Cybersecurity Maturity Model Certification

Measures basic cyber hygiene and and must be satisfied to receive CMMC certification.

Focuses on intermediate cyber hygiene and requires an organization to establish and document standard operating procedures, policies, and strategic plans to guide the implementation of its cybersecurity program.

Measures good cyber hygiene and effective implementation of controls that meet the security requirements of the National Institute of Standards and Technology (NIST) SP 800-171 Rev 1. A Level 3 organization is expected to resource activities appropriately and review adherence to policy and procedures, demonstrating management of practice implementation.

An organization that achieves Level 4 has a substantial and proactive cybersecurity program. The organization can adapt to address the changing tactics, techniques, and procedures (TTPs) in use by advanced persistent threats (APTs).

An organization has an advanced cybersecurity program with a demonstrated ability to optimize its cybersecurity capabilities. For process maturity, a CMMC Level 5 organization is expected to ensure that its process implementation has been standardized across the organization.