CMMC

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-07-13 DoD CIO memo suspends the November 2026 move to CMMC Phase 2; requiring activities may include Level 1 (Self) or Level 2 (Self) assessments in procurement requests
2. 2025-11-10 DFARS CMMC rule takes effect; Phase 1 begins on this date under 32 CFR 170.3(e)
3. 2025-09-10 DoD publishes the DFARS rule incorporating CMMC into contracts
4. 2024-12-16 CMMC Program rule (32 CFR part 170) takes effect

1. 2024-10-15
   CMMC Program rule, 32 CFR part 170 (October 2024) Major versionCurrent

   Final rule establishing the CMMC Program to verify that contractors have implemented the security requirements for FCI and CUI; effective 16 December 2024. source

   More

   • Level 1 checks the 15 requirements of FAR 52.204-21.
   • Level 2 checks the requirements of NIST SP 800-171 Rev. 2.
   • Level 3 adds selected requirements of NIST SP 800-172 (February 2021).
2. 2023-12-26
   CMMC Program proposed rule (December 2023) Draft

   DoD proposed the CMMC Program rule. source

CMMC applies to DoD contracts where a contractor handles FCI or CUI on its own systems, phased into solicitations over four phases.

Who

DoD contract and subcontract awardees that will process, store or transmit FCI or CUI on contractor information systems. source

Exclusions

Requirements apply above the micro-purchase threshold and not to contracts solely for COTS items; they do not apply to federal systems operated on the Government's behalf. source

Phases

Phase 1 began with the DFARS rule; Phase 2 (Level 2 C3PAO as a condition of award) was set for one year later, then Phase 3 and full implementation in Phase 4. source

Phase 2 suspended

In July 2026 DoD suspended the November 2026 Phase 2 transition and told contracting officers to remove or revise CMMC requirements in new and existing contracts. source

Who chooses the level

DoD program managers or requiring activities select the CMMC status required for each procurement. source

Level 1 is a yearly self-assessment; Level 2 is a self-assessment or a C3PAO certification every three years; Level 3 is assessed by DCMA DIBCAC.

Level 1 (Self)

A self-assessment against all FAR 52.204-21 requirements, repeated annually with results submitted in SPRS; no POA&Ms are allowed. source

Level 2 (Self)

A self-assessment against NIST SP 800-171 Rev. 2, repeated every three years with results in SPRS. source

Level 2 (C3PAO)

A certification assessment by an authorized CMMC Third-Party Assessment Organization, completed within three years of the conditional status date. source

Level 3 (DIBCAC)

Requires a Final Level 2 (C3PAO) status first; the assessment is performed by DCMA DIBCAC on behalf of DoD. source

Affirmation

A Final Level 2 status is valid for 3 years and needs an annual affirmation of continuous compliance. source

Since July 2026

DoD permits Level 1 (Self) or Level 2 (Self) in procurement requests while Phase 2 is suspended. source

CMMC is enforced through contract award: without the required status a contractor cannot win or extend the contract.

Contract award

When CMMC status is required, contracting officers check SPRS and may not award a contract or exercise an option without the required status. source

Contract clause

DFARS 252.204-7021 is inserted in solicitations and contracts that require CMMC, and 252.204-7025 notifies offerors of the required level. source

Baseline still applies

During the suspension DoD still requires baseline compliance with NIST SP 800-171 Rev 2 under DFARS 252.204-7012. source

1. Law text 32 CFR part 170 – CMMC Program
2. Law text CMMC Program final rule (15 October 2024)
3. Law text DFARS final rule incorporating CMMC into contracts (10 September 2025)
4. Law text DFARS 252.204-7021 Contractor Compliance with the CMMC Level Requirements
5. Law text DFARS Class Deviation 2026-O0025 Rev. 3 (implements the CMMC Phase 2 suspension)

1. NIST SP 800-171

   NIST SP 800-171 is the list of requirements; CMMC is DoD's program for checking them, with Level 2 tied to Rev. 2, not Rev. 3.

2. DFARS 252.204-7012

   DFARS 252.204-7012 requires contractors to implement NIST SP 800-171 and report incidents; CMMC verifies that implementation before award.

3. FAR 52.204-21

   FAR 52.204-21 sets the 15 basic safeguards; CMMC Level 1 is the DoD self-assessment against them.

4. NIST SP 800-172

   NIST SP 800-172 adds enhanced requirements for CUI; CMMC Level 3 uses selected ones from its February 2021 edition.

5. FedRAMP

   FedRAMP certifies cloud services for government-wide use; CMMC covers defense contractors' own systems.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to CMMC (RSS)