What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) Program is how the US Department of Defense verifies that companies in the defence industrial base have implemented required cybersecurity protections for:
- Federal Contract Information (FCI): information provided by or generated for the government under a contract and not intended for public release;
- Controlled Unclassified Information (CUI): information requiring safeguarding under law, regulation or government-wide policy.
CMMC has two regulatory parts. The program rule (32 CFR Part 170) defines levels and assessments. The acquisition rule (DFARS clause 252.204-7021) puts CMMC requirements into contracts and took effect on 10 November 2025, starting Phase 1.
Purpose and objectives
Before CMMC, contractors mostly self-attested to implementing NIST SP 800-171 under DFARS 252.204-7012. Government reviews found inconsistent implementation. CMMC adds verification: self-assessments with senior-official affirmation, independent certification by accredited assessors, or government-led assessments, depending on the sensitivity of the information.
Who does it apply to?
Prime contractors and subcontractors at every tier that will process, store or transmit FCI or CUI on contractor information systems in performance of a DoD contract. Requirements flow down to subcontractors at the level appropriate to the information they handle.
The CMMC levels
| Level | Information | Requirements | Assessment |
|---|---|---|---|
| Level 1 | FCI | 15 basic safeguarding requirements from FAR 52.204-21 | Annual self-assessment and affirmation |
| Level 2 | CUI | 110 security requirements of NIST SP 800-171 Rev. 2 | Self-assessment or C3PAO certification assessment (every three years), with annual affirmation |
| Level 3 | CUI for higher-priority programmes | Level 2 plus selected requirements from NIST SP 800-172 | Government-led assessment by DIBCAC, after a Level 2 certification |
Phased implementation and the 2026 suspension
The acquisition rule set a four-phase rollout:
| Phase | Original start | Content | Status (October 2026) |
|---|---|---|---|
| 1 | 10 November 2025 | Level 1 and Level 2 self-assessments in applicable solicitations | In effect |
| 2 | 10 November 2026 | Level 2 C3PAO certification required at award for applicable contracts | Suspended (announced 13 July 2026) |
| 3 | 10 November 2027 | Level 3 and wider certification requirements | Suspended |
| 4 | 10 November 2028 | Full implementation | Suspended |
On 13 July 2026 the Department announced that Phase 2 was suspended. It directed that solicitations include only self-assessment requirements during the pause, and set up a CMMC Reform Task Force to carry out a 60-day review of the programme. The Department said self-assessment requirements remain in place and that the action does not remove the requirement to protect federal data.
Core requirements in practice
Level 2 maps to the 14 families of NIST SP 800-171 Rev. 2: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.
Key process elements include:
- a system security plan (SSP) describing the assessment scope and how each requirement is met;
- scoping of assets: CUI assets, security protection assets, contractor risk-managed assets, specialised assets and out-of-scope assets;
- posting assessment results to SPRS;
- affirmation by a senior company official, initially and annually;
- for cloud services handling CUI, the FedRAMP Moderate (or equivalent) requirements of DFARS 252.204-7012.
Key terminology
| Term | Meaning |
|---|---|
| FCI | Federal Contract Information: non-public information provided by or generated for the government under a contract |
| CUI | Controlled Unclassified Information: information requiring safeguarding or dissemination controls under law, regulation or policy |
| C3PAO | CMMC Third-Party Assessment Organization, authorised to perform Level 2 certification assessments |
| DIBCAC | The Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center, which performs Level 3 assessments |
| SPRS | Supplier Performance Risk System, where assessment results and affirmations are recorded |
| ESP | External service provider: a third party providing IT or security services that touch the assessment scope |
| Enclave | A segmented environment built to contain CUI and limit assessment scope |
Implementation lifecycle
- Identify FCI and CUI you receive or generate, and the contracts involved.
- Define the boundary. Consider an enclave to limit scope.
- Gap-assess against FAR 52.204-21 and NIST SP 800-171 Rev. 2.
- Write the SSP and remediate gaps, keeping a POA&M only where the rules allow.
- Self-assess using the official assessment methodology, then post the score to SPRS and affirm.
- Prepare for certification. C3PAO assessments remain available voluntarily, and readiness reduces risk if requirements return.
- Maintain. Annual affirmations, continuous monitoring and change management.
Evidence and documentation
Assessors and government reviewers look for the SSP, network and data-flow diagrams, asset inventories with scoping categories, policies and procedures for each family, configuration baselines, access and audit log reviews, incident response records including DFARS reporting, training records, vulnerability management records and the POA&M.
Governance and accountability
The senior official’s affirmation makes cybersecurity status a matter of executive accountability. Inaccurate self-assessment scores or affirmations can create legal exposure. The US government has used the False Claims Act against contractors that misrepresented cybersecurity compliance. Keep scores supportable with evidence.
Common misconceptions and pitfalls
- “Phase 2 is paused, so we can wait.” Underlying DFARS and NIST SP 800-171 obligations, self-assessments and affirmations continue.
- Over-scoping. Letting CUI spread across the whole corporate network makes compliance far harder.
- SSP written but not implemented. Assessments test practice, not just documentation.
- Cloud services without FedRAMP Moderate or equivalent status for CUI.
Relationship with other frameworks
| Framework | Relationship |
|---|---|
| NIST SP 800-171 | The source of Level 2 requirements (Rev. 2 for CMMC) |
| DFARS 252.204-7012 | The underlying safeguarding and incident-reporting clause that continues to apply |
| FedRAMP | Cloud services used for CUI must meet FedRAMP Moderate or equivalent requirements |
| NIST SP 800-53 | The federal control catalogue from which SP 800-171 requirements were derived |
Open questions and items to watch
Points that were unsettled, contested or likely to change when this page was last reviewed. Check the official sources before relying on them.
- The CMMC Reform Task Force's review was due in September 2026. When this page was reviewed, no final outcome, replacement schedule or rule change had been officially published. Officials had not ruled out significant changes to the programme.
- Contracting officers were directed to remove Phase 2 and later requirements from existing contracts by modification. Check each contract's actual clauses rather than assuming.
- NIST SP 800-171 Rev. 3 has been published by NIST, but the Department continues to require Rev. 2 for DFARS 252.204-7012 and CMMC. Watch for any change.
Frequently asked questions
Does the Phase 2 suspension mean we no longer need to protect CUI?
No. The suspension paused mandatory third-party certification assessments at contract award. The Department stated that Phase 1 self-assessment requirements remain in place, and the DFARS 252.204-7012 obligations to safeguard covered defence information and report cyber incidents still apply. NIST SP 800-171 Rev. 2 continues to be enforced through self-assessments and selected government-led assessments.
What is the difference between a self-assessment and a certification assessment?
For Level 1 and some Level 2 contracts, the contractor assesses itself, posts the result in the Supplier Performance Risk System (SPRS) and has a senior official affirm compliance. A Level 2 certification assessment is performed by an authorised C3PAO. Level 3 assessments are performed by the government's DIBCAC.
Can we have open items and still meet a CMMC level?
The CMMC rule allows a limited plan of action and milestones for certain requirements, with conditional status and a deadline to close them out. Some requirements cannot be left open. The exact rules and scoring thresholds are in 32 CFR Part 170.
Why does the Department appear as both 'Defense' and 'War'?
In September 2025 the US Department of Defense began using 'Department of War' as a secondary title following an executive order. Statutes and regulations, including 32 CFR Part 170, still refer to the Department of Defense. Both names appear in current official materials.
Sources and official references
- Cybersecurity Maturity Model Certification (CMMC) — Office of the DoD Chief Information Officer (official source)
- 32 CFR Part 170 — CMMC Program — Electronic Code of Federal Regulations (National Archives) (official source)
- NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations — NIST Computer Security Resource Center (official source)
- Department of War Suspends CMMC Phase II Requirements — Office of Industrial Base Growth, US Department of War (official source)
- Pentagon Suspends CMMC Phase 2 Requirements and Launches Review — WilmerHale (secondary commentary)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with US Department of Defense (styled Department of War), Office of the DoD CIO; Cyber AB accredits third-party assessors.