CMMC 2.0
compliance

The Cybersecurity Maturity Model Certification (CMMC) is the US Department of Defense programme that verifies defense contractors protect sensitive information. CMMC 2.0 streamlines the model to three levels and ties them directly to existing NIST standards — Level 1 to FAR basic safeguarding, Level 2 to NIST SP 800-171, and Level 3 to a subset of NIST SP 800-172.

Any organisation in the Defense Industrial Base (DIB) that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) under DoD contracts — including subcontractors and offshore delivery partners. The required level is specified in the contract, based on the type of information involved.

CMMC Level 2 is essentially an assessed implementation of NIST SP 800-171, so a contractor that has implemented 800-171 has done most of the Level 2 work. ISO 27001 is not equivalent, but a mature ISMS provides a strong control foundation — governance, access control, logging, and incident response — that maps to many CMMC practices and accelerates readiness.

No. Only an authorised C3PAO (for Level 2) or the government (for Level 3) can conduct an official CMMC assessment. Tranquility Cybersecurity provides readiness — a gap analysis against NIST SP 800-171, control implementation, documentation (SSP and POA&M), and pre-assessment support — so you walk into the assessment prepared.