A sophisticated and sustained cyberattack, often carried out by nation-state actors or well-resourced adversaries. APTs aim to infiltrate systems and remain undetected for long periods, stealing sensitive data such as defense designs, intellectual property, or government information. CMMC was developed in part to ensure contractors handling CUI can defend against threats at this level.