Cybersecurity Maturity Model Certification (CMMC) 2.0 is a revised cybersecurity framework that evaluates and enforces the effective implementation of security controls defined in NIST SP 800-171 by any organization in the DoD supply chain.
NIST SP 800-171 is the current security standard mandated by the DoD for protecting Controlled Unclassified Information (CUI) in non federal information systems and originations, and serves as the foundation for CMMC 2.0 compliance.
CMMC Product Suite
Exostar’s Managed Microsoft 365 is a fully managed cloud service and CUI storage and collaboration tool with robust cybersecurity features to support CMMC certification. EMM365 provides a secure Microsoft Teams environment for CMMC compliance and secure collaboration.
Certification Assistant streamlines CMMC/NIST SP 800-171 self-assessments, calculates SPRS scores, and generates SSPs and POA&Ms for compliance. This tool allows you to take control of your NIST/CMMC self-assessment.
Simplify policy creation and maintenance with Exostar’s PolicyPro.
PolicyPro provides policy management and optimization for NIST SP 800-171 & CMMC compliance.
Choose from a comprehensive template library to build compliant NIST SP 800-171/CMMC policies or use the AI-powered engine to refine your existing documentation, ensuring your policies meet both current and future compliance requirements.
CMMC Webinars
Want to learn more about Cybersecurity Maturity Model Certification (CMMC)?
You can register for any of our upcoming CMC workshops here: CMMC Webinars
CMMC Accepted Credentials
The following credentials are accepted with any of the CMMC bundle products listed above. In order to access any CMMC application, at a minimum you will need to have a Managed Access Gateway account and purchase a Phone (SMS) One-Time Password (OTP) without Proofing.
Accepted Credentials:
– Phone (SMS) One-Time Password (OTP) with or without Proofing
– Hardware One-Time Password (OTP) Token
– FIDO2 Passkey
– Exostar Mobile ID
– MLOA Software Certificates
– MLOA Hardware Certificates
CMMC FAQs
Examples: technical drawings, purchase orders, or supplier data related to defense projects.
If leaked, it could still harm national security or military readiness.
These are the “rules of the road” for protecting CUI, and CMMC is built on them.
Contract rules from the DoD that require contractors to follow specific cybersecurity standards:
252.204-7012 → Protects CUI + requires reporting cyber incidents
252.204-7019 → Requires a self-assessment of NIST 800-171
252.204-7020 → Requires you to post your score in the government’s SPRS system
252.204-7021 → Requires CMMC certification at the time of award
Together, these clauses make cybersecurity and CMMC a mandatory condition for doing business with the DoD.