CMMC 2.0 Compliance Guide for Defense Contractors

If you make parts, write software or provide services for the Department of Defense, a new line is showing up in solicitations: a required CMMC level. Without the right status in the government’s system, you can’t win the award, and in many cases you can’t keep exercising options on an existing contract either.

CMMC, the Cybersecurity Maturity Model Certification program, is no longer a future concern. The program rule took effect in December 2024, the contract clause rule took effect in November 2025, and the next phase, which brings third-party Level 2 assessments into solicitations, begins November 10, 2026. This guide explains the levels, the assessments and the practical first steps for small DoD suppliers.

This is not legal advice. Confirm your specific obligations with your contracting officer and your own counsel.

What CMMC is and why it exists

CMMC checks whether defense contractors actually protect 2 kinds of information:

• Federal Contract Information (FCI): information provided by or generated for the government under a contract that isn’t meant for public release.
• Controlled Unclassified Information (CUI): more sensitive information that requires safeguarding under law, regulation or government-wide policy, such as certain technical drawings or specifications.

Contractors handling CUI have had to implement NIST SP 800-171 for years under DFARS clause 252.204-7012. The problem was verification: many companies self-reported compliance without consistent checks. CMMC adds assessments, scores and annual affirmations by a senior company official.

The program has 2 legal pieces:

1. 32 CFR Part 170, the CMMC Program rule, published October 15, 2024 and effective December 16, 2024. It defines the levels, assessments and scoring.
2. The DFARS acquisition rule (48 CFR), published September 10, 2025 and effective November 10, 2025. It puts CMMC requirements into contracts through clauses such as DFARS 252.204-7021 and 252.204-7025.

The Defense Department is also now styled the Department of War in some official materials, so you may see both names on program websites.

The 3 CMMC levels

	Level 1	Level 2	Level 3
Information protected	FCI	CUI	CUI facing advanced threats
Requirements	15 safeguards from FAR 52.204-21	110 requirements from NIST SP 800-171 Rev 2	Level 2 plus 24 requirements from NIST SP 800-172
Who assesses	Self-assessment	Self-assessment for some contracts; certified third party (C3PAO) for most	DCMA DIBCAC (government assessors)
How often	Every year	Every 3 years	Every 3 years
Affirmation	Annual	Annual	Annual
POA&M allowed?	No	Yes, limited, closed within 180 days	Yes, limited, closed within 180 days
Prerequisite	None	None	Final Level 2 (C3PAO) status

Level 1: basic safeguarding

Level 1 applies when you only handle FCI. You must meet the 15 basic safeguarding requirements in FAR 52.204-21, such as limiting system access to authorized users, identifying and authenticating users, sanitizing media before disposal, controlling physical access, and using malware protection. You self-assess every year and an affirming official confirms compliance. No plan of action is allowed. You must fully meet every requirement.

Level 2: protecting CUI

Level 2 is where most of the work lives. It aligns with the 110 security requirements in NIST SP 800-171 Revision 2. Depending on the contract, you’ll need either a Level 2 self-assessment or a Level 2 certification assessment by an authorized CMMC Third-Party Assessment Organization (C3PAO). Most contracts involving CUI are expected to require the third-party version.

Level 3: advanced threats

Level 3 is for a smaller set of programs facing advanced persistent threats. You must first hold a final Level 2 (C3PAO) status, then pass an assessment by the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) against 24 additional requirements from NIST SP 800-172.

Key takeaway: Your level is set by the information you handle, not your company size. If you only touch FCI, Level 1 is a manageable annual self-assessment. If CUI touches your systems, plan for Level 2 and a third-party assessment.

The rollout timeline

32 CFR 170.3 phases CMMC in over 4 years, starting from the effective date of the DFARS rule. Each phase begins 1 year after the previous one.

Phase	Start date	What changes
Phase 1	November 10, 2025	Level 1 (Self) and Level 2 (Self) in applicable solicitations
Phase 2	November 10, 2026	Level 2 (C3PAO) certification added as a condition of award, and some Level 3
Phase 3	November 10, 2027	Level 2 (C3PAO) required for option periods too; Level 3 expanded
Phase 4	November 10, 2028	Full implementation in all applicable solicitations and contracts

DoD has some discretion within each phase, including requiring a higher level early. If you’re bidding on new work, read each solicitation carefully rather than relying on the phase schedule alone.

How assessments, scores and POA&Ms work

Scoring and SPRS

Level 2 and Level 3 assessments use a scoring method in which each requirement carries a point value. Results go into the Supplier Performance Risk System (SPRS), where contracting officers check them before award.

Conditional status and POA&Ms

You don’t need a perfect score on day one at Levels 2 and 3, but the rules are strict. Under 32 CFR 170.21:

• Minimum score: You must reach at least 80% of the total possible score to get conditional status.
• Limited items only: Most requirements worth more than 1 point can’t be deferred to a plan of action and milestones (POA&M). There’s a narrow exception for encryption that’s in place but not FIPS-validated.
• Some items can never be deferred, including your System Security Plan and several physical access and external connection requirements at Level 2.
• 180-day deadline: Open items must be closed and confirmed in a POA&M closeout assessment within 180 days. If not, conditional status expires.

At Level 1, no POA&M is permitted at all.

Annual affirmations

At every level, a senior official must affirm continued compliance each year. Missing an affirmation causes your status to lapse. Affirmations carry real legal weight, since false statements to the government can create False Claims Act exposure.

Where to start: 7 steps for small suppliers

1. Find out what information you actually handle

Review your contracts for DFARS 252.204-7012, look at CUI markings on documents you receive and ask your prime contractor what level they expect to flow down. Many small firms discover they handle CUI through a single drawing package or email thread.

2. Shrink your scope

The fewer systems that touch CUI, the smaller your assessment. Common approaches include a separate enclave for CUI work, a dedicated cloud tenant built for government data, or keeping CUI off general-purpose laptops. Scoping decisions made early save the most money.

3. Do a gap assessment against NIST SP 800-171

Walk through each requirement and record whether it’s met, partly met or not met. Use the DoD scoring method to estimate your score. Free tools from Project Spectrum, a program of the DoD Office of Small Business Programs, include a cyber readiness check aligned with NIST SP 800-171 and CMMC.

4. Write your System Security Plan

The SSP describes your environment, boundary and how each requirement is met. It’s mandatory and can’t sit on a POA&M, so start it early.

5. Fix the high-value gaps

Common gaps for small contractors include:

• Multi-factor authentication for remote and privileged access. Our guide to multi-factor authentication covers the options.
• Audit logging that’s actually reviewed.
• FIPS-validated encryption for CUI at rest and in transit.
• Incident response procedures, including DoD reporting obligations. See our guide to creating an incident response plan.
• Security awareness training, ideally with CUI-specific content. Our security awareness training guide helps.
• Configuration and account management, including prompt removal of access when people leave. Use our offboarding checklist.

6. Check your cloud and IT providers

If a cloud service stores or processes CUI, DFARS rules expect it to meet FedRAMP Moderate or an equivalent baseline. Managed service providers that touch CUI systems can fall into your assessment scope. If you’re choosing outside help, our guide to choosing a managed IT service provider lists the questions to ask, and our Microsoft 365 security guide is relevant if you run on that platform.

7. Book your assessment early

The pool of authorized C3PAOs is limited and demand rises with each phase. Find an authorized C3PAO through the Cyber AB marketplace, and schedule well before a solicitation you care about closes.

How much CMMC costs

Costs depend on your scope, your current maturity and the level required. The main buckets are:

• Remediation: tools and configuration work to close gaps, often the largest cost.
• Documentation: writing the SSP, policies and procedures, internally or with a consultant.
• Assessment fees: C3PAO fees for Level 2 certification, which vary by scope and assessor.
• Ongoing operation: monitoring, log review, training, annual affirmations and the 3-year reassessment.

Narrow scoping is the most reliable way to control all 4. DoD published its own cost estimates in the rulemaking, but your real number depends on how many systems and people touch CUI.

How CMMC relates to other frameworks

CMMC Level 2 is built on NIST SP 800-171, which overlaps with the NIST Cybersecurity Framework and commercial standards like ISO 27001. Existing certifications don’t replace a CMMC assessment, but they give you policies and controls to reuse. If you also serve commercial customers, our comparison of ISO 27001 vs SOC 2 explains how those fit.

The bottom line

CMMC is now part of DoD contracting, and with Phase 2 starting November 10, 2026, third-party Level 2 assessments will show up in more solicitations. Figure out whether you handle FCI or CUI, keep your CUI footprint small, write your SSP, close the high-value gaps and book an assessor early. Small suppliers that start now can keep their defense work instead of losing it at the award stage.

Sources

• Federal Register: CMMC Program final rule, 32 CFR Part 170 (October 15, 2024) — program rule and December 16, 2024 effective date
• Federal Register: DFARS CMMC acquisition final rule (September 10, 2025) — contract clauses effective November 10, 2025
• 32 CFR 170.3 (Cornell LII) — 4-phase implementation schedule
• 32 CFR 170.21 (Cornell LII) — POA&M rules, 80% minimum score and 180-day closeout
• DoD CIO: About CMMC — levels, requirement counts, assessment frequency and affirmations
• DoD Office of Small Business Programs: Be Cyber Smart — Project Spectrum and free cybersecurity resources for small businesses