The CMMC is a certification procedure developed by the Department of Defense (DoD) to certify contractors have the controls to protect sensitive data including Federal Contract Information, Controlled Unclassified Information (CUI) and Customer Attributed Data (CAD).