The Evolution of CMMC
The Cybersecurity Maturity Model Certification (CMMC) was developed by the U.S. Department of Defense (DoD) in response to persistent and growing cybersecurity threats targeting the Defense Industrial Base (DIB). For years, defense contractors were responsible for self-attesting to their cybersecurity compliance, primarily against standards such as NIST SP 800-171. This approach proved insufficient as sensitive government data continued to be compromised across contractor networks.
To address these risks, the DoD introduced CMMC as a unified, enforceable framework that moves beyond self-certification. CMMC requires defense contractors to demonstrate verified cybersecurity practices through independent third-party assessments, ensuring consistent protection of sensitive data across the supply chain.
CMMC is now being formally integrated into DoD contracting. Contractors must hold the required CMMC level to be eligible to bid on and perform certain defense contracts, making cybersecurity a prerequisite—not an afterthought—for participation in the DIB.
What Is CMMC and How It Works
CMMC is a maturity-based cybersecurity framework designed to safeguard:
- Federal Contract Information (FCI)
- Controlled Unclassified Information (CUI)
The model consists of five cumulative certification levels, each reflecting increasing cybersecurity maturity:
- Level 1 – Foundational: Basic cyber hygiene to protect FCI
- Level 2 – Advanced: Protection of CUI aligned to NIST SP 800-171
- Levels 3–5 – Expert: Advanced processes to counter sophisticated threats and Advanced Persistent Threats (APTs)
Each level builds upon the previous one, expanding both the number and rigor of required security practices and processes.
CMMC Level 2 Requirements
CMMC Level 2 is the most commonly required level for defense contractors handling CUI. It includes:
- 320 security practices derived from NIST SP 800-171
- Formal documentation of policies and procedures
- Consistent implementation of security controls across people, processes, and technology
- Evidence-based validation of controls
These requirements span multiple domains, including:
- Access control
- Identification and authentication
- Incident response
- Configuration management
- Audit and accountability
- Risk management and system security planning
Importantly, CMMC Level 2 does not allow self-certification. Compliance must be validated by an independent, accredited assessor.
How CMMC Certification Is Achieved
To achieve CMMC certification, organizations must undergo a formal assessment conducted by a Certified Third-Party Assessment Organization (C3PAO). The assessment evaluates both the technical implementation of controls and the supporting policies, procedures, and evidence.
This process includes:
- Pre-assessment readiness and gap analysis
- Implementation of required controls
- Evidence collection and validation
- On-site or virtual assessment by a C3PAO
- Final certification decision and issuance
Certification is time-bound and must be renewed on a defined cycle, ensuring that cybersecurity practices remain current and effective.
Why CMMC Is Critical for the Defense Industrial Base
CMMC plays a central role in strengthening national security by:
- Reducing risk across the defense supply chain
- Preventing unauthorized access to CUI
- Establishing consistent cybersecurity expectations for contractors of all sizes
- Eliminating uncertainty around compliance requirements
As of October 2025, only approximately 366 organizations nationwide have achieved CMMC Level 2 certification. With more than 80,000 organizations expected to require this level, certified companies represent well under 1% of the DIB—highlighting both the rigor of the program and the competitive advantage certification provides.
Achieving Certification Through CMMC Space
Kasm Technologies achieved CMMC Level 2 certification through CMMC Space, a joint solution delivered in partnership with ATX Defense. CMMC Space is designed to simplify and accelerate compliance for small and mid-sized defense contractors by isolating CUI workloads into a hardened, compliant environment.
ATX Defense uses Kasm Workspaces as the core platform for workspace orchestration and data protection within CMMC Space. This approach enables organizations to:
- Centralize sensitive work in a secure virtual environment
- Reduce scope and complexity of compliance
- Automate a majority of CMMC Level 2 requirements
- Prepare efficiently for third-party assessment
Kasm Technologies Is Now CMMC Level 2 Certified
Kasm Technologies is officially CMMC Level 2 certified through January 15, 2029. Achieving certification through our partnership with ATX Defense validates both our internal security posture and the effectiveness of CMMC Space as a practical, assessor-proven path to compliance.
For defense contractors navigating CMMC requirements, Kasm’s certification demonstrates that modern, zero-trust, cloud-native solutions can meet stringent DoD cybersecurity standards while remaining operationally efficient and cost-effective.
