CMMC for Government Contractors
The Cybersecurity Maturity Model Certification can decide whether you can compete for defense work. These guides explain what it requires, who it applies to, and how to size the obligation against the contracts you actually want.
Current status: CMMC Phase 2 is suspended
On July 13, 2026, the Department of War (DoD) announced the suspension of CMMC Phase 2, which was scheduled to begin November 10, 2026. Program offices cannot designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments while it lasts, and contracting activities were directed to remove those requirements from solicitations and existing contracts. A CMMC Reform Task Force is reviewing the program, and no restart date has been announced. Read the DoD announcement.
The suspension does not withdraw the program rule. Level 1 and Level 2 self-assessments, SPRS reporting, annual affirmations, DFARS 252.204-7012 and NIST SP 800-171 Revision 2 all continue to apply where your contracts require them, and primes can keep their own third-party requirements. This status was last checked on November 6, 2026.
Much of what is written about CMMC answers the technical question and skips the business one. These pages start with the business question, and our aim is to help you understand the actual requirements before you buy anything. The question underneath what is CMMC is almost always what does this mean for my company, and what will it cost me to keep bidding defense work.
GovCon In A Box publishes these guides to help contractors understand their obligations. Our parent company, Ironroot Holding, Inc., is developing separate cybersecurity services, so we have a commercial interest in this topic. We link to those services only where they are relevant. We cite primary sources, including DoD, NIST, the Cyber AB and acquisition.gov, so you can verify what you read here rather than take our word for it.
Start here
What Is CMMC?
The DoD program that verifies contractors are protecting federal contract information and CUI — and what it changes for your company.
Read the guideDo I Need CMMC?
A decision framework built on your own contracts and pipeline, not on general guidance about the program.
Read the guideCUI vs FCI
The distinction that sets your CMMC level — and the one contractors most often get wrong.
Read the guideCMMC Level 1 vs Level 2
What separates a 15-requirement self-assessment from a 110-requirement program.
Read the guideResearch the work behind the requirement
The level you need is driven by the contracts you intend to bid. These are the parts of the platform contractors use to work that out.
Sources
- Department of War: CMMC Phase II suspension announcement — July 2026 announcement suspending Phase 2 requirements
- DoD CIO — CMMC Program — DoD's official CMMC program office and documentation library
- 32 CFR Part 170 — CMMC Program — The rule that establishes the CMMC program, its levels and assessment types
- NIST SP 800-171 Revision 2 — The version 32 CFR part 170 incorporates and the source of the 110 requirements, although NIST has since published Revision 3
- The Cyber AB — Accreditation body; authoritative registry of authorized C3PAOs and RPOs
- NARA CUI Registry — The authoritative list of CUI categories
- APEX Accelerators — DoD-funded no-cost procurement assistance, including CMMC readiness help
Frequently Asked Questions
Start with the applicability question
Before scoping controls or talking to a provider, work out whether the program applies to you and at what level.