thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Foundational

Cybersecurity Maturity Model Certification (CMMC)

DoD program verifying that defense contractors protect FCI and CUI, with three levels of assessment requirements.

Definition

CMMC 2.0 is codified in 32 CFR Part 170 (effective December 2024) and implemented in contracts via the 48 CFR DFARS rule effective 10 November 2025. Level 1 covers FCI with annual self-assessment, Level 2 covers CUI with self-assessment or C3PAO certification every three years, and Level 3 adds DIBCAC assessment of selected SP 800-172 requirements. Implementation is phased in over four phases ending in November 2028.

Example

A subcontractor handling CUI drawings needs a Level 2 C3PAO certification before contract award once Phase 2 applies.

Exam tip

Phase 1 began 10 November 2025; Phase 2, requiring C3PAO Level 2 certification where specified, begins 10 November 2026.

Related terms