All companies, no matter how small or what product or service they provide, will have to be assessed and certified by a third-party auditor before they can submit a proposal according to the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)).

​

Different contractors will be held to different standards. There are five Cybersecurity Maturity levels depending on the expectations placed on the contractor for handling certain information.

​

These levels are cumulative, meaning that to achieve any level, a contractor will need to fulfill all the requirements for the levels before it.