CMMC Frequently Asked Questions

- Applies to DoD prime contractors and subcontractors
-Applies to some new contracts starting in 2020 and applies to all contracts beginning in 2026
- The progressive model covers advancing levels of cybersecurity processes and practices resulting in a certification level
- Contractors must start at level 1 and certify at each level all the way to the top level 5
- Unlike past certifications, self-certifications are being eliminated.
- All assessments must be done by a 3rd party Certified CMMC Assessor.
- CMMC costs can be factored into your bids and will be a cost for all doing business with the DoD.