Glossary · Glossary
CMMC
The U.S. Department of Defense program that verifies defense contractors have implemented required cybersecurity practices, largely built on NIST SP 800-171. It introduces tiered levels and, for higher levels, independent assessment. CMMC determines whether a contractor is even eligible to hold certain DoD contracts; for a defense supplier it is a business gate as much as a cybersecurity one.
The U.S. Department of Defense program that verifies defense contractors have implemented required cybersecurity practices, largely built on NIST SP 800-171. It introduces tiered levels and, for higher levels, independent assessment.
Why it matters
CMMC determines whether a contractor is even eligible to hold certain DoD contracts; for a defense supplier it is a business gate as much as a cybersecurity one.
Standards & authorities
- 32 CFR Part 170 (CMMC Program)
- NIST SP 800-171 Rev. 2
- DFARS 252.204-7021
Related in glossary
Frequently asked
What is CMMC?
The U.S. Department of Defense program that verifies defense contractors have implemented required cybersecurity practices, largely built on NIST SP 800-171. It introduces tiered levels and, for higher levels, independent assessment.
Why does CMMC matter for defense and counter-UAS operators?
CMMC determines whether a contractor is even eligible to hold certain DoD contracts; for a defense supplier it is a business gate as much as a cybersecurity one.
What standard or authority governs CMMC?
CMMC is defined or governed by 32 CFR Part 170 (CMMC Program), NIST SP 800-171 Rev. 2, DFARS 252.204-7021.