government for the most sensitive programmes.
Domain · Access and identity
Groups the access control and identification and authentication practices that limit who can reach systems holding FCI or CUI.
Domain · Protect and detect
Brings together system and communications protection, media protection, and audit and accountability practices that guard the information and record what happens to it.
Domain · Operate and respond
Covers configuration management, maintenance, incident response, risk and security assessment practices that keep the environment controlled over time.
Domain · People and physical
Addresses awareness and training, personnel security, and physical protection so that staff and facilities do not become the weak point.
SSP and POA&M · Evidence backbone
The System Security Plan describes how each practice is met and the Plans of Action and Milestones track any that are not yet in place.
Who needs it
- Defence contractors and subcontractors in the US Department of Defense supply chain
- Companies that handle Federal Contract Information or Controlled Unclassified Information
- Suppliers whose contracts or flow-down clauses now require a given CMMC level
What you get
- A scope definition and gap assessment against the required CMMC level
- A System Security Plan and Plans of Action and Milestones
- Implemented practices with a mapped evidence set
- An internal readiness assessment and support through the formal assessment
Timelines depend on the level your contracts require, how much CUI you handle and the state of your current controls. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
The current programme is the one finalised by the US Department of Defense in its 2024 rulemaking, with the core CMMC rule taking effect late in 2024. It establishes the three-level model and is being introduced through a phased rollout, so assessment and certification requirements appear in solicitations in stages rather than all at once. A companion acquisition rule then adds the matching clauses to contracts. If you have already worked to NIST SP 800-171, that effort carries into readiness; confirm the applicable level and phase against your specific contracts and flow-down clauses, because what applies today may differ from an earlier draft of the programme.
What it costs
Two costs sit side by side. tr3labs charges a scoped advisory and implementation fee, quoted up front once we understand your size, the CMMC level your contracts require and how much Controlled Unclassified Information you handle. Where your level calls for an assessment by an accredited third-party assessment organisation, that C3PAO charges separately on its own schedule, and the self-assessment levels still carry your own internal cost to prepare and attest; tr3labs is never the assessor, C3PAO or regulator. We scope the work with you rather than quote blind.
How tr3labs gets you there
Scope and gap assessment
We confirm the CMMC level your contracts require, define the assessment scope and the systems that handle FCI or CUI, and measure you against the NIST SP 800-171 practices so you know exactly what is missing.
Build the controls
We help you implement the required practices, write the System Security Plan and Plans of Action and Milestones, and put the policies and technical controls in place to protect the information in scope.
Internal audit and evidence
We run an internal assessment against the practices and assemble the evidence an assessor will expect, so gaps are closed before any formal assessment begins.
Assessment readiness support
We prepare you for a self-assessment or for assessment by a C3PAO at the higher levels, and support you through to the result; tr3labs is not a C3PAO and does not issue CMMC certifications.
CMMC and ISO 27001
Both ask you to prove security controls to an outside party, so teams often assume one satisfies the other, but they answer to different authorities.
| CMMC | ISO 27001 | |
|---|---|---|
| Covers | FCI and CUI in the US defence supply chain | An information security management system, any sector |
| Who asks for it | US Department of Defense contracts | Customers, partners and tenders worldwide |
| Core idea | Meet set practices from NIST SP 800-171 at a required level | Run a risk-based ISMS and improve it over time |
| Audit model | Self-assessment or C3PAO assessment by level | Certification audit by an accredited body |
| Built on | NIST SP 800-171 and, at Level 3, SP 800-172 | Annex A controls and the ISMS clauses |
| Often held with | NIST CSF and SOC 2 | SOC 2 and PCI DSS |
CMMC FAQ
- How much does CMMC certification cost?
- Our scoped advisory and implementation fee is quoted up front once we know the level your contracts require and how much CUI you handle. Where your level needs an accredited C3PAO assessment, that body charges separately; the self-assessment levels still carry your own internal cost to prepare and attest.
- How long does CMMC take?
- It depends on the level your contracts require, how much CUI you handle and the state of your current controls. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Which CMMC level do we need?
- The level is set by your contract and the type of information you handle, from Federal Contract Information at the lower level to Controlled Unclassified Information at higher levels. We confirm the applicable level during scoping.
- How does CMMC relate to NIST SP 800-171?
- The higher CMMC levels are built on the NIST SP 800-171 controls for protecting Controlled Unclassified Information. If you have already worked to 800-171, much of that effort carries directly into CMMC readiness.
- Can tr3labs certify us for CMMC?
- No. At the higher levels, certification is performed by an accredited third-party assessment organisation, a C3PAO. tr3labs prepares you, builds the controls and evidence, and supports you through assessment; we are not a C3PAO.
Related standards
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read