CMMC FAQs

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense program that verifies whether defense contractors protect the information they handle for DoD. It is set out in 32 CFR Part 170 and enforced through contract clauses in the DFARS. It applies to prime contractors and to subcontractors at every tier that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

As of October 2026, CMMC is in Phase 1. Since November 10, 2025, DoD solicitations can require a CMMC Level 1 or Level 2 self-assessment, posted in SPRS with an annual affirmation, as a condition of award.

Phase 2 would have made Level 2 certification by an authorized third-party assessor (C3PAO) the standard requirement starting November 10, 2026. On July 13, 2026, DoD suspended Phase 2 and later phases while a CMMC Reform Task Force reviews the program. The review period closed in September 2026, and no new timeline has been announced. We will update this page when it is.

No. The suspension paused the third-party certification requirement. It did not remove the obligations you already have:

• DFARS 252.204-7012 still requires you to protect covered defense information and report cyber incidents.
• The 110 requirements of NIST SP 800-171 still apply to systems that handle CUI.
• Self-assessment scores must still be posted in SPRS, with an annual affirmation of continued compliance.

An inaccurate score or affirmation carries False Claims Act risk, and DoD has continued to settle cases over NIST SP 800-171 gaps. Many prime contractors have also kept their expectations of suppliers in place. The safest plan is to keep preparing as if third-party certification is coming.

The Defense Industrial Base (DIB) is the network of companies that research, design, produce, deliver, or maintain products and services for the U.S. military. Machine shops, parts suppliers, engineering firms, and software providers that work on DoD contracts or subcontracts are all part of it.

• Level 1: 15 basic safeguarding requirements from FAR 52.204-21, for companies that handle FCI only. Verified by annual self-assessment.
• Level 2: the 110 requirements of NIST SP 800-171 Rev. 2, for companies that handle CUI. Verified by self-assessment or by a C3PAO, depending on the contract.
• Level 3: Level 2 plus selected requirements from NIST SP 800-172, for the most sensitive CUI programs. Assessed by the government.

The solicitation tells you. DoD states the required level and assessment type in the solicitation through DFARS 252.204-7025. As a rule of thumb, if you only receive FCI you need Level 1, and if you receive or create CUI you need Level 2. Your prime contractor should also tell you what flows down to you.

Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release. Purchase orders, contract details, emails with your contracting officer, and delivery schedules are common examples.

Controlled Unclassified Information is government information that requires safeguarding under law, regulation, or policy, but is not classified. Technical drawings, specifications, export-controlled data, and some test results are common examples for manufacturers. The DoD CUI Program site lists the official categories.

If you handle FCI but not CUI, you need Level 1: meet the 15 FAR 52.204-21 requirements, complete the self-assessment, and post an annual affirmation in SPRS.

Yes, if you handle FCI or CUI for the contract. Primes must flow CMMC requirements down to subcontractors at the level that matches the information the subcontractor receives.

No. CMMC does not apply to contracts or subcontracts solely for commercially available off-the-shelf (COTS) items.

Level 2 follows the 14 requirement families of NIST SP 800-171: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

CMMC Level 2 is NIST SP 800-171. The requirements are the same 110 controls. CMMC adds the verification: how you are assessed, who assesses you, how the results are recorded, and the annual affirmation.

Yes. Level 1 is always a self-assessment. Level 2 can be a self-assessment or a C3PAO assessment, depending on what the contract requires. While Phase 2 is suspended, most Level 2 requirements are being met through self-assessment.

The Supplier Performance Risk System (SPRS) is where contractors post their assessment results. A senior official at your company must also affirm each year that you continue to meet the requirements. Contracting officers check SPRS before award.

A Plan of Action and Milestones (POA&M) lists requirements you have not yet met and when you will meet them. Level 1 does not allow one; all 15 requirements must be met. Level 2 allows a limited POA&M: you must score at least 88 of 110, certain higher-weighted requirements cannot be deferred, and open items must be closed within 180 days.

Choose an authorized C3PAO from The Cyber AB Marketplace, schedule the assessment, and provide evidence for each requirement. Results are recorded by DoD and your status appears in SPRS. A certification is valid for three years, with an annual affirmation in between. Even with Phase 2 paused, C3PAO assessments are still available for companies that want or are asked for one.

It depends on where you start. Level 1 can often be completed in weeks. Level 2 typically takes several months for a small company, longer if systems that handle CUI need to be rebuilt or separated. The fastest way to an answer is a gap assessment against NIST SP 800-171.

Cost depends on your level, the size of the environment that handles CUI, and how much remediation is needed. The contractor pays for its own preparation and assessment. Limiting where CUI lives, for example in a dedicated, well-scoped environment, is usually the biggest lever on cost.

No. Scores and assessment details are not public. DoD contracting officers can see your status in SPRS.

We help defense contractors get ready for CMMC and stay ready. Our own W-2 team handles Level 1 engagements and Level 2 readiness for smaller organizations, such as machine shops: gap assessment against NIST SP 800-171, remediation, documentation, your SPRS score, and ongoing compliance management as part of your managed IT. For large Level 2 readiness projects, we bring in a third-party compliance partner to work alongside our team. We do not perform certification assessments ourselves.

Not sure where you stand? Start with a free CMMC readiness planning session.