CMMC 2.0: The DoD's streamlined cybersecurity standard and what it kept about training

The Cybersecurity Maturity Model Certification, or CMMC, has been one of the most consequential cybersecurity developments for the defense industrial base. When the Department of Defense first launched CMMC in 2020, it was a five-level framework that made cybersecurity maturity a condition of doing business with the government. By 2023, the program had been revised into CMMC 2.0, streamlined but no less significant. The revision changed the structure, but it kept one element firmly in place: security awareness training.

From CMMC 1.0 to 2.0

CMMC 1.0 was ambitious but drew criticism from contractors, who found its five levels and assessment requirements costly and complex. The Department of Defense listened and, in late 2021, announced CMMC 2.0, a streamlined version that reduced the levels from five to three and aligned them more closely with existing NIST standards. The goal was to reduce burden while preserving the core idea: that contractors handling controlled information must demonstrate a real cybersecurity posture, not just self-attest to one.

The three levels

CMMC 2.0 condensed the model into three levels. Level 1, foundational, requires basic cyber hygiene and is assessed through self-assessment. Level 2, advanced, aligns with NIST SP 800-171 and applies to organizations handling controlled unclassified information, with assessment requirements varying by the sensitivity of the data. Level 3, expert, applies to the most sensitive programs and aligns with a subset of NIST SP 800-172. The streamlining made the model easier to navigate, but the underlying security expectations remained serious.

Where training sits in the controls

Security awareness training has been a consistent requirement across CMMC's evolution, because it is a core control in NIST SP 800-171, which underpins the model. The requirement, drawn from the NIST control on awareness and training, is that organizations provide security awareness training to their personnel and ensure they understand their responsibilities. This is not a high-level aspiration, it is a specific, assessable control, and it applies from the foundational levels up. Contractors that skip training cannot credibly claim compliance.

Self-assessment versus certification

A key change in CMMC 2.0 was a greater reliance on self-assessment at the lower levels, with third-party certification reserved for higher-risk situations. This reduced cost for many contractors but placed a premium on honest, documented self-assessment. An organization that self-attests to training without being able to produce records is taking a real risk, because the attestation can be tested, and a false one carries consequences. The move to self-assessment made good documentation more important, not less.

What contractors should do now

For contractors in the defense supply chain, the practical steps were clear. Determine which CMMC level applies to the work you perform and the data you handle. Close the gaps against the relevant NIST controls, including the awareness and training requirement. Document everything, because whether the assessment is by self-attestation or a third party, evidence is what matters. And treat training as an ongoing program, delivered to all personnel with clean records, rather than a one-time push before an assessment.

A standard that outgrew defense

CMMC's influence extended beyond the defense industrial base. The idea that cybersecurity maturity should be a condition of doing business, and that it should be demonstrable rather than self-asserted, spread to other sectors and to the insurance market, which adopted similar evidence-driven approaches to underwriting. The lesson was portable: in a world where security posture determines access to contracts, coverage, and customers, the ability to prove your controls, including training, is a competitive asset, not just a compliance chore.