CMMC Compliance for Defense Contractors

What CMMC compliance means

CMMC compliance means holding the CMMC status your contract names, at the level it names, and affirming it in the Supplier Performance Risk System (SPRS) every year ⁶. CMMC mostly adds verification on top of rules that were already in defense contracts: the 15 basic safeguards in FAR 52.204-21 and the NIST SP 800-171 requirements in DFARS 252.204-7012 ⁷⁸.

Two rules make up the program people call CMMC 2.0:

• 32 CFR part 170, the program rule. Published October 15, 2024 and effective December 16, 2024, it sets the levels, the assessment types, scoring, plan of action rules and scoping ¹.
• The 48 CFR acquisition rule (DFARS Case 2019-D041). Published September 10, 2025 and effective November 10, 2025, it puts CMMC into solicitations and contracts through the clause at DFARS 252.204-7021 ⁹⁶.

Under the acquisition rule, for roughly the first three years after November 10, 2025 a CMMC requirement appears in a contract only when the program office decides to apply it. After that it is meant to apply whenever a contractor will process, store or transmit FCI or CUI on its own systems, with commercially available off-the-shelf awards excluded ⁹.

The rest of this guide covers the current status, what still applies, and how to work out your level. Each level has its own page: CMMC Level 1 requirements and CMMC Level 2 requirements.

CMMC timeline: Phase 1 in effect, Phase 2 suspended

CMMC is paused in Phase 1. DoD CIO states that "CMMC implementation is paused in Phase 1" after the Department announced on July 13, 2026 that Phase 2, scheduled for November 10, 2026, was suspended ².

As written in 32 CFR 170.3, the rollout had four phases ¹⁰¹:

1. Phase 1, from November 10, 2025: Level 1 (Self) or Level 2 (Self) as a condition of award.
2. Phase 2, one year later: Level 2 (C3PAO) certification added for applicable contracts.
3. Phase 3, one year after Phase 2: Level 3 (DIBCAC) added.
4. Phase 4, one year after Phase 3: full implementation.

What changed in 2026:

• July 13, 2026. DoD suspended Phase 2 and set up a review and reform task force with 60 days to conduct a top-to-bottom review. The CIO cited compliance costs and said the number of available assessors was not large enough to finish evaluations before the November deadline ¹¹.
• Implementing memo. Contracting officers may designate only CMMC Level 1 (Self) or Level 2 (Self). Level 2 (C3PAO) and Level 3 (DIBCAC) may not be designated, those requirements are to be removed from existing contracts by modification, and no waivers will be granted during the review ³.
• September 3, 2026. A revised class deviation kept the pause in contracting rules and told contracting officers to strip third-party assessment requirements from contracts, as reported by Washington Technology ¹².
• Late September 2026. No task force report and no Phase 2 restart date had been released ¹³.

There is no new date for Phase 2, 3 or 4. The schedule may change; check the DoD CIO About CMMC page before relying on any date ².

What still applies while Phase 2 is paused

Almost every cybersecurity obligation a defense contractor had before July 2026 still applies. DoD CIO says all Phase 1 self-assessment requirements "remain firmly in place" and that DoD will enforce NIST SP 800-171 Rev 2 during the pause ². The suspension memo also states that the DFARS 252.204-7012 requirements remain in effect ³.

In practice that means:

• Level 1 (Self) and Level 2 (Self) can still be conditions of award in new solicitations ³.
• DFARS 252.204-7012 still requires implementing NIST SP 800-171, reporting cyber incidents to DoD within 72 hours, and keeping images of affected systems for at least 90 days ⁸. Our incident response guide covers the first hours of a breach.
• SPRS scores still matter. DFARS 252.204-7019 requires a current NIST SP 800-171 assessment, no more than three years old, posted in SPRS, and DFARS 252.204-7020 bars primes from awarding covered subcontracts to a company without one ¹⁴¹⁵. The NIST 800-171 and SPRS guide explains the scoring.
• Annual affirmations continue. DFARS 252.204-7021 requires affirming continuous compliance in SPRS each year ⁶.

Affirmations and SPRS scores are statements to the government, which creates False Claims Act exposure if they are wrong. The risk is real: Honeywell Aerospace agreed to pay $2,042,518 on September 1, 2026 to settle a cybersecurity False Claims Act case tied to these obligations, as reported by Secureframe ¹⁶. Talk to counsel about your own position before you affirm.

FCI vs CUI: the data you hold decides your level

The type of information you handle sets your CMMC level. CMMC uses the existing federal definitions ¹⁷:

• Federal contract information (FCI) is information not intended for public release that is provided by or generated for the government under a contract to develop or deliver a product or service. It excludes information the government gives the public and simple transactional information such as that needed to process payments ¹⁸. FCI alone points to Level 1.
• Controlled unclassified information (CUI) is information the government creates or possesses, or that a company creates or possesses for the government, that a law, regulation or government-wide policy requires or permits to be safeguarded. It excludes classified information ¹⁹. CUI points to Level 2, and in a small number of cases Level 3.

Under DFARS 252.204-7012, covered defense information includes CUI that is marked or otherwise identified in the contract and provided to you, and CUI you collect, develop, receive, transmit, use or store in support of the contract ⁸. Drawings, specifications and technical data are common examples in manufacturing and architecture and engineering firms.

If you are unsure what you hold, map it before you buy anything. A cybersecurity risk assessment that traces where contract data lives is a sensible first step.

How to find out which CMMC level you need

Your contract or solicitation tells you. DFARS 252.204-7021 lists the CMMC level the contractor must have and maintain for the life of the contract, and requires primes to flow the right level down to subcontractors ⁶.

Work through it in this order:

1. Read the solicitation and contract. Look for DFARS 252.204-7021 and the level it names, plus FAR 52.204-21 and DFARS 252.204-7012, 7019 and 7020.
2. Ask your prime or contracting officer what information you will receive and which level they will flow down. During the suspension, only Level 1 (Self) or Level 2 (Self) may be designated ³.
3. Check what you actually receive. If you only handle FCI, plan for Level 1. If you receive or create CUI, plan for Level 2.
4. Treat Level 3 as rare. It requires Final Level 2 (C3PAO) status on the same scope first, then a DCMA DIBCAC assessment against 24 NIST SP 800-172 requirements ⁵.

Level 2 contracts come in two kinds: Level 2 (Self) and Level 2 (C3PAO). The rule's analysis estimated 8,350 medium and large entities would need a C3PAO assessment ¹. Our page on C3PAO assessments explains how they work and what is paused.

CMMC compliance checklist: what to do now

Use the pause to get your self-assessment right, because that is what contracts can require today. A practical order:

1. List your contracts and clauses and note which levels and DFARS clauses apply.
2. Map where FCI and CUI live, including email, file shares, laptops and any cloud service. Decide whether to protect the whole company or build a smaller CUI enclave; our GCC High and enclave guide covers the tradeoffs.
3. Self-assess against every requirement, with evidence: 15 for Level 1, 110 for Level 2, using the NIST SP 800-171A assessment objectives ²⁰.
4. Write or update your system security plan and plan of action, then post your score in SPRS.
5. Fix the highest-value gaps first. Requirements worth 5 points, and the items that can never sit on a plan of action, come before 1-point items ²¹²².
6. Get ready to report incidents. DFARS 7012 reports go through dibnet.dod.mil and require a DoD-approved medium assurance certificate ⁸.
7. Affirm only what is true, every year.
8. Budget for help and tools. See what CMMC costs and the types of CMMC compliance services, from consultants to managed security services and part-time security leadership through a vCISO.

If you want help, send a request through the form. We pass CMMC requests to an advisory partner, who contacts you by email. We are not a C3PAO or RPO and we do not assess anyone.