{
  "node_id": "us-cmmc-2-0-defense-industrial-base-2021",
  "title": "Cybersecurity Maturity Model Certification (CMMC) 2.0 - Three-Level Framework for Defense Contractors Handling Controlled Unclassified Information (CUI) and Federal Contract Information (FCI)",
  "domain": "Public Sector & Government Procurement",
  "version": "1.1.0",
  "last_updated": "2026-06-29",
  "bluf": "The CMMC 2.0 framework mandates that all organizations within the Defense Industrial Base (DIB) implement cybersecurity practices aligned with one of three certification levels (1, 2, or 3) based on the type of information handled; specifically Federal Contract Information (FCI) or Controlled Unclassified Information (CUI); as established by the CMMC Program rule at 32 CFR Part 170 and the corresponding DFARS clauses. Compliance is required for all Department of Defense (DoD) contractors and subcontractors to bid on or perform work under DoD contracts involving CUI or FCI.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "cyber-nist-800-53-ac2",
    "nist-800-53-au2",
    "nist-800-53-sc7",
    "c-scrm-practices-systems-organizations",
    "assessing-security-privacy-controls"
  ],
  "primary_citations_count": 5
}