Adobe achieves Cybersecurity Maturity Model Certification

Adobe is proud to announce that it has successfully achieved Cybersecurity Maturity Model Certification (CMMC) Level 1. This milestone underscores Adobe’s commitment to supporting the resilience of critical public sector services and the defense industrial base at a time of continued cybersecurity risks.

What is CMMC, and what does level 1 mean?

CMMC is a framework developed by the Department of Defense (DoD) to help ensure the protection of sensitive unclassified information processed by commercial defense contractors and subcontractors such as Adobe. DoD is phasing CMMC requirements into certain defense contracts, including renewals, starting Nov. 2025.

CMMC establishes a three-tiered model of cybersecurity requirements, ranging from basic safeguards to advanced protections against sophisticated threats. CMMC Level 1 focuses on the protection of Federal Contract Information (FCI). FCI is information that is not intended for public release, provided or generated under a government contract, excluding publicly available data. CMMC Levels 2 and 3 will be phased into defense contracts in 2026 and 2027, respectively.

What this means for Adobe

Achieving CMMC Level 1 certification is an important milestone for Adobe as a trusted public sector contractor. There are tens of thousands of businesses that are a part of the US defense industrial base. CMMC not only addresses Adobe's compliance in working with DoD but also supports the other commercial contractors that utilize Adobe products in their support of DoD. This certification validates Adobe’s implementation of enterprise-wide safeguards to help ensure that our systems processing, storing, or transmitting FCI are secure and compliant.

By meeting these and other requirements, Adobe has again demonstrated its commitment to protecting sensitive information and supporting the DoD’s mission. This also reflects Adobe’s alignment with a wide variety of other security frameworks and best practices, as showcased in Adobe’s publicly available Common Control Framework.

Next steps toward CMMC level 2

While achieving Level 1 is a critical step, CMMC Level 2 will be phased into upcoming contracts as well. CMMC Level 2 focuses on the protection of Controlled Unclassified Information processed as part of a defense contract, such as information related to privacy, proprietary business records, technical reports, and other sensitive data.

CMMC Level 2 incorporates security requirements from NIST SP 800-171, requiring a more comprehensive assessment to achieve certification. Adobe is already laying the groundwork to demonstrate compliance with this next phase and further solidify Adobe’s position as a trusted public sector partner.

Continued excellence in the public sector

Adobe helps the public sector meet their demand for AI-powered digital services and operational efficiencies while also maintaining the security government agencies need to achieve mission success. As a leading provider of secure solutions for the public sector, Adobe is proud to contribute to the resilience of the defense industrial base.

Adobe’s CMMC Level 1 certification is more than a compliance milestone – it is a testament to our longstanding dedication to enterprise cybersecurity excellence. As we continue our journey toward higher levels of CMMC certification, Adobe remains steadfast in its mission to deliver secure, innovative solutions that empower the public sector. For other commercial defense contractors pursuing CMMC, Adobe has products with FedRAMP Moderate verified security controls – including Adobe Experience Manager, Adobe Acrobat Sign, and Adobe Connect – making them a strong foundation for CMMC compliance, and organizations can inherit their security benefits. More information about the security posture of all Adobe products and services can be found on the Adobe Trust Center.