What is CMMC? Explained simply

The problem CMMC solves

The Department of Defense, which now calls itself the Department of War in its own documents, shares two kinds of unclassified information with the companies it buys from. Federal Contract Information (FCI) is information made for or provided by the government under a contract and not meant for the public; public website content and simple payment details do not count.

Controlled Unclassified Information (CUI) is information that a law, regulation or government-wide policy requires or permits the government to protect or limit in how it is shared, such as controlled technical drawings.

Contract clauses have required contractors to protect that information for years; the Department's rule describes the NIST requirements as in place since 2017. What was missing was a common way to check.

The Cybersecurity Maturity Model Certification (CMMC) program adds one: a defined assessment, a status recorded in a Department system, and a yearly signed statement from a senior official of your company.

CMMC writes almost no requirements of its own. Its main standard is Special Publication 800-171 from the National Institute of Standards and Technology (NIST), which is why the two names travel together.

What CMMC actually asks of you

Your contract names one of four CMMC statuses, which sets the requirements, who checks them and how often. The Department picks it from the kind of information involved; you do not.

Results go into the Supplier Performance Risk System (SPRS), the Department's supplier database. Level 1 is pass or fail: every requirement must be met. Level 2 is scored.

You start at 110 and subtract 1, 3 or 5 points for each requirement not met, depending on its weight, so a score can fall below zero.

A prime contractor passes the requirement down. A subcontractor that handles only FCI needs Level 1 (Self). One that handles CUI needs at least Level 2 (Self).

What CMMC is not

Not always a certificate. Level 1 and Level 2 (Self) are self-assessments, and the rule's preamble says certification is never required for Level 1. The common claim that CMMC allows no self-assessment is backwards: today self-assessed statuses are the only ones a new contract may require.

Not repealed. The program rule is unamended since it took effect on December 16, 2024. The suspension works through instructions to contracting officers.

Not government-wide. It applies to Department of War contracts and subcontracts. A government-wide CUI rule under the FAR is still a proposal.

Not a NIST certificate. NIST writes the requirements; under the rule, assessments are done by you, a C3PAO or the Department's assessors.

Not FedRAMP. The Federal Risk and Authorization Management Program (FedRAMP) authorizes cloud services. The CMMC rule uses it as a test for your cloud provider: one that stores or handles your CUI must be FedRAMP Moderate authorized or meet equivalent requirements.

Not for every supplier. A contract solely for commercially available off-the-shelf (COTS) items is exempt, and so are government systems a contractor runs on the government's behalf.

How it works, end to end

The steps are much the same at every level; the requirements and the assessor change.

A POA&M is the only way to be eligible with gaps, and the rule keeps it narrow. None is allowed at Level 1. At Level 2 your score must be at least 80 percent of the maximum (88 of 110).

Only 1-point requirements may go on the plan, plus one exception: encryption that is in use but not FIPS-validated. Six requirements may never go on it, including the System Security Plan itself and three physical access requirements. That gives you a Conditional status.

You then have 180 days to close every item and pass a closeout assessment; if you miss that, the Conditional status expires.

A worked example

Take an illustrative company: 18 people, designing cable assemblies for a prime contractor's vehicle program. The prime sends drawings marked as CUI and a subcontract that names Level 2 (Self).

First they find where the drawings go: email, a shared drive and two engineering laptops. They move that work onto separate accounts and a FedRAMP Moderate authorized cloud file service, keeping the office and accounting systems, which are separated from that work and never touch the drawings, out of scope, and write a System Security Plan for that smaller set of systems.

Their first internal pass finds a gap the rule never allows on a POA&M: visitors to the design office are not escorted. They fix it before recording anything. Three other gaps are worth one point each, so they score 107 of 110, list the three on a POA&M, post the result in SPRS and the owner signs the affirmation.

That is Conditional Level 2 (Self).

Within 180 days they close the three items, repeat the assessment for those items, post 110 and affirm again. The status becomes Final Level 2 (Self). The owner reaffirms every year, and in three years they self-assess again.

A third-party certificate the prime expected from November 2026 is on hold.

Who does what

Government, a private accreditation body and you share the work.

How to read or verify a CMMC status

A self-assessed status has no certificate. It exists as an SPRS entry: the level, the status date, the scope, the CAGE codes (the Department's supplier codes) covered, the result and, for Level 2, the score and whether a POA&M is open. A C3PAO or DIBCAC assessment also produces a Certificate of CMMC Status.

One issued by a C3PAO shows at least the CAGE codes, the C3PAO's name, the assessment's unique identifier, your company's name, and the status date and level.

A status must also be current. The contract clause defines that: a Conditional status no older than 180 days, a Final Level 1 no older than one year, a Final Level 2 or 3 no older than three years, and in every case an affirmation no older than one year and no change in compliance since the status date.

A prime must confirm a subcontractor's current status before award; the clause does not say how. Ask for the CMMC UID, level, status date and latest affirmation date, plus the certificate for any third-party status. To check a C3PAO or an assessor, look them up on the Cyber AB Marketplace.

A Level 1 result is not a certificate.

What it costs and how long it takes

We found no public price list for C3PAO assessments; each C3PAO sets its own fee. The only official figures are the Department's own, published with the final rule in October 2024. For a small business they are:

The Department assumes the requirements are already in place, because existing clauses required them, so none of these figures includes the security work itself. Your real cost depends on the size of your scope, how many gaps you have, and whether your cloud and IT providers already meet the requirements.

On time, the rule sets clocks, not project lengths: 180 days to close a POA&M, one year between affirmations, three years between Level 2 and Level 3 assessments. None of the official documents we read says how long getting ready takes.

What changed in 2025 and 2026

In short: the rule is in force, Phase 1 started, Phase 2 is suspended.

While the suspension lasts, new contracts may name only Level 1 (Self) or Level 2 (Self), and no waivers are granted. Solicitations already out that ask for Level 2 (C3PAO) or Level 3 are to be amended.

Contracts already signed are to have Level 2 (C3PAO) or Level 3 requirements removed by modification before the next option is exercised or at the next scheduled administrative change; until then the text stands.

The safeguarding clause (DFARS 252.204-7012) remains in effect, with its NIST Revision 2 baseline, its 72-hour cyber incident reporting and its 90-day preservation of affected system images.

The rewritten clause list the deviation tells contracting officers to use drops the older NIST assessment clauses (DFARS 252.204-7019 and 7020) and adds one (DFARS 252.240-7997) for government-led Medium and High assessments. The published regulation still carries the older clauses, so the version in your contract is what binds you.

Separately, NIST moved all FIPS 140-2 cryptographic module certificates to its Historical List in September 2026. Encryption protecting CUI must be FIPS-validated, so ask providers which validation their modules now carry.

Where it leads next

Three things are pending. First, a CMMC Reform Task Force review of 60 days from July 13, so due around September 11. As of September 29, 2026 no findings are published on the Department's CMMC page.

Second, NIST Revision 3. NIST published it in May 2024 with 97 requirements in 17 families and withdrew Revision 2 on May 14, 2024. Defense contracts still require Revision 2: the rule incorporates it and the clause contracting officers must use names it.

A rule to move CMMC to Revision 3 (RIN 0790-AM01) is listed as an interim final rule for July 2026, but none has been published. Our Revision 3 article covers the differences.

Third, the proposed FAR clause would bring Revision 3 to CUI across federal contracts. It has no legal effect until final.

Until then, build to Revision 2, keep your SPRS entry and affirmation current, and ask your contracting officer or prime what your contract requires.

What we could not verify

Whether a Level 2 (C3PAO) certificate already earned will count after the review; no published document says.

Who will face the "select Government-led assessments" the Chief Information Officer's memorandum mentions, and who runs them.

When contracts first used the rewritten assessment clause dated February 2026. Only Revision 3 of the deviation is posted.

Whether the Revision 3 rule survives the suspension, and how long any transition would be.

What C3PAOs charge. We found no public fee schedule, and we do not print averaged figures.