Current status: CMMC Phase 2 is suspended
On July 13, 2026, the Department of War (DoD) announced the suspension of CMMC Phase 2, which was scheduled to begin November 10, 2026. Program offices cannot designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments while it lasts, and contracting activities were directed to remove those requirements from solicitations and existing contracts. A CMMC Reform Task Force is reviewing the program, and no restart date has been announced. Read the DoD announcement.
The suspension does not withdraw the program rule. Level 1 and Level 2 self-assessments, SPRS reporting, annual affirmations, DFARS 252.204-7012 and NIST SP 800-171 Revision 2 all continue to apply where your contracts require them, and primes can keep their own third-party requirements. This status was last checked on November 6, 2026.
CMMC — the Cybersecurity Maturity Model Certification — is a Department of Defense program that verifies whether a contractor is protecting two kinds of government information: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The program is established in federal regulation at 32 CFR part 170, and it reaches contractors through a clause in the solicitations and contracts they bid on.
The part that trips people up is that CMMC does not invent new cybersecurity requirements. It verifies compliance with requirements that already existed. If your company holds a DoD contract containing DFARS 252.204-7012 and handle covered defense information, you have been obligated to implement the 110 security requirements in NIST SP 800-171 since that clause first appeared in your contract. What CMMC adds is a mechanism to check.
What actually changed
Before CMMC, compliance with the DoD's cybersecurity requirements was largely self-attested. A contractor signed a contract containing DFARS 252.204-7012, thereby representing that it had implemented NIST SP 800-171, and in most cases nobody checked. Later clauses required contractors to compute a score against the NIST requirements and post it to the Supplier Performance Risk System, but that score was still self-reported.
CMMC changes the consequence of that representation. A contractor must perform a self-assessment and formally affirm it or, under the program's full design, undergo an assessment by an authorized third party before award. DoD suspended new third-party requirements in July 2026, but the self-assessment and affirmation obligations remain. An inaccurate affirmation is no longer a quiet gap in a file. It is a statement made to the government by a senior company official.
This is the practical takeaway for most small contractors
If you have been treating NIST SP 800-171 as aspirational, the obligation did not change — the likelihood of it being examined did. Companies that discover this during a bid rather than before one tend to lose the bid.
The three levels
Which level applies is determined by the contract, based on the sensitivity of the information involved. You do not choose your level; the requirement does.
| Level 1 | Level 2 | Level 3 | |
|---|---|---|---|
| Protects | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) | CUI on the highest-priority programs |
| Requirements drawn from | FAR 52.204-21 (15 requirements) | NIST SP 800-171 Revision 2 (110 requirements) | A subset of NIST SP 800-172, on top of Level 2 |
| How it is assessed | Self-assessment | Self-assessment or third-party (C3PAO) assessment, depending on the contract | Government assessment (DCMA DIBCAC), after a Final Level 2 (C3PAO) status |
| How often | Every year | Every three years, with annual affirmation | Every three years, with annual affirmation |
| Who it typically affects | Nearly every DoD contractor | Contractors that receive or generate CUI | A small subset of the defense industrial base |
Levels, requirement counts and assessment types are set out in 32 CFR part 170. New Level 2 (C3PAO) and Level 3 requirements are suspended as of this update. Confirm the current text before relying on any specific figure.
Most small and mid-sized companies land at Level 1 or Level 2, and the distinction between them matters enormously. It is the difference between a checklist you can work through internally and a substantial program that often needs outside help.
Who the program applies to
CMMC follows the information, not the size of the company. The relevant questions are what you handle and what your contract says.
- Prime contractors holding DoD contracts. If the contract contains the CMMC clause, the requirement applies before award, not after.
- Subcontractors at any tier. Your level follows the information you handle. FCI points to Level 1. CUI points to at least Level 2 (Self), or Level 2 (C3PAO) when the prime's requirement calls for it. Primes can also screen suppliers on their own timeline, so this can cost you subcontract work before it affects a prime award.
- Suppliers who never touch a DoD network. Handling FCI is enough to bring Level 1 into scope, and FCI is far more common than most companies assume. See our guide on the difference between CUI and FCI.
One notable carve-out
Acquisitions exclusively for commercially available off-the-shelf (COTS) items are treated differently under the program rule. If you believe you fall into that category, confirm it against the rule text and your contracting officer rather than assuming it.
How CMMC reaches you through a contract
The program becomes real through a chain of contract clauses. Reading them in your own contracts is the fastest way to understand your obligation.
- 1
FAR 52.204-21 establishes the baseline
The basic safeguarding clause defines Federal Contract Information and imposes 15 security requirements on systems that process it. It applies far beyond DoD. Read it at acquisition.gov.
- 2
DFARS 252.204-7012 adds the CUI obligation
Where a contract involves covered defense information, this clause requires implementation of NIST SP 800-171 and rapid cyber incident reporting. It appears in nearly every DoD contract except those solely for COTS items, so its presence alone does not show that you handle CUI.
- 3
DFARS 252.204-7019 and -7020 add scoring and access
These require a self-assessment scored against the NIST methodology and posted to SPRS, and give the government the right to conduct higher-level assessments.
- 4
DFARS 252.204-7021 adds verification as a condition of award
Where a solicitation includes this clause, along with the 252.204-7025 notice, meeting the specified level and affirming it in SPRS becomes a precondition of the award rather than a promise about future behavior. The clause also flows down to subcontracts that involve FCI or CUI.
If you want to know whether CMMC affects you, do not start with the program documentation. Start with your existing contracts and search them for these clause numbers.
The rollout is phased, and Phase 2 is suspended
The program was designed to phase in over several years. Phase 1 began on November 10, 2025, with Level 1 and Level 2 self-assessments. Phase 2 was due to add Level 2 (C3PAO) requirements on November 10, 2026, with later phases running through November 2028.
DoD suspended Phase 2 in July 2026 and has not announced a restart date. Two practical consequences follow. First, a suspended requirement is not a repealed one. The program rule remains in place, so third-party assessment may return, possibly in a different form. Second, the suspension changes less than it appears to: self-assessments, affirmations and DFARS 252.204-7012 still apply, and a prime can still ask for more than DoD does.
Verify current phase timing before you plan around it
Implementation dates have moved before and specific phase details are the part of this program most likely to be out of date in any article, including this one. Check the DoD CIO CMMC program page for the current schedule.
Four things CMMC is not
Most confusion about CMMC comes from a handful of persistent misunderstandings.
- It is not a certification you buy. There is no product, subscription or tool that makes a company compliant. Assessment examines your actual implemented practices and the evidence behind them.
- It is not permanent once achieved. Level 1 is repeated every year, Level 2 and Level 3 assessments run on a three-year cycle, and affirmations are annual. A system that drifts out of compliance between assessments is a real risk, not a theoretical one.
- It is not only about IT. A meaningful share of the requirements concern policy, training, access management and physical controls. Handing the whole problem to an IT vendor without changing how the company operates rarely produces a passing result.
- It is not a reason to avoid DoD work. The requirement applies to your competitors identically. For a small company that gets there early, it is a barrier that works in your favor.
Where this fits in your pipeline
CMMC is a gate on defense work, which makes it a business development question as much as a compliance one. The level you need is driven by the contracts you intend to pursue — so the sensible order is to understand which DoD work you are actually going after, then scope compliance to that.
Research the DoD work you are targeting
- Federal Agency Profiles
See which defense agencies and buying offices actually purchase what you sell.
- Contract Awards Explorer
Look at historical awards in your NAICS to understand which programs involve CUI-bearing work.
- Opportunity Explorer
Read current solicitations and check them for the safeguarding clauses described above.
Sources
- 32 CFR Part 170 — CMMC Program — The rule that establishes the CMMC program, its levels and assessment types
- DoD CIO — CMMC Program — DoD's official CMMC program office and documentation library
- NIST SP 800-171 Revision 2 — The version 32 CFR part 170 incorporates and the source of the 110 requirements, although NIST has since published Revision 3
- FAR 52.204-21 — Basic Safeguarding of Covered Contractor Information Systems — defines FCI
- DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting
- DFARS Subpart 204.73 — Prescribes when 252.204-7012, -7019 and -7020 are used
- DFARS 252.204-7021 — The CMMC contract clause, including subcontract flow-down
- The Cyber AB — Accreditation body; authoritative registry of authorized C3PAOs and RPOs
- Department of War: CMMC Phase II suspension announcement — July 2026 announcement suspending Phase 2 requirements