Cybersecurity Maturity Model Certification (CMMC)

The Cybersecurity Maturity Model Certification (CMMC) is a framework developed by the U.S. Department of Defense (DoD) to ensure that contractors handling DoD-sensitive data follow established cybersecurity standards. The goal of CMMC—achieved through third-party assessments—is to provide the DoD with assurance that its industry partners are properly safeguarding Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). This helps strengthen the overall security of the Defense Industrial Base (DIB) and supports the mission of protecting U.S. warfighters.

CMMC 2.0 Framework Levels

Under CMMC 2.0, announced in 2021, the model consists of three levels:

The CMMC 2.0 rulemaking process is currently ongoing, with the final rule expected soon. Once finalized, CMMC requirements will begin appearing in new and renewed DoD contracts.

Steps to Prepare for CMMC Compliance

Determine Which CMMC Level Applies

Review your contracts and DFARS clauses to identify the required level.
If uncertain, confirm with your program manager or prime contractor.

Perform a Gap Analysis

Compare your current cybersecurity posture to the applicable framework:

Level 1: FAR 52.204-21 (17 controls)
Level 2: NIST SP 800-171 Rev. 2 (110 controls)
Level 3: NIST SP 800-172 (subset)Identify and document gaps requiring remediation.

Develop Key Compliance Documentation

Implement Security Practices: Describe each NIST and CMMC control.
Build Gap Plan: Outline remediation steps, ownership, and timelines.
Policies Planning: Such as access control, configuration management, and system monitoring.
Have Incident Response Plan: How will you report cyber incidents to the DoD within 72 hours.

Maintain Continuous Compliance

Stay current with evolving CMMC 2.0 requirements.
Review and update your plans annually.
Undergo recertification every three years (for applicable levels).

SANS Resources to Support CMMC Compliance

SANS offers a range of resources and training programs aligned with the NIST Cybersecurity Framework and CIS Critical Security Controls, including:

Executive Cyber Exercises: Practical simulations to strengthen organizational incident response planning.
Leadership Curriculum: Courses designed to build governance, strategy, and leadership skills necessary for maintaining cybersecurity compliance.
Technical Training: Courses built and taught by top practitioners in such topics such as incident response, cyber defense, and pen testing.

These resources help organizations develop the policies, governance, and response capabilities needed to meet CMMC and broader cybersecurity requirements.

Get CMMC-Ready with SANS Training

SANS offers a comprehensive series of training courses and hands-on exercises designed to help your security team and leadership meet CMMC domain requirements using this suggested mapping tool. Learn directly from top industry experts through continuously updated course content and give auditors confidence in your team’s capabilities with skills validation backed by GIAC certifications.

View Mapping

SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Cybersecurity Maturity Model Certification (CMMC)

CMMC 2.0 Framework Levels

Level 1 – Foundational

Level 2 – Advanced

Level 3 – Expert

Steps to Prepare for CMMC Compliance

SANS Resources to Support CMMC Compliance

Get CMMC-Ready with SANS Training

Resource Highlights

What You Need to Know About The Cybersecurity Maturity Model Certification (CMMC)

SANS Compliance Countdown: Hear from CMMC (10 Minutes In)

CMMC Website

NIST 800-171 Checklist

Cyber AB - CMMC Accreditation