CMMC requirements are the security conditions the US Department of Defense sets for contractors that handle defense information: three levels, each verified by a self-assessment, a third-party assessment or a government assessment.
| Level | Protects | Requirements | Assessment |
|---|---|---|---|
| Level 1 | FCI | 15 requirements from FAR clause 52.204-21 | Annual self-assessment |
| Level 2 | CUI | 110 requirements from NIST SP 800-171 Rev. 2 | Self-assessment or C3PAO assessment, every three years |
| Level 3 | CUI | 24 selected requirements from NIST SP 800-172, added to Level 2 | Government assessment by DCMA DIBCAC, every three years |
Source: the 32 CFR part 170 final rule in the Federal Register, and the November 10, 2025 start of the rollout from the DFARS final rule. The program rule defines four rollout phases; the dates after Phase 1 are not printed in it and are computed below.
What CMMC is and why it exists
The program rule describes CMMC as a way to verify that defense contractors and subcontractors have implemented the required security measures to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). FCI is information provided by or generated for the government under a contract that is not meant for public release. CUI is information the government creates or possesses, or that a contractor handles for it, that requires safeguarding under law or policy.
The program rule says the DoD limits the burden of CMMC compliance by requiring annual affirmations rather than annual assessments. Each contractor holds a CMMC status, which records its level and assessment type. Security teams working toward these controls will find related ideas in the guide to zero trust for defense networks.
The two rules: 32 CFR part 170 and the DFARS rule
CMMC reached contractors through two separate regulations that work together.
- The program rule, 32 CFR part 170. DoD published it in the Federal Register on October 15, 2024. It defines the levels, the assessment types, the affirmation process, and the phased implementation plan. Its effective date was December 16, 2024.
- The acquisition rule, 48 CFR (DFARS). DoD issued a final DFARS rule on September 10, 2025. It adds the contract clauses that let contracting officers require a CMMC level, and it states: “This rule is effective November 10, 2025.”
The two rules are linked on timing. Under the program rule, Phase 1 begins on the later of the two rules’ effective dates, which makes the DFARS rule’s November 10, 2025 effective date the start of the rollout.
The three CMMC levels
The table above summarises the levels. Under the program rule, every Level 1 requirement must be fully met and no plan of action and milestones (POA&M) is allowed. At Level 2 a limited POA&M is permitted, but open items must be closed within 180 days of the Conditional status. A contractor must hold Final Level 2 (C3PAO) status before it can seek Level 3.
Self-assessment versus C3PAO assessment
Level 2 has two forms, and the solicitation states which one applies.
- Level 2 (Self). The organization assesses itself against the 110 NIST SP 800-171 requirements and submits the results to the Supplier Performance Risk System (SPRS). Under the program rule, the assessment repeats every three years.
- Level 2 (C3PAO). A Certified Third-Party Assessment Organization (C3PAO) conducts the assessment, and results are entered in the CMMC eMASS system. The program rule also sets a three-year cycle for this assessment.
After each assessment, and after any POA&M closeout, an Affirming Official at the company must submit an affirmation of compliance in SPRS. The program rule requires affirmations to be renewed every year after the Final status date, and a missed annual affirmation causes the status to lapse. The DFARS rule adds that contracting officers must validate CMMC compliance before extending the period of performance or exercising an option, and it requires contractors to give them the CMMC unique identifiers so the status can be checked in SPRS.
The DFARS rule also explains why some contracts need a C3PAO: it says CUI categories from the DoD Organizational Index group “would necessitate a C3PAO assessment, at a minimum.”
What each level means in practice
Level 1 applies where a contractor handles FCI. The program rule gives it 15 requirements from FAR clause 52.204-21, and the self-assessment and affirmation are repeated annually. Level 2 applies where a contractor handles CUI, and it brings in all 110 NIST SP 800-171 requirements. Level 3 adds 24 selected requirements from NIST SP 800-172 and is assessed by the Defense Contract Management Agency’s DIBCAC rather than a commercial assessor.
NIST SP 800-171 and the link to existing contracts
Level 2 is built directly on NIST SP 800-171 Rev. 2, the set of 110 security requirements for protecting CUI in nonfederal systems, as the program rule sets out. The program rule notes that DFARS clause 252.204-7012 already requires defense contractors to provide adequate security on covered systems by implementing the 110 security requirements of NIST SP 800-171, so CMMC adds verification and a recorded status to an existing obligation. The same rule points to NIST SP 800-171 requirement 3.12.4, which calls for system security plans that describe system boundaries and how security requirements are implemented. Gaps that remain at Level 2 are tracked on a POA&M.
The four-phase rollout
Section 170.3(e) of the program rule defines each phase relative to the previous one: Phase 1 begins on the later of the two rules’ effective dates, and Phases 2, 3 and 4 each begin one calendar year after the phase before. The rule does not print calendar dates for Phases 2 to 4. The dates below are computed from the November 10, 2025 Phase 1 start, and are not dates stated in the rule.
- Phase 1 (begins November 10, 2025, per the DFARS rule). DoD plans to require Level 1 (Self) or Level 2 (Self) status as a condition of award for applicable solicitations. It may also require one of those statuses before exercising an option on an existing contract, and may choose Level 2 (C3PAO) in place of Level 2 (Self).
- Phase 2 (computed: November 10, 2026). Phase 1 requirements continue, and DoD adds Level 2 (C3PAO) as a condition of award. It may defer that requirement to an option period, and it may also require Level 3 status.
- Phase 3 (computed: November 10, 2027). Level 2 (C3PAO) extends to all applicable solicitations as a condition of award and of exercising options. DoD intends to require Level 3 for all applicable solicitations, with possible deferral to an option period.
- Phase 4 (computed: November 10, 2028). DoD includes CMMC requirements in all applicable solicitations and contracts, including option periods on contracts awarded before Phase 4 began.
The DFARS rule uses the same November 2028 boundary: until November 9, 2028 its clause applies where the program office or requiring activity determines a specific CMMC level is required, and on or after November 10, 2028 it applies where the contractor will use information systems to process, store or transmit FCI or CUI. Until then, a given solicitation states its own requirement.
Where to follow CMMC in person
CMMC is a standing topic at government and military cyber events, where DoD speakers, assessors and contractors compare notes on rollout. The overview of government cybersecurity conferences lists events worth knowing, and the AFITC conference guide explains the Air Force event held in Montgomery, Alabama. How CMMC fits with NIST SP 800-171, FedRAMP and the agencies involved is summarised in the defense cybersecurity guide.
Frequently asked questions
Does CMMC apply to subcontractors?
Yes. The program rule applies to defense contractors and subcontractors that handle FCI or CUI, and the required level depends on the information involved.
What is the difference between Level 1 and Level 2?
Per the program rule, Level 1 protects FCI with 15 requirements and an annual self-assessment. Level 2 protects CUI with the 110 requirements of NIST SP 800-171 Rev. 2 and is assessed every three years by self-assessment or a C3PAO.
When did CMMC start appearing in contracts?
The DFARS rule took effect on November 10, 2025, which started Phase 1 of the rollout.
Can a contractor have open items at Level 2?
Yes. The program rule allows a POA&M at Level 2 and requires open items to be closed within 180 days of the Conditional status.
How often must affirmations be submitted?
An Affirming Official submits an affirmation in SPRS after each assessment and then annually after the Final status date.
Photo credits: panumas nikhomkhai (Pexels License); Christina Morillo (Pexels License).
