CMMC is the new DoD’s method for securing the defense industrial base. The intent is to increase the security around critical information.
All companies that work with the DoD, subcontract to subs and primes of the DoD, and any third-party service company that supports those companies. This will include support companies such as MSPs (Managed Service Providers, i.e. IT support companies).
The DoD has seen large amounts of critical information being taken by hostile third parties and has created this standard to reduce the risk of data loss.
The CyberAB has stated that they expect the first contracts to require CMMC to begin in 2025. CMMC requires that a company shows proof of performance over time. That means to expect that, at a minimum, it will take 6 months to be ready to get assessed.