CMMC 2.0 Compliance Guide: Levels, Phases and 2026 Status

Last updated: 22 October 2026

Quick answer: CMMC 2.0 compliance means meeting the Level 1, 2 or 3 cybersecurity requirements that the Department of Defense attaches to contracts handling Federal Contract Information or Controlled Unclassified Information. Phase 1 self-assessments and SPRS affirmations apply today, while mandatory Level 2 third-party certification (Phase 2) was suspended in July 2026 pending review.

If you sell to the Department of Defense, directly or as a subcontractor, CMMC 2.0 compliance is no longer a planning exercise. The program rule has been in force since December 2024, the contract clause has been live since November 2025, and prime contractors are already asking suppliers for SPRS scores and affirmations.

At the same time, 2026 brought a major twist. In July, the Department (now styled the Department of War) suspended Phase 2 of the rollout and launched a reform review. This guide explains what is required, what is paused, and how to build a program that holds up whatever the review decides.

What is CMMC 2.0 compliance?

CMMC 2.0 compliance is the verified implementation of a defined set of safeguarding requirements on the contractor systems that process, store or transmit DoD contract information. It is a verification program layered on top of cybersecurity obligations most defense contractors already had under the FAR and DFARS.

The Cybersecurity Maturity Model Certification program is codified at 32 CFR Part 170. The final program rule was published on October 15, 2024 and took effect on December 16, 2024. It defines three levels, who assesses each one, how often, and how results are recorded in the Supplier Performance Risk System (SPRS).

The acquisition side followed with a DFARS rule. The DFARS final rule (Case 2019-D041) was published on September 10, 2025 and became effective on November 10, 2025. It updated DFARS 252.204-7021 and 252.204-7025 so that contracting officers can specify a required CMMC level in solicitations and contracts.

Two types of information drive the level

• Federal Contract Information (FCI): information provided by or generated for the government under a contract that is not intended for public release. FCI generally points to Level 1.
• Controlled Unclassified Information (CUI): information that requires safeguarding under law, regulation or government-wide policy, such as controlled technical information. CUI points to Level 2 or, for the most sensitive programs, Level 3.

What are the three CMMC levels?

CMMC has three levels: Level 1 for FCI, Level 2 for CUI, and Level 3 for CUI in the most critical programs. Each level builds on the one below it, and the contract, not the contractor, decides which level applies.

Two scoring details matter for planning. Level 1 has no plan of action and milestones (POA&M) option: all 15 requirements must be met. For Level 2, the program rule allows a Conditional status at a minimum score of 88 out of 110, with open items closed out within 180 days, but only for requirements the rule permits on a POA&M.

Common mistake: mapping to NIST SP 800-171 Rev 3. NIST published SP 800-171 Rev 3 on May 14, 2024, but CMMC Level 2 is built on Rev 2. Keep your assessment objectives on Rev 2 unless your contract or DoD guidance tells you otherwise.

What is the current status of CMMC phases in 2026?

Phase 1 is in effect and Phase 2 is suspended. Level 1 and Level 2 self-assessments and affirmations can still be required in contracts, but Level 2 C3PAO certification and Level 3 requirements are on hold while the Department reviews the program.

The program rule planned four phases over roughly three years, starting with self-assessments (Phase 1, from November 10, 2025) and adding third-party Level 2 certification in Phase 2, originally set for November 10, 2026. On July 13, 2026, the Department announced it was suspending CMMC Phase II requirements and set up a CMMC Reform Task Force to conduct a 60-day review.

What still applies today

• CMMC Phase 1 self-assessments and annual affirmations in SPRS, where your contract requires them.
• DFARS 252.204-7012, which requires covered contractors to implement NIST SP 800-171 and report cyber incidents.
• Government-led assessments of NIST SP 800-171 implementation.
• Flow-down: primes must still pass applicable requirements to subcontractors.

What is paused

• New requirements for Level 2 C3PAO certification and Level 3 assessments. Contracting officers were directed to amend active solicitations and contracts that included them.
• The November 10, 2026 Phase 2 start date. No replacement date had been announced at the time of writing.

The Task Force’s review period ended in September 2026 and its recommendations went to the DoD CIO. As of this update, the Department had not published final decisions. Treat any date you see for a restarted Phase 2 as unconfirmed until it appears in an official DoD release or the Federal Register.

In practice: the suspension changes who verifies you, not what you must protect. NIST SP 800-171 has been a DFARS obligation for years, and a false affirmation in SPRS carries legal risk regardless of which phase is active.

How do you prepare for a CMMC 2.0 assessment?

Start by scoping where FCI and CUI live, then assess against the right requirement set, fix gaps, document everything in a System Security Plan, and record an honest score in SPRS. The same preparation serves a self-assessment today and a C3PAO assessment later.

A 10-step CMMC readiness checklist

1. Confirm your level. Read the clauses in your current contracts and solicitations (look for DFARS 252.204-7012, -7019, -7020, -7021 and -7025) and ask your primes what level they expect you to hold.
2. Map your data flows. Identify where FCI and CUI enter, where they are stored and processed, and where they leave, including email, file shares, engineering tools and cloud services.
3. Define the assessment scope. Classify assets as CUI assets, security protection assets, contractor risk managed assets, specialized assets or out of scope. A smaller, well-defined enclave can cut effort significantly.
4. Inventory assets. Keep a current list of hardware, software, accounts and external service providers in scope. An assessment workspace linked to your asset register makes this easier to maintain.
5. Run a gap assessment. Score each of the 110 Level 2 requirements (or 15 Level 1 requirements) against their assessment objectives, not just their headlines.
6. Write or update the System Security Plan. Describe the boundary, the environment and how each requirement is implemented. Assessors test what the SSP says.
7. Remediate and track. Put every gap on a POA&M with an owner and a date, and prioritize items that cannot remain open under the rule, such as multifactor authentication.
8. Collect evidence. For each requirement, keep policies, configurations, screenshots and logs that prove implementation. Store them centrally with version history.
9. Check your cloud and service providers. Under DFARS 252.204-7012, cloud services that store or process covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline. Collect their evidence and shared responsibility matrices.
10. Score and affirm. Enter your score in SPRS, have your affirming official sign off, and schedule the annual affirmation.

If you already run ISO 27001, SOC 2 or NIST CSF, much of this work overlaps. Mapping NIST SP 800-171 to your existing controls in one place, rather than in parallel spreadsheets, is where tools such as AI cross-framework control mapping save time. Our overview of NIST CSF 2.0 and its new Govern function shows how the frameworks connect.

Want to see your NIST SP 800-171 gaps alongside ISO 27001 and SOC 2 in one view? You can start your 14-day free trial of Enactia’s AI-powered GRC platform, no credit card needed.

How does CMMC handle incidents and third parties?

CMMC itself does not add a new incident clock; the existing DFARS 252.204-7012 duties apply. You must report cyber incidents affecting covered defense information within 72 hours of discovery, and you must flow requirements down to subcontractors who handle FCI or CUI.

Under DFARS 252.204-7012, “rapidly report” means within 72 hours of discovery, through the DoD reporting portal. Contractors must also preserve images of affected systems and relevant monitoring data for at least 90 days from submitting the report. The DFARS CMMC rule dropped a proposed separate 72-hour notice for lapses in security, leaving this clause as the main reporting mechanism.

Build these steps into your incident and breach management workflow so the clock, the evidence preservation and the report owner are clear before an incident happens.

Suppliers and subcontractors

Primes carry the burden of verifying their supply chain. Expect to ask suppliers for their CMMC level, SPRS score date, SSP status and any open POA&M items, and to reassess them each year. A structured vendor and third-party risk program keeps those answers current. Our article on why vendor risk is now executive liability covers the governance side.

Who owns CMMC 2.0 compliance inside the business?

A senior affirming official signs the SPRS affirmation, so accountability sits with leadership, not only with IT. The CISO typically owns the program, while contracts, engineering, HR and procurement each own parts of the evidence.

The DFARS rule uses the term “affirming official” for the person who confirms continued compliance each year. That affirmation is a statement to the government. It should be backed by a documented review, not a signature on a dashboard.

Written policies are part of the evidence. Keep them current and approved in a policy management workflow that records who approved what and when, and track residual gaps in your enterprise risk register so leadership sees them before the affirmation date.

Key takeaways

• CMMC is law: 32 CFR Part 170 has applied since December 16, 2024 and the DFARS clause since November 10, 2025.
• Phase 1 self-assessments and SPRS affirmations remain in effect; Phase 2 C3PAO certification was suspended on July 13, 2026.
• Level 2 is based on the 110 requirements of NIST SP 800-171 Rev 2, not Rev 3.
• DFARS 252.204-7012 duties, including 72-hour incident reporting, continue regardless of the CMMC phase.
• Scope tightly, document in an SSP, and reuse evidence from ISO 27001, SOC 2 or NIST CSF.

Frequently asked questions

Is CMMC 2.0 mandatory in 2026?
Yes, where a contract includes the CMMC clause. The program rule and DFARS rule are both in force, so contracting officers can require Level 1 or Level 2 self-assessments today. Third-party Level 2 certification and Level 3 assessments were suspended in July 2026 pending a program review, but underlying DFARS 252.204-7012 obligations continue for contractors handling covered defense information.

What happened to CMMC Phase 2?
On July 13, 2026 the Department suspended the Phase 2 requirements that were due to start on November 10, 2026 and launched a 60-day CMMC Reform Task Force review. Contracting officers were told to amend solicitations and contracts requiring C3PAO or Level 3 assessments. At the time of writing, no replacement Phase 2 date had been announced.

How many requirements are in CMMC Level 2?
CMMC Level 2 contains the 110 security requirements of NIST SP 800-171 Revision 2, grouped into 14 families such as access control, incident response and system and communications protection. The maximum score is 110, and a Conditional status is possible at 88 or more, with remaining POA&M items closed within 180 days.

Can we use POA&Ms for CMMC?
Only in limited cases. Level 1 does not allow POA&Ms: all 15 requirements must be met. Level 2 allows a Conditional status if you reach the minimum score and the open items are ones the rule permits on a POA&M. Those items must be closed and verified within 180 days, or the conditional status lapses.

Does ISO 27001 certification satisfy CMMC?
No. ISO 27001 is not accepted as a substitute for a CMMC assessment. However, many ISO 27001 Annex A controls overlap with NIST SP 800-171, so an existing ISMS gives you policies, risk processes and evidence you can reuse. Map controls requirement by requirement rather than assuming coverage.

Building a CMMC program that survives the review

Whatever the Reform Task Force recommends, the core of CMMC 2.0 compliance is stable: protect FCI and CUI with the FAR and NIST SP 800-171 requirements, keep an accurate SSP, report incidents on time, and affirm only what you can evidence. Contractors that keep working on those basics now will be ready when the Department confirms its next step.

If you want to run CMMC alongside ISO 27001, SOC 2 or NIST CSF without duplicating work, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.