Skip to content

CMMC

What is CMMC?

The Cybersecurity Maturity Model Certification is a US Department of Defense framework requiring defense contractors to implement cybersecurity practices at specified maturity levels.

Compliance and Regulatory

Terms that appear alongside cmmc

Each of these is named in at least one of the same controls as cmmc. The number is how many controls name both.

Frameworks that govern cmmc

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on cmmc

Requirements naming cmmc across 5 standards, quoted from the control text.

CMMC 2.0 Level 117 controls

CMMC 2.0 Level 1 (Foundational) practice IA.L1-3.5.1: Identification - safeguarding Federal Contract Information per FAR 52.204-21(b)(1)(v) (3.5.1).

IA.L1-3.5.1 · Identification →
IRS Publication 10752 controls

Section 9.3 of IRS Publication 1075 establishes the technical and procedural security controls + by inheritance from NIST SP 800-53 Rev 5 Security and Privacy Controls for Information Systems and Organizations.

IRSPub1075-Section93-NIST800-53-Inheritance-IRSModerate-Plus-Baseline-FIPS199-HIGH-Confidentiality · IRS Publication 1075 Section 9.3 + NIST SP 800-53 Rev 5 Inheritance + IRS Moderate-Plus Baseline (Not Just Moderate, Less Than High) + FIPS 199 Confidentiality HIGH for FTI + 18 Control Families + 200+ Controls →
Australian Energy Sector Cyber Security Framework (AESCSF)1 control

The cybersecurity program strategy identifies the compliance requirements the program must meet, for example NERC CIP, the TSA pipeline security guidelines, PCI DSS, ISO standards or DoD CMMC.

australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-1g · PROGRAM-1g: Strategy identifies compliance requirements →
NIST SP 800-1371 control

Conduct ISCM Programme Review per Section 4.9 annually + capability maturity assessment + gap analysis + improvement planning aligned with NIST CSF 2.0 implementation tiers.

NISTSP137-8 · Programme Review, Training, and Third-Party ISCM →
SIG (Shared Assessments)1 control

Each SIG release is mapped to reference documents so one response can serve several frameworks: the 2024 SIG carries direct mappings to 27 reference documents in the content library (among them the 2024 SCA, ISO/IEC 27001 and 27002:2022, ISO/IEC 27701, NIST AI...

sig-shared-assessments::U4 · Use SIG mapping references and keep the questionnaire on the current release →

Questions people ask about cmmc

What is CMMC?
The Cybersecurity Maturity Model Certification is a US Department of Defense framework requiring defense contractors to implement cybersecurity practices at specified maturity levels.
Why is CMMC important for compliance?
CMMC is a key concept in Compliance and Regulatory. Understanding cmmc helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address CMMC?
CMMC appears in the requirement text of CMMC 2.0 Level 1, IRS Publication 1075, Australian Energy Sector Cyber Security Framework (AESCSF), NIST SP 800-137, SIG (Shared Assessments). Across these standards we have identified 22 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about CMMC?
Explore our compliance framework pages to see how cmmc applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how CMMC applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.