CMMC Compliance: Levels, Requirements, and Where the Program Stands in 2026

Q: What are the three CMMC levels?

Level 1 protects Federal Contract Information with 15 FAR 52.204-21 requirements and an annual self-assessment. Level 2 protects CUI with the 110 NIST SP 800-171 requirements, verified by self-assessment or a C3PAO. Level 3 adds 24 NIST SP 800-172 requirements, assessed by DCMA DIBCAC.

Sarah Silva

30 minutes ago

Last Updated: 10/19/2026

CMMC compliance means meeting the Cybersecurity Maturity Model Certification level a Department of War (DoW, formerly DoD) contract requires. There are three levels:

Level 1: 15 basic safeguards for Federal Contract Information (FCI).
Level 2: the 110 requirements of NIST SP 800-171 for Controlled Unclassified Information (CUI).
Level 3: 24 more requirements from NIST SP 800-172.

As of October 2026, Phase 1 self-assessments are in force, and the Phase 2 third-party assessment requirement is suspended pending a DoW review.

Current status — updated October 8, 2026. On July 13, 2026, the Department of War suspended CMMC Phase 2, which would have required C3PAO certification for many Level 2 contracts starting November 10, 2026. Later phases are suspended too. Phase 1 remains in force: Level 1 and Level 2 self-assessments, SPRS affirmations, and DFARS 252.204-7012 obligations. A CMMC Reform Task Force finished its 60-day review in September 2026, and its report has not been published. We will update this page when DoW announces next steps.

What is CMMC?

CMMC is the Department of War’s program for verifying that contractors protect the federal information they handle. It is codified in 32 CFR Part 170, effective December 16, 2024. It enters contracts through the DFARS clause 252.204-7021.

CMMC does not create a new security standard. It checks implementation of standards contractors already owe:

FAR 52.204-21 for FCI
NIST SP 800-171 for CUI

What CMMC adds is verification. Depending on the level, that means a signed self-assessment, an independent assessment by an authorized third party, or a government assessment.

You will still see “CMMC 2.0.” That is the name DoD gave the streamlined three-level model announced in November 2021, which replaced the original five-level version. The current program is simply “CMMC.” For a deeper introduction, see what CMMC is and how it works.

Who runs CMMC

DoW Chief Information Officer: owns the program and its policy.
The Cyber AB: accredits Certified Third-Party Assessment Organizations (C3PAOs) and certifies individual assessors.
DCMA’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC): performs Level 3 assessments and assesses C3PAOs.
Supplier Performance Risk System (SPRS): where contractors post assessment results and affirmations.

Who needs CMMC compliance?

Any contractor or subcontractor that processes, stores, or transmits FCI or CUI on a DoW contract that includes the CMMC clause needs the level that contract specifies. Prime contractors must flow the requirement down to subcontractors that handle the same information. Contracts solely for commercially available off-the-shelf (COTS) items are exempt.

The two kinds of data drive everything:

FCI is information provided by or generated for the government under a contract and not intended for public release. FCI alone triggers Level 1.
CUI is information the government requires to be safeguarded under law, regulation, or policy, but that is not classified. The NARA CUI Registry lists every category. Examples include export-controlled technical data and controlled technical information. CUI triggers Level 2 or Level 3.

Your vendors can be in scope too. Under 32 CFR 170, an External Service Provider (ESP) that handles your CUI or your Security Protection Data becomes part of your assessment. An MSP running your firewall is a common example. Cloud providers that store CUI must meet FedRAMP Moderate or equivalent requirements under DFARS 252.204-7012.

People who handle CUI also need training. Awareness and Training is one of the 14 requirement families in NIST SP 800-171. For a scoping walkthrough, see who needs CMMC.

CMMC levels and requirements

The level is set by the contracting officer based on the information involved, not chosen by the contractor. Here is how the three CMMC levels compare under 32 CFR 170:

	Level 1 (Foundational)	Level 2 (Advanced)	Level 3 (Expert)
Protects	FCI	CUI	CUI facing advanced persistent threats
Requirements	15, from FAR 52.204-21	110, from NIST SP 800-171 Rev 2	Level 2, plus 24 from NIST SP 800-172
Assessment	Self-assessment	Self-assessment or C3PAO, as the contract specifies	DIBCAC, after a final Level 2 C3PAO certification
How often	Annual	Every 3 years, plus an annual affirmation	Every 3 years, plus an annual affirmation
POA&M allowed?	No	Yes, limited. Minimum score 88 of 110, closed within 180 days.	Yes, limited. Closed within 180 days.
Status (Oct 2026)	In force	Self-assessment in force. C3PAO requirement suspended.	Suspended

CMMC Level 2 is pinned to NIST SP 800-171 Revision 2, even though NIST published Revision 3 in May 2024. Build to Rev 2 for CMMC purposes until DoW says otherwise.

The full control lists are on the CMMC requirements page.

What a POA&M is, and what it is not

A Plan of Action and Milestones (POA&M) lists requirements you have not met yet and how you will close them. At Level 2, CMMC allows a temporary Conditional status if your score is at least 88 of 110 and the open items are on the allowed list. You then have 180 days to close them.

Some high-value requirements can never sit on a POA&M. Level 1 allows no POA&M at all.

Your SPRS score

Separate from CMMC, DFARS 252.204-7019 and 252.204-7020 already require contractors with CUI to post a NIST SP 800-171 assessment score in SPRS. The DoD Assessment Methodology produces scores from -203 to 110. Contracting officers can check that score before award, so an outdated or inflated score is a real exposure.

The CMMC rollout and the 2026 Phase 2 suspension

The rule that put CMMC into contracts took effect on November 10, 2025. It set four phases, each adding requirements one year apart:

Phase	Original start	What it adds	Status (Oct 2026)
Phase 1	Nov 10, 2025	Level 1 and Level 2 self-assessments in applicable new contracts	In force
Phase 2	Nov 10, 2026	Level 2 C3PAO certification for applicable contracts	Suspended July 13, 2026
Phase 3	Nov 10, 2027	Level 3 DIBCAC assessments	Suspended
Phase 4	Nov 10, 2028	Full implementation, including option periods	Suspended

On July 13, 2026, DoW announced the immediate suspension of Phase 2 and all later milestones. It also stood up a CMMC Reform Task Force for a 60-day review. DoW cited compliance costs and barriers for small and mid-sized businesses (DoW release).

The review window closed in September 2026. The Task Force report has not been made public.

What still applies to you today

Phase 1 CMMC requirements. Applicable contracts still require Level 1 or Level 2 self-assessments and annual affirmations in SPRS.
DFARS 252.204-7012. You must still implement NIST SP 800-171 and report cyber incidents to DoD within 72 hours through DIBNet.
DFARS 252.204-7019 and 7020. A current SPRS score is still required.
Legal accountability. Self-assessments and affirmations are signed by a senior official. Federal contractors that misrepresent cybersecurity compliance have faced False Claims Act liability.

The suspension paused when third-party verification becomes mandatory. It did not change what you have to protect or how.

What to watch

The Reform Task Force report and any DoW decision that follows.
Any change to 32 CFR Part 170 or the DFARS CMMC rule.
Final action on the CMMC grant program proposed in the Senate FY2027 NDAA. It is not law yet.

Track every change on our CMMC updates page.

What does CMMC compliance cost?

Cost depends mostly on the level, how much of your environment handles CUI, and how much of NIST SP 800-171 you already have in place. In its final program rule, DoD estimated a Level 2 C3PAO certification at a little over $100,000 for a small business. That figure covers the assessment-related costs. It excludes the cost of implementing the controls themselves (Federal News Network).

The biggest drivers are usually:

Scope. A well-designed enclave that isolates CUI can cost far less than bringing an entire enterprise up to Level 2.
Remediation. Multifactor authentication, FIPS-validated encryption, logging, and documentation gaps are common big-ticket items.
Cloud platform. CUI in the cloud must sit with a FedRAMP Moderate (or equivalent) provider.
Internal time. Writing a System Security Plan (SSP), collecting evidence, and maintaining both takes ongoing staff hours.

For a breakdown by level and a realistic timeline, see CMMC cost and timeline.

How to prepare for CMMC

The same preparation applies whether you self-assess or bring in a C3PAO. That makes it the safe work to do while the program is under review.

Confirm what you handle. Find which contracts carry FCI or CUI and which DFARS and FAR clauses they include.
Define your scope. Map where FCI and CUI flow. Classify your assets, and identify the ESPs and cloud services that touch that data.
Run a gap assessment. Score yourself honestly against every applicable requirement and assessment objective.
Document. Write or update your SSP and build a POA&M for the gaps.
Remediate. Close the gaps, starting with requirements that cannot be placed on a POA&M.
Report. Post your SPRS score, and have the senior official sign the affirmation.
Decide on independent validation. A C3PAO assessment is voluntary for most contracts right now. Some primes still ask suppliers for one.

The detailed version is on how to prepare for CMMC. Before you start, read the most common CMMC mistakes.

Getting assessed: C3PAOs and assessor independence

Only a C3PAO authorized by the Cyber AB can perform an assessment that results in a CMMC Level 2 certification. Authorized C3PAOs are listed on the Cyber AB Marketplace. The C3PAO uploads results to DoW’s CMMC eMASS system. A final certification is valid for three years, as long as annual affirmations continue.

Independence is built into the program. A C3PAO cannot assess an organization it has helped prepare for that assessment. That is why preparation support and the formal assessment should come from different engagements, and often different firms.

For what to look for in an assessor, see choosing a CMMC provider.

Staying compliant after assessment

CMMC is not a one-time event. To keep your status you need to:

Affirm compliance in SPRS every year.
Keep your SSP current as systems change.
Report cyber incidents within 72 hours under DFARS 252.204-7012.
Reassess every three years, or every year at Level 1.

If your environment changes significantly, your assessment scope may no longer be accurate. See maintaining CMMC compliance.

Explore the CMMC resource hub

Start here: What is CMMC? · Why CMMC matters · Who needs it
Requirements and process: Requirements · How it works · How to prepare · Cost and timeline
Avoid problems: Common mistakes · Myths · Red flags · Audit findings
Compare and choose: CMMC vs. other frameworks · By segment · Choosing a provider · Tools
Reference: Official guidance · Updates · Glossary · FAQ · Maintaining compliance

Work with RSI Security

RSI Security is a Cyber AB-authorized C3PAO that performs independent CMMC Level 2 assessments. Organizations at a different stage can work with RSI Security on CMMC readiness through a separate advisory engagement. To protect assessor independence, RSI Security does not assess any organization it has advised on CMMC.

Schedule a CMMC Level 2 assessment · Talk to an advisor about readiness

Frequently asked questions about CMMC compliance

Is CMMC still required in 2026?

Yes. Phase 1 has been in force since November 10, 2025. Applicable DoW contracts require Level 1 or Level 2 self-assessments and annual affirmations in SPRS. In July 2026, DoW suspended Phase 2 and later phases, which would have added mandatory third-party and government assessments.

Was CMMC Phase 2 cancelled?

No. Phase 2 was suspended, not cancelled. On July 13, 2026, the Department of War paused the transition to Phase 2 and all later milestones while a CMMC Reform Task Force reviewed the program. The CMMC rule in 32 CFR Part 170 has not been repealed.

What are the three CMMC levels?

Level 1 protects Federal Contract Information with 15 FAR 52.204-21 requirements and an annual self-assessment.
Level 2 protects CUI with the 110 NIST SP 800-171 requirements, verified by self-assessment or a C3PAO.
Level 3 adds 24 NIST SP 800-172 requirements, assessed by DCMA DIBCAC.

Is there a CMMC Level 4 or Level 5?

No. The original CMMC model had five levels. DoD reduced it to three in November 2021, a change often called CMMC 2.0. The current program in 32 CFR Part 170 has only Levels 1, 2, and 3.

Do I need a C3PAO assessment right now?

For most new contracts, no. With Phase 2 suspended, Level 2 contracts currently call for self-assessment. Some contracts and prime contractors may still request independent C3PAO certification. A completed C3PAO certification remains valid for three years with annual affirmations.

What is the difference between CMMC and NIST SP 800-171?

NIST SP 800-171 is the security standard: 110 requirements for protecting CUI. CMMC is the DoW program that verifies contractors actually meet it, through self-assessments, third-party assessments, or government assessments. CMMC Level 2 uses NIST SP 800-171 Revision 2.

How long does CMMC certification last?

A final Level 2 or Level 3 status lasts three years, provided a senior official affirms continued compliance in SPRS every year. Level 1 self-assessments are repeated every year. A Conditional status with an open POA&M lasts 180 days.

What is a C3PAO?

A C3PAO is a Certified Third-Party Assessment Organization authorized by the Cyber AB to perform CMMC Level 2 certification assessments. Authorized C3PAOs are listed on the Cyber AB Marketplace. A C3PAO cannot assess an organization it helped prepare for that assessment.

Do subcontractors need CMMC?

Yes, when they handle FCI or CUI. Prime contractors must flow CMMC requirements down to subcontractors that process, store, or transmit the same information. The required level depends on the information the subcontractor handles, not the prime’s level.

How much does CMMC compliance cost?

It depends on level, scope, and existing controls. In its final rule, DoD estimated a Level 2 C3PAO certification for a small business at a little over $100,000. That covers assessment-related costs, not the cost of implementing the controls.