US DEFENCE SUPPLY CHAIN

CMMC (Cybersecurity Maturity Model Certification)

The assessment programme for contractors and subcontractors in the US Department of Defense supply chain.

Who it reaches

Contractors and subcontractors in the US Department of Defense supply chain, including UK ones, once their contract carries the CMMC clause. The programme rule is 32 CFR Part 170, effective 16 December 2024, and the contract rule phases CMMC into Department of Defense contracts from 10 November 2025. Three levels: Level 1 (15 requirements, annual self-assessment, for Federal Contract Information), Level 2 (the 110 requirements of NIST SP 800-171 Revision 2, assessed by an accredited C3PAO every three years for most contracts), Level 3 (assessed by the Department of Defense's own assessors).

What Goldline does

Readiness for Level 1 and Level 2: scoping the boundary around Controlled Unclassified Information, the gap assessment, the System Security Plan, the evidence, and a mock assessment before the C3PAO arrives.

Who issues the outcome

A C3PAO accredited by the Cyber AB, or the Department of Defense for Level 3. Goldline is not a C3PAO and does not assess for certification.

How it fits with ISO 27001

The same management system holds the evidence; CMMC adds its own assessment.

What it costs

Scoped on the diagnostic. Any third-party fee is paid direct.

Scoped on the diagnostic

Discuss how this framework reaches your organisation

Bring the contract, questionnaire or buyer request. The diagnostic establishes the scope and the evidence route.

Book the Free Diagnostic