The Cybersecurity Maturity Model Certification is required for Defense Industrial Base contractors handling CUI. Levels 1 (self-assessment), 2 (third-party for prioritized CUI), and 3 (government-led)
The Cybersecurity Maturity Model Certification is required for Defense Industrial Base contractors handling CUI. Levels 1 (self-assessment), 2 (third-party for prioritized CUI), and 3 (government-led) apply based on data sensitivity. Final rule published December 2024; contractual requirements began rolling into DoD solicitations through 2025.