CMMC Overview

The Department of War (DOW) has implemented new standards for contractors to prove they
have systems in place to protect digital and physical contract information. Known as the
Cybersecurity Maturity Model Certification (CMMC), this is a safeguarding tool to ensure
contractors and subcontractors (at every tier) have consistent cybersecurity standards for
processing, storing, and/or transmitting federal contract information (FCI) and controlled
unclassified information (CUI). CMMC has 3 levels. The requirements for CMMC Level 1 and Level 2 are described in the graphic below.

In November 2025, some contracts began requiring CMMC Level 1 and Level 2. By November
2026, some proposals and contracts will require CMMC Level 2 certification. Your CMMC
status will need to be registered in the Supplier Performance Risk Systems (SPRS) to be eligible
for these contracts.

To ensure your ability to be part of future proposals, Bristol requests subcontractors obtain at
least Level 1 certification. Once certified, complete the Cybersecurity Prequalification
Questionnaire in SmartBid.