CMMC Compliance FAQ: What Defense Contractors Need to Know

Answering frequently asked questions on the Cybersecurity Maturity Model Certification (CMMC) program: what it requires, how it's being phased in, and where things stand today.

• 

  C3

CMMC Basics

What is the Cybersecurity Maturity Model Certification (CMMC)?

CMMC is the Department of War’s (DoW, also known as the Department of Defense, DoD) cybersecurity framework designed to safeguard sensitive data within the Defense Industrial Base (DIB). It ensures that defense contractors and subcontractors implement and maintain security controls to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Published under 32 CFR Part 170 and 48 CFR (DFARS), the CMMC rule establishes certification requirements that contractors must meet to remain eligible for DoW contracts.

What is 32 CFR?

Title 32 of the Code of Federal Regulations (“32 CFR”) contains codified U.S. federal laws and regulations related to national defense and security. Part 170 of 32 CFR establishes the CMMC Program itself — who it affects, how it’s structured, and how it’s administered. This rule took effect December 16, 2024.

What is 48 CFR?

Title 48 of the CFR (“48 CFR”) contains the Federal Acquisition Regulation System, and Chapter 2 covers Defense-specific acquisition rules (DFARS). The CMMC-specific DFARS rule took effect November 10, 2025, adding the contract clauses that actually require contractors to implement CMMC.

How do 32 CFR and 48 CFR work together?

Taken together, the two rules establish:

• Who is affected by CMMC
• When CMMC goes into effect, and for whom
• The levels of CMMC and how they’re determined
• The requirements for each level
• When and how the requirements appear in contracts

With the finalization of the CMMC portion of 48 CFR, Phase 1 of the CMMC program began on November 10, 2025, kicking off a planned four-phase rollout. Phase 1 self-assessment requirements remain fully in effect today.

On July 13, 2026, the DoW suspended the transition to Phase 2 (mandatory third-party C3PAO certification), which had been scheduled to begin November 10, 2026, and stood up a CMMC Reform Task Force to review the program; Phases 3 and 4 are paused along with it pending that review.

Who needs to comply with CMMC?

Any entity that contracts with the DoW either directly or indirectly — primes, subcontractors, and suppliers — will be subject to the CMMC Program in some capacity, with timing depending on the specific contract and the program’s phased rollout. Full implementation was originally scheduled for November 10, 2028, though that date is contingent on the outcome of the 2026 Phase 2 review. This includes small and midsize businesses that serve as vendors, manufacturers, consultants, or IT providers within the DIB.

DoW’s regulatory impact analysis for the final 48 CFR rule estimates 337,968 total entities (primes and subcontractors) will ultimately be subject to CMMC requirements, of which 229,818 (about 68%) are classified as small entities.

Does CMMC follow NIST SP 800-171 Rev 2 or the most updated version (Rev 3)?

The final rule explicitly calls out Revision 2. In May 2024, the DoW issued a class deviation addressing language in DFARS 252.204-7012 that would otherwise require the “current version” of NIST 800-171, pinning the standard to Revision 2. That deviation remains in effect with no stated expiration date, and Revision 2 continues to govern CMMC Level 2 assessments and SPRS scoring today, unaffected by the 2026 Phase 2 pause.

CMMC Timelines and Levels

How is CMMC being rolled out?

CMMC was designed to phase in over four stages, adding requirements incrementally rather than all at once:

• Phase 1 (began Nov 10, 2025) — in effect. All applicable* new solicitations require a CMMC status of Level 1 (Self) or Level 2 (Self) as a condition of award. At its discretion, DoW may require Level 2 (C3PAO) certification even during Phase 1.

• Phase 2 (originally Nov 10, 2026) — suspended. Phase 2 would have made Level 2 (C3PAO) third-party certification mandatory in all applicable new solicitations. On July 13, 2026, the DoW suspended this transition and launched a CMMC Reform Task Force to review the program, with a report expected on or about September 13, 2026. There is currently no confirmed date for when, or whether in its original form, Phase 2 will take effect.

• Phases 3 and 4 — paused. Phase 3 was to expand Level 2 (C3PAO) to option-period renewals and begin Level 3 (DIBCAC) requirements; Phase 4 was full implementation across all applicable contracts. Both are paused pending the outcome of the Phase 2 review, since each phase was scheduled relative to the one before it.

Many primes are actively pushing their subs toward certification well ahead of any contractual deadline to reduce their own supply-chain risk, so a paused federal timeline doesn’t necessarily mean a paused deadline from your prime.

*Selection of the CMMC level for a given contract is a DoW risk-based decision made by the Program Manager or Requiring Activity.

What is the difference between FCI and CUI?

Both Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) are government-provided or contractor-generated information not intended for public release.

CUI is the more sensitive category: unclassified information that must be safeguarded under federal law or policy. For defense contractors, the top CUI categories include controlled technical information, export-controlled information, privacy information, operations security information, and DoW critical infrastructure security information.

The government’s CUI program is detailed in 32 CFR Part 2002, and DoW provides further guidance through its DoW CUI Program site.

Contractors that only handle FCI can focus on Level 1 compliance; any contractor that expects to handle CUI in any form should plan for Level 2.

Which contracts will fall under the “applicable solicitations and contracts” language?

During the phased implementation period, DoW Program Managers retain some discretion over whether and how to prescribe CMMC requirements for a given solicitation. Certain contracts will be required to include CMMC requirements; others are left to Program Manager judgment.

DoW has not published a policy standardizing these decisions across components, and has no plans to publish a list of solicitations that will or may include CMMC requirements.

What are the CMMC Levels?

The required CMMC level is specified in each solicitation, based on the type of information a contractor will handle. CMMC defines three progressive levels:

• CMMC Level 1 — Basic safeguarding of FCI. Applies to contracts where the contractor will only handle Federal Contract Information.
• CMMC Level 2 — Advanced protection of CUI. Applies to contracts where the contractor will handle Controlled Unclassified Information.
• CMMC Level 3 — Protection against advanced persistent threats (APTs). Applies to a small subset of contracts involving highly sensitive information.

How will CMMC Levels be determined for each contract?

The DoW Program Manager or Requiring Activity determines the applicable level based on several factors:

• Criticality of the associated mission capability
• Type of acquisition program or technology
• Threat of loss of the FCI or CUI involved
• Impacts from exploitation of information security deficiencies
• Other relevant policy factors, including Milestone Decision Authority guidance

How different are the security requirements between CMMC Levels?

• CMMC Level 1 (Self) requires compliance with 15 controls derived from FAR 52.204-21, a relatively basic set of cybersecurity practices. Annual self-assessment is required.
• CMMC Level 2 (Self and C3PAO) requires compliance with the 110 security requirements in NIST SP 800-171 Rev 2, assessed against 320 objectives defined in NIST SP 800-171A. This is a substantially stricter set of technical, procedural, and operational requirements, available as either a self-assessment or a third-party (C3PAO) certification depending on contract type.
• CMMC Level 3 (DIBCAC) additionally requires 24 DoW-selected security requirements from NIST SP 800-172, intended to reduce risk from advanced persistent threats. It requires an on-site government assessment by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).

Practical CMMC Questions

How long does it take to achieve CMMC Level 2?

Estimates commonly cited by C3PAOs put full implementation of all 110 NIST 800-171 controls at 12–18 months, plus a “burn-in” period demonstrating adherence to your System Security Plan (SSP), plus the time to schedule and conduct the assessment itself.

Working from a pre-vetted architecture rather than building one from scratch can meaningfully shorten that timeline; ask any compliance partner what their standardized approach looks like and how much of it has already been tested against CMMC Level 2 requirements.

Are Primes responsible for their subcontractor’s CMMC?

Prime contractors are responsible for ensuring their subcontractors meet the appropriate CMMC level. Subs must have their own CMMC status recorded in SPRS; primes don’t have direct database access, so they typically verify compliance through documentation like an SPRS screenshot.

The main exception is subcontractors that only use the prime’s own IT systems, or that don’t handle any FCI or CUI at all.

Because primes can’t predict exactly which solicitations will require CMMC, many are pushing suppliers toward certification well ahead of the federal timeline. Lockheed Martin and other major primes have issued supplier notices requiring CMMC compliance documentation independent of the DoW’s own phased schedule.

Can one CMMC Level 2 assessment apply to multiple contracts?

CMMC statuses are awarded to an assessed environment, not to the organization as a whole. If you hold or are pursuing multiple contracts, your assessment scope must cover the activities required by each of them, or you’ll need separate assessments. Any major change to your scoped environment to meet new contractual requirements may trigger a new assessment.

A single well-scoped environment can often satisfy multiple contracts; a compliance consultant can help you evaluate your specific situation.

Can I create a POA&M if I don’t meet all the requirements for the assessment?

Only in limited circumstances. For a Level 2 assessment, you can receive a Conditional status — with open items tracked on a Plan of Action and Milestones (POA&M) — only if your assessment score is at least 80% of the maximum (110 points), and none of the open items fall on a short list of security requirements the rule designates as ineligible for a POA&M (including external connections, control of public information, the System Security Plan itself, and several physical-security controls around CUI). Any open item outside that carve-out, or a score below the 80% threshold, is a failed assessment, not a POA&M candidate.

Once a Conditional status is granted, all POA&M items must be closed out within 180 days, verified by a follow-up assessment, or the Conditional status expires.

Can I get a waiver exempting me from CMMC?

Waivers are rare and require sign-off from a DoW Service Acquisition Executive or Component Acquisition Executive (e.g., an Assistant Secretary of a service branch). Waivers apply to an individual contract, not to an organization as a whole.

Does the Fundamental Research carve-out apply to me?

Basic research intended for public release is exempt from CMMC. But if that research could later become CUI, or if you handle other controlled information under the same contract, CMMC requirements will apply. When in doubt, check with the program office.

Are commercial off-the-shelf (COTS) products exempt from CMMC?

Pure COTS products are exempt, but the definition is narrow. If your “commercial” product requires integration, configuration, custom software, or special services, CMMC may still apply.

How long do I need to keep the artifacts from my assessment?

The final CMMC rule requires assessment artifacts to be retained for six years.

When will I need a new assessment?

You’ll need to reaffirm compliance annually, but a formal Level 2 or Level 3 assessment is only required every three years — unless something in your environment changes enough to trigger a new one. The rule allows an “operational plan of action” to address system updates, patches, or reconfiguration for a requirement that was previously fully implemented but has since drifted out of compliance.

A material change to scope, architecture, or control posture beyond routine operational updates requires a new assessment and a new affirmation — for example, moving data, adding a new system, or changing how users authenticate.

What happens if a company fails an assessment?

Depending on the gaps found, a contractor may receive a Conditional status (see the POA&M question above) if the 80%-score threshold and the not-eligible-for-POA&M list are both satisfied. If they aren’t, the assessment is a failure: the organization doesn’t receive a Level 2 certificate and loses eligibility for the associated contract requirement until it passes a new assessment.

MSPs and CMMC

Are MSPs considered an External Service Provider (ESP) or a Cloud Service Provider (CSP)?

The final rule distinguishes between Cloud Service Providers and “External Service Providers other than CSPs.” DoW has indicated that an ESP that manages a third-party cloud service on behalf of an OSA is not itself considered a CSP; a CSP is an external company that hosts shared computing resources that can be rapidly provisioned with minimal provider interaction.

Under this definition, an MSP or MSSP that uses a third-party cloud service (Microsoft, Amazon, Google, etc.) to deliver its services is generally an ESP, not a CSP. It’s still important to confirm that any cloud service your MSP relies on meets FedRAMP Moderate equivalency or greater.

Does my MSP or MSSP need to be included in scope even if they don’t handle CUI?

Yes. An external service provider that handles IT or security support for the environment being assessed qualifies as an ESP and must be assessed as part of your organization’s assessment.

Should my MSP be CMMC-certified?

CMMC doesn’t require ESPs to be independently certified, but there are two good reasons an MSP might pursue it anyway: it provides third-party validation of the environment your MSP manages, and it can streamline your own assessment. The rule notes that an ESP may voluntarily undergo a CMMC certification assessment to reduce the ESP’s effort required during the OSA’s assessment, which suggests some efficiency benefit for clients during their own assessment.

If an MSP does pursue certification to simplify things for its clients, it needs a certification equal to or above the level and type its clients require for their contracts.

What is a Customer Responsibility Matrix?

The final CMMC rule requires all ESPs — not just CSPs — to provide a Customer Responsibility Matrix (CRM) describing the division of responsibilities between the OSA and the ESP, along with a service description. Both must be documented or referenced in the organization’s System Security Plan (SSP).