The Cybersecurity Maturity Model Certification (CMMC) has five certification levels that will assess a company’s maturity and cybersecurity preparedness to ensure that sensitive defense information is protected on contractors’ information systems. They are:
Level 1: Basic Cyber Hygiene. This level consists of 17 basic cybersecurity controls and focuses on the protection of Federal Contract Information (FCI).
Level 2: Intermediate Cyber Hygiene. This level has 72 controls and introduces a new type of data, Controlled Unclassified Information (CUI).
Level 3: Good Cyber Hygiene. This level includes 130 controls and requires organizations to establish, maintain and resource a plan demonstrating the management of activities for practice implementation.
Level 4: Proactive. This level comprises 156 controls and requires organizations to review their established plans, policies, and procedures regularly and take a proactive approach to measure, detect, and defeat threats.
Level 5: Advanced/Proactive. The highest CMMC level consists of 171 controls and adds a layer of requirements that refers to organizations’ capacity to respond to the changing threat landscape through auditing and managerial processes.