What Is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is a Department of Defense program designed to ensure contractors protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).
CMMC consolidates and enforces cybersecurity requirements drawn largely from NIST SP 800-171, adding formal assessment and certification requirements for contractors across the defense industrial base.
As of November, 2025 these requirements became mandatory. Under CMMC 2.0, most contractors will be required to meet Level 2 requirements, which focus on the consistent implementation and enforcement of security controls across people, processes, and technology.
Why It Matters
CMMC compliance is a contract requirement, not a best practice. Organizations that fail to meet required levels may be ineligible for future DoD contracts or face delays, remediation demands, and additional oversight.
Assessments focus on whether security controls are implemented, operating, and sustained over time. Policies alone are not sufficient. You must demonstrate that systems handling CUI are configured securely, monitored continuously, and protected from unauthorized changes.
Many assessment failures stem from gaps between documented controls and what is actually enforced in production environments.
“Develop, document, and maintain under configuration control, a current baseline configuration of the system.”
“Establish and maintain baseline configurations for organizational systems.”
“Review and update baseline configurations as required due to system changes or security requirements.”
What It Requires
CMMC Level 2 aligns closely with NIST SP 800-171 and requires contractors to implement and demonstrate controls across 14 security domains, including:
- Configuration management: Establish, enforce, and maintain secure system configurations
- Access control: Limit system access to authorized users and roles
- Audit and accountability: Generate and retain audit logs for system activity
- System integrity: Protect systems from unauthorized changes and configuration drift
- Risk management: Identify and mitigate risks to CUI
- Continuous monitoring: Detect deviations from expected security posture
Controls must be applied consistently across all in-scope systems and supported by evidence.
CMMC Implementation Guidance
Organizations pursuing CMMC Level 2 should be able to demonstrate the following:
☐ Systems handling CUI follow documented, enforced security baselines
☐ Configuration changes are approved, logged, and auditable
☐ Unauthorized configuration changes are detected and addressed
☐ Access to system configuration settings is restricted by role
☐ Audit logs are enabled, protected, and retained
☐ Continuous monitoring is in place to identify drift or control failures
☐ Evidence is organized and accessible for assessment
☐ Security controls are reviewed regularly and updated as risks evolve
How to Prepare for a CMMC Level 2 Assessment
CMMC assessments focus on whether controls are implemented and sustained, not just planned. Contractors should prioritize:
- Enforcing secure configuration baselines on all in-scope systems
- Monitoring continuously for drift or unauthorized changes
- Maintaining clear, assessor-ready evidence
- Mapping technical controls directly to NIST SP 800-171 requirements
- Treating compliance as an ongoing operational function
The more automated and consistent your enforcement is, the easier it is to demonstrate compliance during assessment.
How CalCom Helps
CalCom Hardening Suite (CHS) helps defense contractors meet CMMC technical requirements related to configuration management, system integrity, and audit readiness.
With CHS, you can:
- Enforce hardened baselines aligned with NIST SP 800-171
- Detect and prevent unauthorized configuration changes
- Log and audit all configuration activity automatically
- Preview the impact of hardening changes before deployment
- Maintain continuous compliance instead of scrambling before assessments
CalCom helps ensure that security controls are not just documented, but actively enforced and provable.
