Federal Contracting Acronym
CMMC
Cybersecurity Maturity Model Certification
Plain-English definition
Cybersecurity Maturity Model Certification (CMMC) builds on NIST SP 800-171 controls to protect controlled unclassified information on defense programs. Contractors may need third-party certification or self-assessment depending on level and contract requirements. CMMC aligns with DFARS 252.204-7012 flow-downs and SPRS scoring. It is separate from FedRAMP, which addresses cloud service authorization for federal agencies.
Why it matters
Cyber requirements gate eligibility on defense work; SPRS and assessment evidence must be current at award.
Where you will see it
DFARS clauses, supplier performance risk assessments, proposal security volumes, and subcontract flow-downs.
Example in context
A subcontractor uploads an SSP and POA&M summary and confirms SPRS score before the prime includes them on a CMMC-scoped bid.