How to Get Cybersecurity Maturity Model Certification (CMMC)

The Cybersecurity Maturity Model Certification (CMMC) has moved from future planning to active contract risk.

Phase 1 of the Department of Defense (DoD) rollout began on November 10, 2025, and primes are already asking subcontractors for proof before proposal teams are ready.

Contractors pursuing CMMC compliance face four core challenges: determining the required level, drawing a defensible boundary around systems, collecting evidence without derailing operations, and knowing when to bring in a formal assessor.

This guide explains how an organization can get CMMC and covers all you need to know about it.

TL;DR

• To get CMMC, first determine which CMMC Level your DoD contract requires, define your assessment scope, complete a gap analysis against the required controls, remediate weaknesses, and then complete either a self-assessment or formal C3PAO assessment, depending on the contract.
• CMMC Level 1 focuses on protecting FCI, while Levels 2 and 3 apply to CUI and require stricter security controls and evidence.
• Most organizations need 8–24 months and significant remediation work to become CMMC-compliant, especially for Level 2 certifications tied to NIST 800-171 requirements.
• Common mistakes include scoping too broadly, failing to maintain evidence, and engaging a C3PAO before systems, policies, and documentation are fully ready.
• MotherBear helps defense contractors centralize CMMC requirements, evidence, documentation, and remediation tracking so assessment readiness stays organized throughout the certification lifecycle.

What Does It Mean to Be CMMC-Compliant?

Being CMMC-compliant means your organization can demonstrate it meets the security requirements for the data and contracts it handles.

At CMMC Level 1, the focus is on protecting Federal Contract Information (FCI). For the next two levels, it shifts to Controlled Unclassified Information (CUI), and certification requirements become more demanding because the data is more sensitive.

Instead of treating CMMC compliance as a badge, treat it as proof that your systems, policies, people, and evidence align with the CMMC framework, and that the proof reflects how the company actually works.

Proof can come from a self-assessment or an independent third-party assessment, and the applicable CMMC Level controls the path.

The CMMC Certified Professional (CCP) path is separate from organizational certification. A CCP supports the assessment ecosystem, while a contractor seeking certification must demonstrate its own security program.

Mixing the two paths wastes time because an individual's training plan does not confer CMMC status on the company.

CMMC Levels Explained

CMMC 2.0 reduced the CMMC model to three levels, which makes the structure easier to explain but not always easier to apply.

The trade-off is that the CMMC Level printed in the contract now carries more weight, so if the specified CMMC Level is wrong, every later step becomes distorted.

The value of the framework is a unified cybersecurity standard for defense contractors that would otherwise answer different security demands from every prime. It gives smaller suppliers one way to explain their program.

CMMC Level 1

CMMC Level 1 applies to contractors that handle FCI but do not handle CUI, and it is built around basic safeguarding requirements.

Annual self-assessment results are entered into the Supplier Performance Risk System (SPRS), and while the workload is lighter than at CMMC Level 2, teams still need to know where they receive FCI, where they store it, and which systems transmit it during contract work.

Ask whether email, file sharing, or contract portals transmit FCI during daily work, because if they do, those systems belong in evidence before a subcontract award conversation starts.

FCI is not meant for public release, so even Level 1 work deserves clear handling rules, and teams often discover that rule late.

CMMC Level 2

CMMC Level 2 applies when a contractor processes CUI, and it maps to the 110 security requirements in NIST 800-171 Revision 2. The CMMC program currently uses Revision 2 for assessment purposes.

Some Level 2 contracts allow self-assessment, while others require an assessment by a CMMC Third-Party Assessment Organization (C3PAO) every three years.

Most teams should plan their CMMC implementation around the stricter path unless their contracting officer confirms otherwise.

CMMC Level 3

CMMC Level 3 is for the most sensitive CUI and programs exposed to advanced persistent threats.

A contractor must already hold Final Level 2 CMMC Status for the same assessment scope before the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) conducts the Level 3 review, which keeps the expert review from starting too soon.

This level is rare compared with Level 2, but it changes the shape of preparation. Level 3 adds selected NIST 800-172 requirements to increase assurance, so a team needs stronger monitoring, incident response, and governance before it requests a formal review.

How to Get CMMC: A Step-by-Step Guide

The certification process works best when each phase produces something concrete. Teams that skip ahead usually pay for it later through rework, assessor delays, or a CMMC assessment that confirms what the readiness work would have shown at a lower cost.

Step #1: Determine Your Required CMMC Level

Start with the contract, not with a generic checklist.

Read the solicitation, subcontract flow-down terms, Defense Federal Acquisition Regulation Supplement (DFARS) clauses, and any instructions from the contracting officer, since the goal is to identify the applicable CMMC Level before you commit budget.

For most DoD contracts, the decision turns on the data, so FCI generally aligns with CMMC Level 1, while CUI aligns with CMMC Level 2 or, in rare cases, CMMC Level 3.

Once the level is clear, the next priority is making that decision traceable. Use requirements tracking to tie each requirement to a contract driver, owner, and evidence source, which keeps the compliance process grounded when a prime asks for proof before contract award.

Step #2: Define Your CMMC Assessment Scope

Scope determines cost. A loose boundary pulls too many assets into the assessment, while an overly narrow one creates findings when assessors trace data beyond your declared boundary.

The CMMC assessment scope should include only assets that process, store, or transmit protected contract data. Clear system boundaries let an assessor follow the data path without guessing.

Build the first scope map around four asset groups, and keep the list short enough for owners to validate:

1. List contract portals, email routes, file shares, and endpoints that receive protected work files.
2. Mark repositories and partner tools that can affect access to evidence or assessment.
3. Separate hard-to-change shop-floor systems from standard laptops and servers.
4. Draw boundaries so a reviewer can follow the data path without guessing.

Treat external service providers as part of the scope when they touch evidence or CUI, since sensitive information should not be shared via convenience tools just because it is easier.

Document specialized assets separately, especially operational technology that cannot support standard controls, because a shop-floor system may need compensating evidence rather than the same configuration as a laptop.

Step #3: Conduct a Gap Analysis

This step compares the current environment with the control set for the selected level so you can identify gaps before they become assessment findings.

For CMMC Level 2, the practical baseline is NIST 800-171. For CMMC Level 3, the scope expands to include selected NIST 800-172 controls.

Do not score only the policy binder. Use the CMMC requirements as the scorecard, then test whether access control rules work, whether multi-factor authentication covers the right systems, and whether logs can prove the control was active.

The point of testing is to surface what written policy alone cannot show. These checks turn CMMC readiness into evidence instead of optimism.

A focused gap analysis should produce a list of findings that match the items an assessor would flag during the formal CMMC assessment. Fixing them now is cheaper than fixing them later.

Step #4: Remediate Gaps and Build Documentation

Remediation turns findings into working controls, while documentation proves those controls belong to a managed CMMC program.

Teams often treat these as separate tracks, but they have to move together because assessors compare written procedures with actual practice, and a control without a named owner becomes stale before the assessor sees it.

Create or update the System Security Plan (SSP), policies, procedures, network diagrams, and a Plan of Action and Milestones (POA&M) for allowed gaps. Use documentation builder tools to keep each document tied to its control, evidence, and owner.

The strongest SSP is not the lengthiest one, since what matters is explaining how the environment actually meets the CMMC standards, including exceptions, shared responsibilities, and remediation dates that leadership can defend.

Use the same evidence model for technical and administrative practices, because both can fail when the proof is thin.

Step #5: Conduct a Pre-Assessment

Run a pre-assessment before paying for the formal CMMC assessment. The organization seeking assessment should review evidence, interview control owners, and identify gaps that could undermine the formal results.

This work can occur through an internal mock review, CMMC consulting services, or a readiness check by a Registered Provider Organization.

The value is not a practice score on its own, but rather finding weak evidence while you still have time to fix it, because the assessment only sees what you can prove.

Use MotherBear’s evidence repository to map screenshots, logs, tickets, policies, and approvals to assessment objectives, preventing the last-week scramble in which teams know a control works but cannot prove it.

Book a demo now.

Step #6: Engage a C3PAO or Submit a Self Assessment

For CMMC Level 1, submit the self-assessment and affirmation in SPRS. For CMMC Level 2, confirm whether the contract requires a Level 2 self-assessment or a C3PAO assessment.

If a C3PAO is required, start early and use the Cyber AB Marketplace to check authorized providers.

The Cyber AB (formerly the CMMC Accreditation Body) manages key parts of the assessor ecosystem, and its Marketplace is the safest starting point because unauthorized providers cannot issue the CMMC status needed for a contract.

The Marketplace listing also confirms whether a provider is authorized for the assessment scope you need.

This step is also where many organizations seeking certification misjudge timing, because a C3PAO backlog can add months, and scheduling before remediation is complete turns an assessment slot into an expensive lesson.

Step #7: Complete the Formal Assessment

The formal CMMC assessment tests whether applicable requirements are implemented, documented, and supported by evidence.

Assessors review artifacts, interview staff, inspect configurations, and evaluate whether CMMC practices operate consistently. The assessment type determines who performs the work and where results are entered.

A passing assessment can produce a Final CMMC Status, but if limited gaps are allowed, the result may be a Conditional CMMC Status tied to a Conditional CMMC Status Date.

That date matters because it starts the 180-day window for POA&M closeout and the period during which the status remains current.

For Level 2, a closeout certification assessment validates open items after a C3PAO review, so that a weak remediation plan can result in an expired CMMC status rather than a conditional pass.

Step #8: Maintain Your Certification

After the assessment, maintain compliance through annual affirmations, evidence updates, and change control.

A new cloud tool, acquisition, contract, or CUI workflow can affect the scope. Your CMMC status is a living record rather than a file you store until renewal. Passing once is not the finish line.

Track each CMMC Status Date and renewal point in the same place as evidence of ownership, and if a Conditional CMMC Status Date exists, assign closeout work immediately.

For self-assessment paths, allowed POA&M items may need a closeout self-assessment, and the owner should be named before the deadline.

For C3PAO or DIBCAC paths, the closeout assessment must match the original assessment authority. Strong maintenance keeps the next certification process smaller because evidence, owners, and system boundaries stay current.

How Long Does It Take to Get CMMC?

Most organizations starting from scratch need 8–24 months to become CMMC-compliant, with CMMC Level 2 usually taking longer than Level 1.

A contractor with mature controls may reach assessment readiness in 6–9 months, while a small team with scattered systems, weak access controls, and no SSP can take 12–18 months to schedule a C3PAO.

Defense contractors that already manage sensitive government information usually move faster because established habits are part of their work. They still need time, but rarely start from scratch.

The formal review itself is shorter than the preparation. On-site assessment usually takes one to three weeks, but booking the assessor, responding to evidence requests, and waiting for the report can add months.

The practical answer is to start before the solicitation forces the issue, since Phase 1 has already begun, and later phases add more contract language across the defense industrial base.

How Much Does CMMC Compliance Cost?

Cost depends on company size, scope, current controls, and the amount of remediation needed.

The C3PAO fee gets attention, but it is rarely the whole bill, since most spending occurs during the CMMC implementation work that takes place before the assessor arrives.

The best cost decision is usually scoping discipline. A tight boundary reduces specialized assets, limits exposure of sensitive data, and keeps the certification requirements tied to actual contract needs.

Common Challenges and Pitfalls

The hardest part of CMMC is rarely one control. It is the chain of decisions that turns a manageable project into a costly scramble, so watch for these mistakes:

• Scoping too broadly pulls ordinary business systems into the assessment, making every change harder to defend.
• Underestimating documentation effort leaves teams with working controls but weak evidence during the CMMC assessment.
• Engaging a C3PAO too early can waste budget before the required security measures are in place and operating.
• Treating policies as paperwork creates findings when written procedures do not align with daily practice.

The cleaner approach is slower at the beginning and faster near the assessment, which fits teams that want a defensible CMMC status, not just a binder that looks ready.

A strong compliance partner should challenge assumptions about scope, evidence, and timing before those assumptions become contract risk.

Maintaining Your CMMC Status

CMMC status stays useful only when it reflects the current environment. A Final CMMC Status at CMMC Level 2 is generally valid for three years, but annual affirmations still matter.

Under the DFARS CMMC clause (DFARS 252.204-7021), contractors must maintain current status for systems that process, store, or transmit FCI or CUI.

Keep a recurring control cycle and use it during monthly reviews:

• Review the scope after new contracts, tools, acquisitions, or changes to data flows.
• Refresh evidence monthly so the next review does not depend on memory.
• Reconfirm status dates, POA&M deadlines, and renewal timing with leadership.

That habit turns the CMMC program into routine operations and reduces the likelihood that a small system change will create a gap right before contract award.

Keep Contract Risk Out of Your Assessment With MotherBear

MotherBear gives defense contractors and CMMC consultants a central place to manage requirements, documentation, evidence, and task ownership.

CMMC compliance breaks down when status lives in a spreadsheet, evidence lives in shared drives, and remediation lives in someone's inbox.

Use MotherBear to keep the CMMC program connected from level determination through maintenance, so a missing artifact or outdated scope decision does not put a bid at risk.

Book a demo now and see how MotherBear keeps your assessment record ready for the next contract.

FAQs About How to Get CMMC

Can organizations earn formal CMMC status?

Yes. Organizations can earn Final CMMC Status at the required level after completing the correct assessment path. CMMC Level 1 uses self-assessment, many CMMC Level 2 contracts require a C3PAO assessment, and DIBCAC conducts CMMC Level 3.

How much does it cost to become CMMC-compliant?

Most Level 2 organizations should plan for tens of thousands in assessment fees and far more for remediation. A full program often exceeds $100,000 once tools, consulting, staffing, documentation, and maintenance are included.

How hard is it to become CMMC-compliant?

It is hard when the scope is unclear, evidence is scattered, or policies do not match daily work. It is manageable when the CMMC requirements are assigned, tested, documented, and reviewed before the formal assessment.

What is the first step to becoming CMMC-compliant?

The first step is to determine the required CMMC Level from the contract and data type. Once the level is clear, define the scope and run a gap analysis before booking an assessor.