# CMMC 2.0: US Cybersecurity Maturity Model Certification

> Cybersecurity certification for US Department of Defense contractors handling federal contract or controlled unclassified information.

URL: https://securei3.com/standards/cmmc/
Category: Cybersecurity frameworks: Attestation / assessment
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


CMMC 2.0 sets three levels of cybersecurity practices for the US defence industrial base, with Level 2 aligned to NIST SP 800-171. Requirements are being phased into DoD contracts. We support readiness assessments, system security plans and remediation for contractors and their supply chains, including suppliers outside the US.

## Who it is for

- US defence contractors and subcontractors
- Global suppliers in DoD supply chains

## Benefits

- Eligibility for defence contracts

## How Secure iQube helps

1. **Scoping**: Agree the systems, services and criteria in scope, and whether a Type 1 or Type 2 report fits your customers and timeline.
2. **Readiness assessment**: Map existing controls to the criteria, identify gaps and design missing controls with owners and evidence.
3. **Remediation**: Put policies, tooling and processes in place, and rehearse evidence collection so it is routine, not a scramble.
4. **Assessment coordination**: We help you engage an authorised CMMC third-party assessment organisation where required, prepare the evidence and support you through the assessment and any follow-up actions.
5. **Observation period and report**: For Type 2, we monitor controls through the observation window and help you respond to exceptions before the report is issued.

## Frequently asked questions

### Do non-US suppliers need CMMC?

If they handle federal contract information or controlled unclassified information in a DoD supply chain, contract flow-downs can require it.

Related: https://securei3.com/standards/nist-800-53/, https://securei3.com/standards/nist-csf/

Contact: https://securei3.com/contact/: info@securei3.com