These are the cybersecurity requirements that government contractors and their subcontractors have been following since 2003. The CMMC was recently created to enhance this already existing compliance, in conjunction with the Defense Federal Acquisition Regulation Supplement (DFARS) requirements.