What is CMMC compliance?

CMMC is the DoD's answer to defense contractor cybersecurity gaps. After years of self-attested compliance failing to prevent breaches, the DoD moved to mandatory third-party assessments. If your business holds DoD contracts — primary or subcontractor — CMMC applies to you.

The three levels

• Level 1 (Foundational): 17 basic safeguarding requirements for Federal Contract Information (FCI). Self-assessment allowed.
• Level 2 (Advanced): 110 controls aligned with NIST SP 800-171 for Controlled Unclassified Information (CUI). Third-party C3PAO assessment required for most contractors.
• Level 3 (Expert): Level 2 plus additional NIST SP 800-172 enhancements for the most sensitive programs. Government-led assessment.

What CMMC Level 2 actually requires

110 controls across 14 domains: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, system and information integrity.

Practically, this translates to:

• Multi-factor authentication everywhere
• Encryption of CUI at rest and in transit
• Audit logging and regular review
• Configuration baselines and change control
• Vulnerability management with documented remediation
• Incident response procedures with regular testing
• Annual security training
• Network segmentation isolating CUI environments
• Formal risk assessment process
• System Security Plan (SSP) documenting all controls
• Plan of Action & Milestones (POAM) for any gaps

Timeline

CMMC requirements began appearing in DoD contracts in 2025-2026 with full rollout phased over multiple years. Tennessee defense contractors should be working toward Level 2 readiness now — the assessment process can take 6-18 months from kickoff to certification.

Microsoft 365 GCC High

For organizations handling CUI, Microsoft 365 GCC High is the FedRAMP High-equivalent environment that satisfies most M365-related CMMC requirements. Standard commercial M365 doesn't meet CUI handling requirements.