Getting Started with CMMC: Levels, Requirements, and First Steps

Introduction

The Cybersecurity Maturity Model Certification (CMMC) is a program of the United States Department of War (DoW). Official CMMC pages use that name. The regulation still says Department of Defense (DoD). Both names refer to the same department.

This guide is for owners, operations leaders, IT managers, and security leads at small and midsize defense contractors and subcontractors.

You will learn the program status, two information types, and the three levels. You will also learn how to find the requirement in a contract and which first steps to take.

The central message is short. Understand your requirement. Define your scope. Build evidence you can explain.

Current program status

CMMC status as of October 21, 2026

What is in effect

Phase 1 of CMMC implementation started on November 10, 2025. Solicitations can require Level 1 (Self) or Level 2 (Self).
Phase 1 self-assessment requirements remain in place. Contractors still enter self-assessment results and annual affirmations in the Supplier Performance Risk System (SPRS) when a contract requires them.
DFARS 252.204-7012 remains in effect. The security baseline is NIST SP 800-171 Revision 2. The Department of War (DoW) says it will enforce this baseline through self-assessments and select government-led assessments.

What is suspended

On July 13, 2026, the DoW suspended the Phase 2 transition, which was scheduled for November 10, 2026. It also suspended the other planned milestones.
Program offices may not require a CMMC Third-Party Assessment Organization (C3PAO) assessment at Level 2 during the suspension. They also may not require Level 3 (DIBCAC), a Government-led assessment.
Contracting officers must amend active solicitations to remove those requirements as soon as practicable. For current contracts, they must remove them by modification before the next option period or at the next scheduled administrative modification. If your contract still names Level 2 (C3PAO) or Level 3 (DIBCAC), ask your contracting officer how it applies.
The DoW created a CMMC Reform Task Force for a 60-day review. On October 21, 2026, we found no official publication of its recommendations and no new Phase 2 date.

What to do

Read each solicitation and contract for the CMMC level it names.
Continue the self-assessment and affirmation work that your contracts require.
Do not plan around the November 10, 2026 date.
Check the official CMMC page for changes.

Sources

What CMMC means and who it affects

CMMC is a framework to assess whether a contractor protects Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The program rule is 32 CFR Part 170. DFARS 252.204-7025 is the solicitation notice. DFARS 252.204-7021 is the contract clause.

CMMC can apply to DoW contractors and subcontractors at all tiers. It applies when they process, store, or transmit FCI or CUI on their own systems for a DoW contract. It does not apply to a Federal system that a contractor operates for the Government.

The rule applies to contracts above the micro-purchase threshold. It does not apply to contracts only for commercially available off-the-shelf (COTS) items.

The DoW program office selects the level for each procurement from the type of information. Company size or industry alone does not set the level.

FCI and CUI

FCI is information that the Government provides under a contract to develop or deliver a product or service. A contractor can also generate FCI for the Government under that contract. The Government does not intend FCI for public release.

FCI does not include information that the Government provides to the public, such as on public websites. It also does not include simple transactional information, such as the information necessary to process payments. See FAR 52.204-21(a).

CUI is information that the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government. A law, regulation, or Government-wide policy requires or permits an agency to handle it with safeguarding or dissemination controls. Information that your company creates for the Government under a contract can be CUI.

CUI is not classified information. The National Archives and Records Administration (NARA) is the Executive Agent for the CUI program. The CUI rule is 32 CFR Part 2002. The DoW CUI Registry lists the categories.

Hypothetical example, FCI

A hypothetical machine shop receives a statement of work and a delivery schedule for a bracket under a DoW contract. The Government does not intend this information for public release. It is likely FCI. The payment record is simple transactional information, so it is not FCI.

Hypothetical example, CUI

The same hypothetical shop receives a technical drawing from its prime contractor. The drawing has a CUI marking. The marking and the contract tell the shop how to protect it. Each system that processes, stores, or transmits the drawing is in scope for CUI protection.

These examples are simplified. Your contract, the markings, and the CUI Registry decide what applies. If the answer is not clear, ask your contracting officer or prime contractor.

The three levels at a glance

Level 1
Information
FCI
Requirements
The 15 requirements in FAR 52.204-21(b)(1).
Assessment
A self-assessment every year. Results go in SPRS. No POA&M.
Affirmation
After each assessment, so every year.
Level 2
Information
CUI
Requirements
The 110 requirements in NIST SP 800-171 Revision 2.
Assessment
A self-assessment or a C3PAO assessment every three years, as the contract states. Results go in SPRS.
Affirmation
At each assessment and every year after.
Level 3
Information
CUI with enhanced protection
Requirements
Level 2 plus 24 selected requirements from NIST SP 800-172.
Assessment
A DCMA DIBCAC assessment every three years. A Final Level 2 (C3PAO) status on that scope comes first.
Affirmation
At each assessment and every year after.

During the current suspension, a new solicitation may require only Level 1 (Self) or Level 2 (Self). The cards show the full framework in 32 CFR 170.14 through 170.18.

Each level in plain English

Level 1

All 15 requirements must be MET. A Plan of Action and Milestones (POA&M) is not permitted at Level 1. There is no point score.
Enter the results in SPRS each year. An Affirming Official affirms after each assessment. Keep the artifacts for six years.

Level 2

Purpose: protection of CUI.
Two paths exist. In Level 2 (Self), your organization assesses itself. In Level 2 (C3PAO), an authorized or accredited CMMC Third-Party Assessment Organization (C3PAO) assesses you. The solicitation names the path.
A limited POA&M is possible. The score must be at least 88 of 110. Only 1-point requirements can go on it, with one exception for CUI encryption that is not FIPS-validated. Six requirements, such as the System Security Plan, can never go on it. The result is a Conditional status. A closeout assessment must close the POA&M within 180 days, or the status expires.
Keep the System Security Plan current. Keep the artifacts for six years. A missed affirmation ends the status.

Level 3

The Defense Contract Management Agency (DCMA) Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) assesses you every three years. A Final Level 2 (C3PAO) status on the same scope is a prerequisite.
Affirm the Level 3 status and the Level 2 (C3PAO) status every year.

Assessment frequency and annual affirmation

Assessment frequency is how often you assess the system. Level 1 is every year. Levels 2 and 3 are every three years. Affirmation is a separate statement by your Affirming Official in SPRS. You affirm after each assessment, after each POA&M closeout, and every year after a Final status. At Level 2, you assess once in three years, but you affirm each year.

NIST SP 800-171 Revision 2 is the baseline

NIST published Revision 3 of SP 800-171 in May 2024. CMMC does not use it yet. The rule incorporates Revision 2 by reference. The DoW says that it will add Revision 3 through future rulemaking. See DoW CIO CMMC FAQ, B-A3.

How to find the requirement in your contract

Read the solicitation for DFARS 252.204-7025. Paragraph (b)(1) names the level: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC).
Read the contract for DFARS 252.204-7021. Paragraph (d)(1) names the level that you must hold for the full contract period.
Find FAR 52.204-21 or FAR 52.240-93. Both clauses set the same 15 basic safeguarding requirements for FCI. Older contracts can keep FAR 52.204-21. New DoW contracts can carry FAR 52.240-93. This guide does not state a start date for FAR 52.240-93. The CMMC rule still names FAR 52.204-21 as the Level 1 source.
Look for DFARS 252.204-7012. It requires NIST SP 800-171 protection for covered defense information, with or without a CMMC level.
If you are a subcontractor, read the flow-down terms from your prime contractor. 32 CFR 170.23 sets the minimums. FCI only requires Level 1 (Self). CUI requires at least Level 2 (Self).
If the level is not clear, ask the contracting officer or the prime contractor. Keep the written answer.
List each information system that will process, store, or transmit FCI or CUI for that contract. Each system gets its own CMMC status and CMMC unique identifier (UID) in SPRS.

Practical first steps

Identify the information. List the contracts that provide FCI or CUI. Collect the markings and the contract clauses. Decide which information is FCI, which is CUI, and which is neither.
Map the data flows. Follow each type of information from receipt to disposal. Include email, file shares, cloud services, backups, paper, and external service providers.
Define the scope. List the assets that process, store, or transmit the information. For Level 2, sort the assets into the five categories in 32 CFR 170.19. Document the scope and the network diagram before the assessment.
Inventory the systems. Record each device, account, cloud service, and application in scope. Name an owner for each one.
Review the safeguards against the objectives in NIST SP 800-171A. The methods are examine, interview, and test. Plan where the team will keep the findings.
Document the evidence. Keep the evidence in final form. Drafts do not count. For Level 2, write the System Security Plan. Record where each piece of evidence is and who owns it.
Address the gaps. Make a remediation list with owners and dates. An internal list is not a CMMC POA&M. Only a POA&M that meets 32 CFR 170.21 counts toward a Conditional status.
Follow the assessment or reporting process that your contract names. For Level 1, each of the 15 requirements must be MET. For a Level 2 self-assessment, use the CMMC Scoring Methodology in 32 CFR 170.24. Enter the results in SPRS and submit the affirmation. Keep the artifacts for six years.

The CMMC First-Steps Checklist turns these steps into a printable worksheet.

Glossary

SSP (System Security Plan): the document that describes the system boundary and how each requirement is met. Level 2 requires an SSP. Level 1 does not, but the DoW recommends one.
POA&M (Plan of Action and Milestones): a document for tasks and dates that close NOT MET requirements. A CMMC POA&M is allowed only under 32 CFR 170.21.
SPRS (Supplier Performance Risk System): the Government system for Level 1 and Level 2 results and affirmations. Access is through PIEE.
C3PAO: an organization that the CMMC Accreditation Body authorizes or accredits to perform Level 2 certification assessments.
DCMA DIBCAC: the Government team that performs Level 3 certification assessments.
Affirming Official: the senior person who affirms continued compliance in SPRS.

A fictional example: from finding to verification

This example is fictional. Acme Aerospace is not a real company. The data is synthetic.

Acme Aerospace prepares for a Level 2 self-assessment. On September 23, 2026, the team ran a privileged access review of its GitHub organization. The saved report lists three owners: Maya Patel, Trent Anderson, and Alex Morgan. The Entra identity for Alex Morgan is inactive, but the Owner assignment is still present. The snapshot does not verify current sign-in access.

The product demo stops there, with each decision at “Pending review.” The rest of this example is an added fictional record. The owner confirms that Alex left the company. The team approves the removal and records the decision. The next saved report shows two owners. The record holds the finding, the decision, the approval, and the verification evidence.

The team can explain this record for AC.L2-3.1.1 and AC.L2-3.1.5. The assessor still decides whether the evidence is sufficient.

Powered by Redapt

Hyphen helps your team build evidence it can explain. It connects directory identities with observed accounts and permissions. It shows who holds administrative access, and it highlights access that inactive identities still hold. It reconciles Intune inventory with Entra registrations.

Each saved report run keeps its results, so your team can compare findings between runs. Access reviews go to owners, with decisions, exceptions, and follow-up evidence. Hyphen Agent answers questions about saved evidence and shows the references behind each answer.

Hyphen does not certify your organization and does not guarantee an assessment result. Control references on the Hyphen CMMC page show alignment, not full satisfaction of a requirement. You define the scope, you keep the policies, and you validate the controls. Your assessor decides whether the evidence is sufficient.

hyphen

Request a demo of Level 2 evidence.

FAQs

What is a self-assessment?

Your organization assesses its own system. You record the results, enter them in SPRS, and affirm.

Level 1 has no point score. Each of the 15 requirements must be MET. Level 2 (Self) uses the CMMC Scoring Methodology and one assessment every three years.

What is a third-party assessment?

A C3PAO assesses your system for Level 2 (C3PAO). DCMA DIBCAC assesses your system for Level 3.

During the suspension, a new solicitation may not require either path.

What is the current rollout status?

Phase 1 self-assessment requirements continue. Phase 2 is suspended. On the check date, we found no new official date.

Read the status section for the sources.

What is the difference between NIST SP 800-171 and CMMC?

NIST SP 800-171 Revision 2 is the set of 110 security requirements for CUI. DFARS 252.204-7012 already requires contractors to implement it.

CMMC adds an assessment framework, a scoring method, a status in SPRS, and an affirmation.

What is scope?

Scope is the set of assets that an assessment covers. At Level 1, the scope is the systems that process, store, or transmit FCI.

At Level 2, the scope also includes assets that protect CUI assets, and the other categories in 32 CFR 170.19.

How long does preparation take?

Preparation time depends on your scope, the state of your controls, the quality of your documents, and the time your team can give.

Do not use a universal estimate. Ask for an estimate that uses your scope.

What does it cost?

The cost of a CMMC assessment depends on the level, the network, the current posture, and the market.

The DoW does not count the cost to implement current requirements, such as DFARS 252.204-7012, as a CMMC cost.

Official references

This guide is general information, not legal advice. Your contract, your data, and your assessment scope determine your path.