Current status: CMMC Phase 2 is suspended
On July 13, 2026, the Department of War (DoD) announced the suspension of CMMC Phase 2, which was scheduled to begin November 10, 2026. Program offices cannot designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments while it lasts, and contracting activities were directed to remove those requirements from solicitations and existing contracts. A CMMC Reform Task Force is reviewing the program, and no restart date has been announced. Read the DoD announcement.
The suspension does not withdraw the program rule. Level 1 and Level 2 self-assessments, SPRS reporting, annual affirmations, DFARS 252.204-7012 and NIST SP 800-171 Revision 2 all continue to apply where your contracts require them, and primes can keep their own third-party requirements. This status was last checked on November 6, 2026.
At a glance
Both levels are defined in 32 CFR part 170. Check the current rule text before planning against any specific figure below.
| Level 1 | Level 2 | |
|---|---|---|
| Protects | Federal Contract Information | Controlled Unclassified Information |
| Requirements | 15, from FAR 52.204-21 | 110, from NIST SP 800-171 Revision 2 |
| Assessment | Self-assessment | Self-assessment or C3PAO assessment, per the contract (new C3PAO requirements are suspended) |
| How often | Every year | Every three years |
| Affirmation | With each annual assessment, by the Affirming Official | At each assessment and annually, by the Affirming Official |
| Partial compliance allowed? | No — all requirements must be met | Limited; a score of at least 80% is required, and eligible open items must close within 180 days |
| Typical effort | Weeks of focused internal work for a small, simple environment | Months, usually with outside help and system changes |
| Outside cost | Usually none beyond internal time | Assessment fees, and commonly consulting or managed services |
What Level 1 actually asks of you
Level 1 maps to the basic safeguarding requirements in FAR 52.204-21. These are foundational practices: limiting system access to authorized users, controlling who can perform what actions, sanitizing media before disposal, limiting physical access, monitoring and controlling connections at network boundaries, applying updates, and running malware protection.
None of it is exotic. A company running a modern, well-managed environment is often close to meeting these already, and the work is frequently more about proving and documenting what you do than changing it.
Two aspects still catch people out. There is no partial credit — all applicable requirements must be met, so a single unaddressed item is disqualifying rather than a deduction. And the annual affirmation is a formal representation to the government made by a named official, not an internal checkbox.
What Level 2 actually asks of you
Level 2 is built on the 110 requirements in NIST SP 800-171, organized across families covering access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.
The requirement count understates the work. Level 2 expects a System Security Plan describing how each requirement is met in your specific environment, evidence that the described controls are actually operating, and a Plan of Action and Milestones for anything not yet in place. Where the contract calls for a third-party assessment, an authorized assessor examines that evidence rather than accepting your description of it.
Requirements worth starting early
For small companies the hard ones are rarely the firewall rules. They tend to be multifactor authentication applied consistently, audit logging that is actually reviewed rather than merely collected, FIPS-validated cryptography where required, and the discipline of keeping the System Security Plan accurate as the environment changes.
The POA&M difference
A Plan of Action and Milestones is the formal record of requirements you have not yet met and how you intend to close them. The two levels treat POA&Ms very differently, and this is one of the most consequential distinctions between them.
At Level 1, there is no room for one. Every applicable requirement must be met at the time of the assessment and affirmation.
At Level 2, a POA&M is allowed only if your score is at least 80% of the total and each open requirement is worth 1 point. The one exception is encryption that is in use but not FIPS-validated (SC.L2-3.13.11). Six requirements can never sit on a POA&M, including the System Security Plan and several physical access controls. A closeout assessment must confirm the fixes within 180 days of your Conditional CMMC Status Date, or the conditional status expires.
Do not build a plan around the POA&M allowance
A POA&M is a short bridge to closeout, not a way to carry gaps. Confirm the full rules in 32 CFR part 170 rather than relying on secondhand summaries — including this one.
Working out which level applies to you
You do not select a level. The contract specifies it, based on the information you will handle. The sequence for figuring it out is short.
- 1
Determine whether you handle CUI at all
This is the decisive question, and it is answered by the information itself rather than by your preferences. If you handle only FCI, Level 1 is the likely requirement. If CUI is genuinely in play, Level 2 is.
- 2
Read the solicitations you intend to bid
Where a CMMC requirement applies, the solicitation states the required level. Bidding is the point at which the obligation becomes concrete, so look at the pursuits you actually intend to make.
- 3
Ask your primes what they will flow down
Subcontract work can impose a Level 2 requirement on a company whose prime contracts would only ever have required Level 1. Ask explicitly what data types each prime intends to share.
- 4
Scope the environment before you cost the work
If Level 2 applies, decide early where CUI will live. Consolidating it into a deliberately bounded enclave reduces the systems subject to assessment, and that decision typically moves cost more than any other.
Notice that three of these four steps are business development questions rather than IT questions. Which contracts you pursue determines the compliance you need — which is why scoping CMMC without a clear view of your pipeline tends to produce either overspending or an unpleasant surprise.
Scope the level to the pipeline
Before committing to a Level 2 program, get specific about which defense work you are actually going after and whether it involves CUI-bearing requirements.
Research before you scope
- Opportunity Explorer
Read live solicitations in your space and check the safeguarding and CMMC requirements they carry.
- Contract Awards Explorer
Look at who has won similar work and what kind of programs it sits within.
- Federal Contractor Directory
Identify primes whose supply chain you might join, then ask what they flow down.
Sources
- 32 CFR Part 170 — CMMC Program — The rule that establishes the CMMC program, its levels and assessment types
- NIST SP 800-171 Revision 2 — The version 32 CFR part 170 incorporates and the source of the 110 requirements, although NIST has since published Revision 3
- FAR 52.204-21 — Basic Safeguarding of Covered Contractor Information Systems — defines FCI
- DoD CIO — CMMC Program — DoD's official CMMC program office and documentation library
- The Cyber AB — Accreditation body; authoritative registry of authorized C3PAOs and RPOs
- Department of War: CMMC Phase II suspension announcement — July 2026 announcement suspending Phase 2 requirements