CMMC - a US Federal Maturity Model

A maturity model is defined as a set of best practices that an organization will follow to ensure a certain level of security. This model system has been introduced as a solution to limit the damage related to cybercrimes, which are increasing exponentially around the world and becoming ever more sophisticated.

The DoD entrusts contractors and sub-contractors with sensitive information and needs to ensure appropriate security measures are in place. To bid on federal contracts, organizations must be prepared to meet these cybersecurity measures.

Though CMMC certification may be difficult for small contractors or companies to achieve, it serves important national interests and represents an investment in security hardening throughout the DoD supply chain.

How Many Maturity Levels Are There?

The DoD labels contracts with the required level of CMMC certification. No CMMC certification is required if your firm deals only with public information. There are 3 levels:

• Level 1: involves FCI not for public release. Matches 15 controls from FAR 52.204-21 “basic” controls. Annual certifications and self-assessments are completed by company leadership.
• Level 2: involves dealing with CUI. Aligns with 110 NIST SP 800-171 controls. Requires annual self-assessments; third-party assessment by a Certified Third-Party Assessor Organization (C3PAO) is required in most contracts starting November 10, 2026 (Phase 2).
• Level 3– Expert: involves dealing with CUI. Aligns with 110 NIST 800-171 controls and 24 NIST 800-172 controls. Requires triennial, government-led assessments.

If contractors are not certified with the appropriate CMMC level, they will not be able to bid on DoD projects. The main question becomes, which level of certification is needed? It largely depends on the information the organization will handle – public, FCI, or CUI.

How to Achieve Level 2 CMMC Certification

There are over 300,000 Defense Industrial Base firms subject to CMMC certification at some level — and with Phase 1 now active, most that handle CUI should already be building toward Level 2 compliance.

There is a 7-step process commonly used to achieve Level 2 CMMC certification:

1. Assess and Implement Information Security Workflows: the first step is to self-assess and then develop a security plan that complies with NIST 800-171 standards.
2. Improve Workflows and Submit Scores: develop a scoring system with a maximum score of 110, to ensure target compliance. Once this is done, submit those scores to the Supplier Performance Risk System (SPRS)
3. Check for Scope: it could be for a program enclave, enterprise or organization unit. The CMMC has released compliance assessment guides.
4. Preliminary Gap Assesssment (Optional): An external party can help with security assessments, identify any issues, and develop solutions to address them promptly.
5. Choose a C3PAO: Utilize the Cyber-AB (formerly CMMC-AB) Marketplace to identify a C3PAO to schedule your CMMC assessment.
6. CMMC Assessment: Certification assessment is done in 4 phases; if your request is approved, a 90-day time period is allotted to address any and all shortfalls identified.
7. Certification: The Cyber AB reviews assessments made by the C3PAO. If approved, your organization is awarded a 3-year CMMC Level 2 certification, after which a renewal assessment is required.

FileCloud Support for CMMC Domains & Requirements

FileCloud’s secure content collaboration platform helps organizations implement the technical capabilities required to support CMMC-aligned environments. While CMMC certification is granted at the organizational level, FileCloud offers vital controls and governance to prepare for assessments and maintain compliance. Here are just a few of the ways FileCloud supports CMMC requirements and domains:

Access Control (AC)

Granular user permissions, role-based access control, and secure sharing ensure that only authorized users can access sensitive data.

Audit and Accountability (AU)

Comprehensive audit logs and activity tracking provide full visibility into file access, sharing, and modifications—supporting traceability and reporting requirements.

Identification and Authentication (IA)

Integration with SSO, SAML, and multi-factor authentication (MFA) ensures strong identity verification and secure user access.

System and Communications Protection (SC)

Data is protected with AES-256 encryption at rest and TLS 1.2/1.3 in transit, supporting secure data transfer and storage.

Configuration and Data Governance

Policy-driven controls, file retention, and content classification support governance requirements for managing sensitive data throughout its lifecycle.

Read our white paper to learn how FileCloud supports hyper-secure file sharing and data governance for contractors and organizations working with US Federal data!