--- title: CMMC Compliance Overview description: The Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD (A&S)), developed the Cybersecurity Maturity Model Certification (CMMC), requiring its implementation by all companies doing business across the DOD supply chain by 2025. The CMMC is a framework that consists of maturity processes and cybersecurity best practices, at five (5) levels of maturity. image: https://blog.unicomgov.com/hubfs/businessman%20hand%20shows%20logistics%20diagram%20as%20concept.jpeg --- ##### UNICOM GLOBAL DIVISIONS [![UNICOM Global](https://blog.unicomgov.com/hubfs/Unicomgov_November2018%20Theme/Images/Logo_-_UNICOM_Global_-_Horizontal.png)](https://www.unicomglobal.com/home/) UNICOM® Global consists of more than 40 corporate entities encompassing a wide range of businesses including Mergers and Acquisitions (M&A), Real Estate Development, Business and Financial Services and a range of Information Technology (IT) Divisions. --- - [CICS.com](https://www.cics.com/home/) - [UNICOM Systems](https://www.unicomsi.com/home/) - [TeamBLUE](https://teamblue.unicomsi.com/home/) - [Macro 4](https://www.macro4.com/home/) - [DETEC](https://www.detec.com/home/) - [SoftLanding](https://www.softlanding.com/home/) - [illustro](https://www.illustro.com/home/) - [iET Solutions](https://www.iet-solutions.com/home/) - [USRobotics](https://www.usrobotics.com/home/) - [USR](https://www.usr.com/home/) - [Memeo](https://www.memeo.com/home/) - [Firetide](https://www.firetide.com/home/) - [Unified Communications and Collaboration](https://www.usrobotics.com/services/visual-communications/) - [Eden](https://www.eden.com/home/) - [UNICOM Capital](https://www.unicom-capital.com/home/) - [Mergers & Acquisitions](https://www.eden.com/mergers-acquisitions/) - [IT Real Estate](https://www.eden.com/real-estate/) - [UNICOM Government](https://www.unicomgov.com/unicom-government-root/home/) - [UNICOM Engineering](http://www.unicomengineering.com/home/) [![UNICOM Global](https://blog.unicomgov.com/hubfs/Unicomgov_November2018%20Theme/Images/UNICOM-Global-Bug-Vector-25.png)](https://www.unicomglobal.com/home/) [UNICOM Global](https://www.unicomglobal.com/home/) Divisions Product Catalog Sign In  Search  [![UNICOM Government](https://blog.unicomgov.com/hubfs/Unicomgov_November2018%20Theme/Images/Logo_-_UNICOM_Government_-_Small.png)](https://www.unicomgov.com/unicom-government-root/home/) - [Markets](https://www.unicomgov.com/unicom-government-root/markets/) - [Solutions](https://www.unicomgov.com/unicom-government-root/solutions/) - [Services](https://www.unicomgov.com/unicom-government-root/services/) - [About](https://www.unicomgov.com/unicom-government-root/about/) - [Blog](https://www.unicomgov.com/unicom-government-root/blog/) MENU  - [Home](https://www.unicomgov.com/unicom-government-root/home/) - Markets - [Markets](https://www.unicomgov.com/unicom-government-root/markets/) - [Civilian](https://www.unicomgov.com/unicom-government-root/markets/civilian/) - [Department of Defense](https://www.unicomgov.com/unicom-government-root/markets/department-defense/) - [Intelligence Community](https://www.unicomgov.com/unicom-government-root/markets/intelligence-community/) - [State & Local](https://www.unicomgov.com/unicom-government-root/markets/state-local/) - [Healthcare](https://www.unicomgov.com/unicom-government-root/markets/healthcare/) - Solutions - [Solutions](https://www.unicomgov.com/unicom-government-root/solutions/) - [Virtualization](https://www.unicomgov.com/unicom-government-root/solutions/virtualization/) - Physical Security - [Physical Security](https://www.unicomgov.com/unicom-government-root/solutions/physical-security/) - [Mobile Evidence Capture](https://www.unicomgov.com/unicom-government-root/solutions/physical-security/mobile-evidence-capture/) - [Cloud Computing](https://www.unicomgov.com/unicom-government-root/solutions/cloud-computing/) - [Unified Communications](https://www.unicomgov.com/unicom-government-root/solutions/unified-communications/) - Capabilities - [Capabilities](https://www.unicomgov.com/unicom-government-root/solutions/capabilities/) - [Data Center](https://www.unicomgov.com/unicom-government-root/solutions/capabilities/data-center/) - [Networking](https://www.unicomgov.com/unicom-government-root/solutions/capabilities/networking/) - [Client](https://www.unicomgov.com/unicom-government-root/solutions/capabilities/client/) - [Security](https://www.unicomgov.com/unicom-government-root/solutions/capabilities/security/) - [IT Service Management](https://www.unicomgov.com/unicom-government-root/solutions/capabilities/it-service-management/) - Services - [Services](https://www.unicomgov.com/unicom-government-root/services/) - [Implementation Services](https://www.unicomgov.com/unicom-government-root/services/implementation-services/) - [Integration Services](https://www.unicomgov.com/unicom-government-root/services/integration-services/) - [Support and Maintenance Services](https://www.unicomgov.com/unicom-government-root/services/support-and-maintenance-services/) - [Financial Services](https://www.unicomgov.com/unicom-government-root/services/financial-serv/) - [E-Procurement Services](http://shop.unicomgov.com/) - [SupportNet](https://www.unicomgov.com/unicom-government-root/services/supportnet/) - About - [About](https://www.unicomgov.com/unicom-government-root/about/) - [Directions](https://www.unicomgov.com/unicom-government-root/about/directions/) - [Our History](https://www.unicomgov.com/unicom-government-root/about/our-history/) - [UNICOM Government Ethics Program](https://www.unicomgov.com/unicom-government-root/about/unicom-government-ethics-program/) - [Careers](https://www.unicomgov.com/unicom-government-root/about/careers/) - [Contact Us](https://www.unicomgov.com/unicom-government-root/about/contact-us/) - [Contract Vehicles](https://www.unicomgov.com/unicom-government-root/contract-vehicles/) - [News](https://www.unicomgov.com/unicom-government-root/news/) - [Blog](https://www.unicomgov.com/unicom-government-root/blog/) - UNICOM Government Events - [UNICOM Government Events](https://www.unicomgov.com/unicom-government-root/events/) - [Next Generation 911](https://www.unicomgov.com/unicom-government-root/events/next-generation-911/) - [Digital Transformation](https://www.unicomgov.com/unicom-government-root/events/digital-transformation/) - [Digital Transformation: Hyper Converged Infrastructure](https://www.unicomgov.com/unicom-government-root/events/digital-transformation-hyper-converged-infrastructure/) ##### SEARCH ALL OF UNICOM GLOBAL ### UNICOM DIVISIONS - [UNICOM Global](https://www.unicomglobal.com/home/) - [UNICOM Government](https://www.unicomgov.com/unicom-government-root/home/) - [UNICOM Engineering](http://www.unicomengineering.com/home/) - [CICS.com](https://www.cics.com/home/) - [USRobotics](https://www.usrobotics.com/home/) - [Eden](https://www.eden.com/home/) - [UNICOM Systems](https://www.unicomsi.com/home/) - [TeamBLUE](https://teamblue.unicomsi.com/home/) - [Macro 4](https://www.macro4.com/home/) - [DETEC](https://www.detec.com/home/) - [SoftLanding](https://www.softlanding.com/home/) - [illustro Systems](https://www.illustro.com/home/) - [iET Solutions](https://www.iet-solutions.com/home/) - [USR](https://www.usr.com/home/) - [Memeo](https://www.memeo.com/home/) - [Firetide](https://www.firetide.com/home/) - [UNICOM Capital](https://www.unicom-capital.com/home/) - UNICOM Divisions - Product Catalog ### Categories - [News (3)](https://blog.unicomgov.com/blog/tag/news) - [Financial Services (2)](https://blog.unicomgov.com/blog/tag/financial-services) - [Distribution services (1)](https://blog.unicomgov.com/blog/tag/distribution-services) - [Federal (1)](https://blog.unicomgov.com/blog/tag/federal) - [IT (1)](https://blog.unicomgov.com/blog/tag/it) - [Insider (1)](https://blog.unicomgov.com/blog/tag/insider) - [Integration Services (1)](https://blog.unicomgov.com/blog/tag/integration-services) - [Modernization (1)](https://blog.unicomgov.com/blog/tag/modernization) # CMMC Compliance Overview May 05, 2021 Sharon Page - CISSP-ISSMP, CAP, Certified ISO 27001 Lead Auditor Security Architect Malicious cyber actors are targeting the Defense Industrial Base (DIB), and the supply chain of the Department of Defense (DOD). So the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD (A&S)), developed the Cybersecurity Maturity Model Certification (CMMC), requiring its implementation by all companies doing business across the DOD supply chain by 2025. The CMMC is a framework that consists of maturity processes and cybersecurity best practices, at five (5) levels of maturity. ![cmmc table](https://blog.unicomgov.com/hs-fs/hubfs/cmmc%20table.png?width=594&name=cmmc%20table.png) *Reference: Cybersecurity Maturity Model Certification (CMMC), Version 1.02, March 18 2020, copyright 2020 Carnegie Mellon University and The Johns Hopkins University Applied Physics Laboratory LLC., page 11.* For companies in the United States, that usually means implementing the security controls, also known as best practices, contained in NIST SP 800-171, plus some other best practices. Each maturity level, builds upon the previous level. Level 1 is required by any organization with a DoD contract, and protects Federal Contract Information (FCI). It consists of 17 security controls, and minimal effort with their cybersecurity defenses. Level 2 is the minimum level required to protect Controlled Unclassified Information (CUI). It consists of 55 additional security controls, in addition to the 17 controls in Level 1, and requires the development of written cybersecurity policies, plans, and standard cybersecurity practices. Level 3 consists of all the controls in Level 1 and 2, plus 58 additional security controls, necessary to increase the protection of CUI. The organization should perform continuous monitoring, and reviews of their cybersecurity activities, based on their cybersecurity policy. Level 4 adds 26 more security controls, 11 of which are from the draft NIST SP 800-171B, a supplement to the NIST SP 800-171. This level also adds the requirement of monitoring and measuring the security controls, to determine if they’re effective. Level 5 adds 15 new security controls, so there are 171 security controls in place. The organization must have standardized cybersecurity policies, and processes, across the entire organization. Levels 4 and 5 go beyond just protecting CUI. They also provide the ability to reduce the risk of Advanced Persistent Threats (APTs). CMMC applies only to the Defense Industrial Base (DIB) contractors’ unclassified networks, which process, store, or transmit FCI or CUI. The FCI and CUI are data collected, created, transmitted, or received when performing contract obligations that a law, regulation, or Government-wide policy requires be handled using safeguards or dissemination controls. Therefore, the scope of a company’s CMMC boundary must cover the company’s network infrastructure that uses CUI and/or FCI. Obtaining a CMMC certification, at any maturity level, requires the implementation of security best practices, with official validation from an authorized and accredited, CMMC third-party assessment organization (3PAO). The CMMC is being implemented in a 5 year, phased rollout approach. During the first year (2021), fifteen new prime contracts will include the requirement for a CMMC certification. Each following year will increase the number of prime contracts including CMMC certification requirements: 2022 – 75, 2023 – 250, 2024 – 325, and 2025 – 475. These contracts will focus on mid-sized programs that require the contractor to process, or store CUI (CMMC Level 3). Primes will be required to flow down the appropriate CMMC requirements to their subcontractors. Contracts that include the CMMC requirements will not be awarded, if a company is not certified at the appropriate CMMC level at the time of contract award. Note: Companies that only provide Commercial-Off-The-Shelf (COTS) products to the DOD are not required to obtain a CMMC certification.   Look forward to UGI's blog for May, we will be diving deeper in to CMMC Compliance and what is to be expected in the future.  - [Tweet](https://twitter.com/share) ### Register for the Blog! ### Categories - [News (3)](https://blog.unicomgov.com/blog/tag/news) - [Financial Services (2)](https://blog.unicomgov.com/blog/tag/financial-services) - [Distribution services (1)](https://blog.unicomgov.com/blog/tag/distribution-services) - [Federal (1)](https://blog.unicomgov.com/blog/tag/federal) - [IT (1)](https://blog.unicomgov.com/blog/tag/it) - [Insider (1)](https://blog.unicomgov.com/blog/tag/insider) - [Integration Services (1)](https://blog.unicomgov.com/blog/tag/integration-services) - [Modernization (1)](https://blog.unicomgov.com/blog/tag/modernization) #### Connect With Us     - [e-Procurement](http://shop.unicomgov.com/) - [Contact](https://www.unicomgov.com/unicom-government-root/about/contact-us/) - [Site Map](https://www.unicomgov.com/unicom-government-root/site-map/) - [Legal](https://www.unicomgov.com/unicom-government-root/legal/) - [Ethics Program](https://www.unicomgov.com/unicom-government-root/about/careers/) - [Privacy](https://www.unicomgov.com/unicom-government-root/privacy/) Copyright © 2018 **UNICOM® Government, Inc.**