The Defense Department’s Cybersecurity Maturity Model Certification (CMMC) is a multi-level cybersecurity certification system for contractors doing business with the federal government. CMMC codifies cybersecurity practices to ensure an engaged culture of cybersecurity throughout a contractor’s supply chain. DOD first launched the standard Jan. 31, 2020, and its acquisition and , What are the requirements of CMMC Level 1? CMMC Level 1 requires contractors to implement the 15 security requirements identified in FAR 52.204-21 (b) (1), Basic Safeguarding of Covered Contractor Information Systems, for contractor information systems that process, store, or transmit FCI., Learn what CMMC Levels 1–3 mean in 2025, what assessment costs to expect, and how contractors can stay compliant through the phased rollout., EXECUTIVE BRIEF With the CMMC contractual requirement rule (48 CFR) aiming to be finalized later this year, it is imperative for defense contractors to understand what will be required of them. Here is what you need to know: Subcontractors will need to become compliant with the CMMC maturity level that is listed in their prime contractor's request for proposals A CMMC Certificate of Status , A contractor that continues performing at the government's direction notwithstanding the invalid option exercise would be entitled to an equitable adjustment for the added cost of complying with CMMC. See, e.g., Fluor Fed. Sols., Inc., ASBCA No. 62343, 23-1 BCA ¶ 38,302 (collecting cases)., How will CMMC impact Government Contractors? Most organizations fulfilling government contracts for the DoD will need to address CMMC requirements in requests for information (RFIs) and requests for proposal (RFPs) bids for DoD acquisitions, with the potential exception for commercial items..