FAQ

CMMC Frequently Asked Questions

Everything you need to know about the Cybersecurity Maturity Model Certification — from basic concepts to costs, timelines, and technical requirements.

Showing 169 of 169 questions

General

Costs & Timeline

Assessment Process

External Providers & MSPs

Technical Requirements

Supply Chain

CUI Handling

Enclaves & Cloud

Legal & Regulatory

Documentation

Related Resources

CMMC Compliance Services

Our turnkey DoD/Federal CUI compliance program.

View service

PII vs NPI Explained

Understanding data classification for compliance.

Need CMMC compliance help?

Schedule a free scoping call to assess your readiness and build a path to certification.

Schedule Scoping Call

CMMC Frequently Asked Questions

General

What is CMMC?

Who must comply with CMMC?

What are the CMMC levels?

When will CMMC take effect?

How will the DoD determine what CMMC level/requirements I have to meet?

How will we know what CMMC level is required for a specific contract?

Are there any contracts that will be exempt from CMMC?

The Title 32 part of CMMC goes live in about a week. What does that mean to me?

How long will it take to completely roll out CMMC to all defense contractors?

CMMC only applies to DoD but what about CUI for other government contracts?

If I don't have access to CUI, then I can just ignore CMMC, right?

We only sell commercial products; does CMMC apply to us?

If I am only selling COTS (commercial off the shelf) products, do I need to be CMMC certified?

Is CMMC a DoD only requirement?

What other countries have a CMMC-like program?

Does or will CMMC have reciprocity with other countries' versions of CMMC?

Why is DoD forcing the CMMC issue?

Who owns CMMC in your organization?

Is CMMC a business consolidation event?

Need to Explain CMMC to Someone in 10 Minutes?

What is Katie Arrington, the new person acting in the role of DoD CIO, saying about CMMC?

With this new administration and the emphasis on less regulations, doesn't that mean the Pentagon is going to cave on CMMC?

Costs & Timeline

How much will it cost to implement CMMC?

How much will it cost and how long will it take to migrate all of our data from our current environment to an approved one?

CMMC is expensive, how do I pay for it?

Will the government pay for my becoming CMMC Certified?

Is the government looking at any financial help for small businesses who need to become CMMC certified?

Can't we wait until we see a contract with CUI to get started?

When will CMMC Title 32 be "official"?

What is the timeline of CMMC?

What is the status of CMMC Title 48?

When will we see CMMC requirements?

When are we going to start seeing CMMC requirements in RFPs and RFIs?

What are the rules for cost recovery if we are required to become CMMC Level 3 certified?

Assessment Process

How does the assessment process itself work?

What happens if we "fail" Phase One?

Do I have to get a SPRS score of 110 to pass my CMMC test?

Can we "fix" issues the assessors find once the assessment is done?

What are the top two controls that companies fail to comply with?

When should we start talking to C3PAOs about getting certified?

How important is documentation to passing an assessment?

What is the biggest problem companies seeking assessments are having?

What should we pay attention to in order to improve our chances of passing our assessment?

Will my DoD customer make on-site visits, separate from the C3PAO, to check my compliance status?

Am I going to be able to self-certify that I am CMMC Level 2 compliant?

We are a DoD cleared facility. Can we self certify our compliance with CMMC Level 2?

How do I know if I can self certify for CMMC or will have to get certified by a third party?

Is a DIBCAC assessment the same as a CMMC Level 2 Certification?

What is our ESP's role during a CMMC assessment?

What level of knowledge do assessors expect from the CxO who is participating in the assessment?

What is expected from the technical team during the assessment?

Are CMMC assessments uncovering potential felonies?

What is a CMMC UID?

What is CMMC's definition of a significant change that triggers a requirement for a new assessment?

After today can I still enter a score of, say, 60, in SPRS?

What happens if we submit an RFP response and we are not CMMC compliant?

What special training do I need to give all employees to be ready for our assessment?

What do we need to do once we attest that we are fully compliant with CMMC?

I heard there was a shortage of CMMC assessors. Is that true?

External Providers & MSPs

If we use a third party shredding service to dispose of paper CUI, are they an external service provider?

We use an external software developer who has access to our systems, do they need to be CMMC compliant and/or certified?

Does my Managed Service Provider (MSP) or Managed Security Service Provider (MSSP) need to be CMMC certified?

Since the final rule says that Managed Service Providers do not HAVE to be certified, why should we choose one that is certified?

How will my relationship with my MSP be impacted by my CMMC requirements?

If you use a Managed Service Provider (MSP), have you verified in writing that they can and will support you through the CMMC process?

If I have export controlled (ITAR) information, does that affect my MSP requirements?

We use an outside printer to print large format documents. If those documents are CUI, how should we handle that?

If I have an MSP or other External Service Provider (with access to my CUI), do they need to show up for my assessment?

We are part of a bigger company that uses a shared (IT) services model. Does our internal shared service have to be FedRAMP authorized?

Technical Requirements

What will I need to have to prove that I am using FIPS certified cryptography?

I have heard that FIPS 140-2 is being retired. What does that mean for my FIPS certified cryptography products?

What is the status of Operational Technology (OT, IoT, IIoT) and CMMC?

When will we have to comply with NIST SP 800-171 Revision 3?

How does CMMC relate to NIST 800-171?