CMMC 2.0 — Cybersecurity Maturity Model Certification

The Cybersecurity Maturity Model Certification (CMMC) is the U.S. Department of Defense program that verifies defense contractors actually protect the sensitive unclassified information they handle — Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It replaced self-attestation with verified certification: a contractor's cybersecurity is assessed against a defined standard before contract award, and the level required depends on the information the work involves.

What CMMC 2.0 requires

CMMC 2.0 — the streamlined three-level model the DoD announced in November 2021 — sets three certification levels:

• Level 1 — Foundational: 15 basic safeguarding practices drawn from FAR clause 52.204-21, for contractors that handle FCI but not CUI. Assessed by annual self-assessment.
• Level 2 — Advanced: all 110 security requirements of NIST SP 800-171 Revision 2, for contractors that handle CUI. Most Level 2 contracts require certification by an independent CMMC Third-Party Assessment Organization (C3PAO); certification is valid for three years, with an annual affirmation.
• Level 3 — Expert: the Level 2 requirements plus 24 selected requirements from NIST SP 800-172, for the DoD's highest-priority programs. Assessed by the government through the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).

The rule behind it

CMMC is established by federal rule, not by industry guidance. The program rule, 32 CFR Part 170, was published October 15, 2024 and took effect December 16, 2024. The acquisition rule that puts CMMC requirements into DoD contracts — DFARS clause 252.204-7021 — took effect November 10, 2025. Requirements flow down through the supply chain: primes and subcontractors are each assessed at the level matching the information they handle.

Why it matters for facility work

Defense and aerospace facilities don't just need a contractor who can do the work — they need one whose cybersecurity meets the standard the contract requires. Facility services firms work inside secure facilities, alongside government systems and personnel, and the information they handle is part of that security picture. Certification is how a prime or a contracting officer verifies it before award, rather than taking a vendor's word for it.

Reference material

• DoD CIO — CMMC Program (official program page)
• DoD CIO — About CMMC
• DoD CIO — CMMC 101 overview briefing (PDF)
• Federal Register — CMMC Program final rule (32 CFR Part 170)
• NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
• Defense Counterintelligence and Security Agency (DCSA) — CMMC
• The Cyber AB — CMMC Accreditation Body

RUSH Facilities is CMMC 2.0 Level 2 certified

RUSH Facilities is CMMC 2.0 Level 2 certified, assessed by an independent CMMC Third-Party Assessment Organization (C3PAO). That means we have done the work to meet the cybersecurity standard required for government contracting — and we hold ourselves to it on every job. Our teams support NASA and Kennedy Space Center, Boeing, L3Harris, and Space Florida, clients where security is a contractual requirement, not a preference.