Government work is the new and lucrative frontier for IT and cloud providers, and part of its competitiveness is the rigorous requirements for service providers that weed out those who aren’t prepared for such work, leaving effective and professional outfits that can function at a high-level and provide services that other companies can’t.
While many providers know about standards like FedRAMP or NIST requirements, not many know about CMMC. This relatively new framework impacts IT and cloud providers who want to work with agencies under the Department of War (DoW) but provides a clear picture of the requirements these providers must meet to work with sensitive data.
What is CMMC?
The Cybersecurity Maturity Model Certification framework is a standard developed by the Department of Defense to gauge the security capabilities of federal contractors. Specifically, CMMC was developed by the DoD to help protect Controlled Unclassified Information (CUI) and (FCI) handled by these federal contractors.
CMMC was implemented to protect critical data handled by contractors for the DoD. A recent claim by the DoD notes that contractors handle up to 70% of CUI or FCI, and as such, it is relevant to national security to
What are CUI and FCI? Controlled Unclassified Information is unclassified information that still requires proper security controls to protect it against unauthorized dissemination. Typically, CUI does not contain proprietary information or intellectual property that calls for additional privacy unless a relationship between a private corporation and a government agency is called for it.
While CUI is unclassified, it is still important for the operation of a given agency. Hackers will often target CUI because they can gain insight from it in terms of our defense or strike capabilities or other data that could benefit other agencies without the same classified designations. CUI was created as part of an Executive Order signed in November of 2010.
Federal Contract Information is similar to CUI but covers a broad range of documents that are not intended for public release and are specifically part of a contractual relationship between a provider and a government agency.
Currently, the DoD is releasing some RFPs containing CMMC compliance requirements. This trend is expected to increase over time, with it being a 100% requirement for all RFPs by 2026. By that time, government contractors working with DoD must meet CMMC requirements.
What are the Certification Levels for CMMC?
CMMC derives its language and requirements from existing federal security documents, including NIST 800-171, 48 CFR 52.204-1, and others.
With those documents, it breaks down areas of concern into domains, capabilities, practices, and processes.
- A domain is a broad category covering large impact areas, including items like Access Control and Audit and Accountability. There are 17 domains.
- Each domain has a set of capabilities that a contractor must be able to accomplish, including things like Establishing system access requirements, conducting security awareness activities, or planning an incident response.
- Each capability comprises practices and processes linked to that capability that must be in place to protect CUI and FCI.
Following that, the CMMC certification is broken down into 3 Levels corresponding to the number of domains (and thus capabilities) the contractor must demonstrate to meet that requirement. These levels are:
- Level 1: Demonstrating the ability to implement “basic” cybersecurity controls from NIST Special Publication 800-171 (15 in total).
- Level 2: This level is the base minimum where a contractor can handle CUI. At this level, the contractor must implement every control (110 in total).
- Level 3: Encompassing 134 controls from both NIST SP 800-171 and NIST SP 800-172 and undergo more stringent auditing requirements. This level is for more challenging threats, such as Advanced Persistent Threats (APTs).
At each level, the responsibilities of the contractor increase in terms of the kinds of security controls they have in place and the additional processes they have to operate those controls across their organization.
What is a C3PAO?
Much like FedRAMP, CMMC calls for a Third-Party Assessment Organization (C3PAO) to handle assessment and audits for the provider. While the assessment process isn’t as prolonged for CMMC as it is for FedRAMP, it is quite involved and is meant to give the government a clear and fair picture of the security capabilities of a provider.
There are a few terms that might confuse you when looking into C3PAOs, however:
- A 3PAO is an organization certified to audit providers for CMMC compliance.
- A Certified Professional (CP) is a security professional that participates in CMMC assessments, usually as part of a team under an experienced assessor.
- A Certified Assessor (CA) conducts and manages assessments and supervises CPs.
Both CAs and CPs are part of C3PAO businesses.
Are There Synergies Between CMMC and FedRAMP?
FedRAMP certification and CMMC are both parts of the federal compliance space. They both utilize several NIST documents as the basis for their compliance demands, but they don’t map onto each other 1-to-1.
FedRAMP regulates government cloud providers by ranking their security requirements low, Medium, and High. These levels are determined by the type of data that a cloud provider would handle with a partner agency. They do not immediately relate to the 3 levels of security outlined in CMMC.
The DoD has, however, stated that they intend to offer a level of reciprocity between the two so that cloud providers undergoing the rigorous FedRAMP audits (or vice versa with CMMC) have a path to working with agencies in and outside the defense community. For example, a cloud provider handling CUI would call for a Moderate ranking in FedRAMP, which is Level 3 in CMMC. The consensus in some areas is that since these are both relatively the midpoint in their respective frameworks, they could be used as an entry point to map one framework onto the other.
Conclusion
CMMC is a new and emerging framework that will quickly become a necessity for IT companies and cloud providers who intend to work with agencies under the DoD. More importantly for business, CMMC could open doors for companies who want to expand their potential pool of government agencies within the DoD umbrella. With a potential synergy with FedRAMP, many cloud providers will be able to serve agencies across several levels of the government.
If you’re interested in learning more about CMMC, FedRAMP, or working with a 3PAO or C3PAO, contact Lazarus Alliance at 1-888-896-7580 or contact us through the form below.
What Is Autonomous Malware?
We’re reaching the end of 2025, and looking ahead to 2026, most experts are discussing the latest threats that will shape the year ahead. This year, we’re seeing a new, but not unexpected, shift to autonomous threats driven by state-sponsored actors and AI. With that in mind, a new generation of threats, broadly known as...Continue reading→
What CISA’s Emergency Directive 26-01 Means for Everyone
In mid-October 2025, the CISA issued one of its most urgent orders yet: Emergency Directive 26-01. The directive calls on all Federal Civilian Executive Branch (FCEB) agencies to immediately mitigate vulnerabilities in devices from F5 Networks following a state-sponsored breach of F5’s systems and access to portions of BIG-IP source code and vulnerability data. The event...Continue reading→
Cybersecurity and Vetting AI-Powered Tools
A recent exploit involving a new AI-focused browser shone a light on a critical problem–namely, that browser security is a constant issue, and AI is just making that threat more pronounced. Attackers discovered a way to use that browser’s memory features to implant hidden instructions inside an AI assistant. Once stored, those instructions triggered unwanted...Continue reading→
Shutdown Security And Cyber Vulnerability
When the federal government shuts down, the public sees closed monuments, unpaid workers, and halted programs. What they do not see is the silent surge of cyberattacks targeting agencies already operating on fumes. During the most recent shutdown, attacks against U.S. government systems spiked by nearly 85%. Cybersecurity failures during government disruptions rarely start with...Continue reading→
Identity and the Shift from Malware
The world of cyber threats is rapidly evolving, and while we can see these changes more generally, it’s always crucial to understand them concretely. As the 2025 CrowdStrike Global Threat Report shows us, the landscape of our industry is changing. We’re digging into this report to discuss a challenging trend: the move of hackers foregoing...Continue reading→
Maintaining Compliance Against Prompt Injection Attacks
The increasing adoption of AI by businesses introduces security risks that current cybersecurity frameworks are not prepared to address. A particularly complex emerging threat is prompt injection attacks. These attacks manipulate the integrity of large language models and other AI systems, potentially compromising security protocols and legal compliance. Organizations adopting AI must have a plan...Continue reading→
Are We Already Talking About CMMC 3.0?
The ink has barely dried on the CMMC final rule, and already the defense contracting community is buzzing with speculation about what comes next. Just when contractors thought they had a moment to catch their breath after years of regulatory limbo, whispers of CMMC 3.0 have begun circulating through the industry. But is this just...Continue reading→
Centralizing Identity-Based Risk
As the traditional network boundary dissolves and remote work becomes standard practice, identities are the major frontier for security. Whether we’re talking about human users, service accounts, or machine identities, these have emerged as both the primary access mechanism and the most targeted attack vector. It has become imperative for providers to centralize identity management...Continue reading→
Deviation and Significant Change Requests in FedRAMP: A Comprehensive Guide
FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. While the program’s rigorous baseline requirements ensure consistent security, the reality is that this consistency calls for a little flexibility. This is where deviation requests and significant change requests come into play. These two...Continue reading→
The Costs of Compliance and Data Breaches
Data is possibly one of the most valuable assets any organization holds. Customer information, employee records, and proprietary business intelligence present challenges because the data flowing through modern enterprises represents both significant opportunities and serious risks. Businesses face a challenging balance: investing in compliance measures to protect sensitive information while also preparing for the real...Continue reading→
Related Posts