CMMC 2.0 is the Department of Defense's program for verifying that contractors protect sensitive federal information. If your firm handles Federal Contract Information or Controlled Unclassified Information on a DoD contract, you now need a specific CMMC status — self-assessed or third-party certified — to remain eligible for award. Here is exactly what that means for you, and what to do about it.

The Cybersecurity Maturity Model Certification (CMMC) program is governed by 32 CFR Part 170, published in October 2024 and effective in December 2024. It gives the DoD a consistent way to confirm that companies in the defense supply chain have actually implemented the cybersecurity requirements their contracts already demand — rather than simply promising they have.

CMMC protects two kinds of information:

The level of CMMC you need depends entirely on which of these you touch. That single distinction drives everything else, so settle it before anything else: FCI only points you to Level 1; any CUI points you to Level 2 or higher.

CMMC has three levels, each building on the one below. The requirement counts below come directly from the program rule (32 CFR § 170.14).

For most small firms in IT and cyber, the live question is Level 1 versus Level 2. Level 3 is reserved for a narrow set of programs — advanced or breakthrough technology, large aggregations of CUI, or systems whose compromise would create widespread DoD risk — and it requires you to hold a Final Level 2 certification first.

What this means for you: map your contracts and data flows now. If you only ever handle FCI, your obligation is a Level 1 self-assessment. The moment CUI enters a system you operate, you are in Level 2 territory — and the bar jumps from 15 requirements to 110.

CMMC recognizes three assessment paths, and the contract tells you which one applies:

Whichever path applies, your result becomes a formal CMMC Status that lives in the Supplier Performance Risk System (SPRS). (C3PAO and DIBCAC results are recorded in the CMMC instance of eMASS, but the affirmation that keeps your status active always goes into SPRS.) Achieving a higher status satisfies the lower ones for the same scope — a Level 2 (C3PAO) status, for example, also covers your Level 1 and Level 2 (Self) obligations.

This is the part that changes, so it is the part to get right. CMMC requirements began appearing in DoD contracts on November 10, 2025, when the revised acquisition clause DFARS 252.204-7021 took effect. From there, the DoD is phasing requirements in over three years, under 32 CFR § 170.3(e):

What this means for you: the deadline that matters most for small firms handling CUI is November 10, 2026 — roughly five months out as of this writing. A Level 2 certification is not a same-week exercise, and prime contractors are not waiting for the government: many are already telling their subcontractors to produce a Level 2 status now or lose purchase orders. If certification is in your future, the runway is already short.

For a Level 2 effort — the one most small IT and cyber firms face — the work breaks into a predictable sequence:

A practical note for cloud users: if you use a cloud service to handle CUI, that service generally must be FedRAMP Moderate authorized — or meet the FedRAMP Moderate equivalent baseline under DoD policy. That requirement quietly disqualifies a lot of commodity tools, so check it early.

You do not have to be perfect on day one. For Level 2 and Level 3, the rule permits a limited Plan of Action and Milestones (POA&M) — a documented plan to close specific gaps. If your assessment score reaches at least 88 — 80% of the 110-point maximum — and every gap you leave open is POA&M-eligible, you can earn a Conditional CMMC Status and remain eligible for award. But two conditions bind hard: certain critical requirements cannot be placed on a POA&M at all, and every open item must be closed within 180 days, verified by a closeout assessment. Miss that window and the conditional status expires — with the contract consequences that follow.

The annual affirmation is the most underestimated part of CMMC. Under 32 CFR § 170.22, a senior Affirming Official — not the IT lead, but an executive with authority over compliance — must personally attest in SPRS that the organization meets its requirements, after every assessment and annually thereafter. An outdated or missing affirmation makes your CMMC Status inactive and can cost you contract eligibility.

What this means for you: that signature carries False Claims Act exposure. Affirming compliance you do not actually have is a false statement to the government, and cybersecurity affirmations have become a focus area for both regulators and whistleblowers. Build the recordkeeping and control validation that let your Affirming Official sign honestly — every year, not just at assessment time.

CMMC does not flow down as a blanket requirement. Under 32 CFR § 170.23, the level a subcontractor needs is driven by the data that subcontractor will handle:

When a prime contract requires Level 3, the minimum flow-down to subcontractors handling CUI is Level 2 (C3PAO), unless the government specifies otherwise. If you are a small sub, do not assume your prime's obligations are yours — but do confirm, in writing, exactly what data you will touch and what status they expect.

There is no single price tag, and any guide that gives you one is guessing. The DoD itself ties cost to the level required, the complexity of your network, your existing security posture, and market demand for assessors. A Level 1 self-assessment is largely internal effort; a Level 2 C3PAO certification is a multi-month project with real outside cost. The honest planning assumption for Level 2 is months of work and meaningful spend — not a quick fix before a bid is due.

Five moves to make this quarter:

Do small businesses really have to comply with CMMC? Yes. CMMC applies to any contractor or subcontractor that processes, stores, or transmits FCI or CUI on a DoD contract — regardless of size. If you do neither, you fall outside the assessment requirement. If you handle FCI only, a Level 1 self-assessment applies; any CUI puts you at Level 2 or higher.

What's the difference between CMMC Level 1 and Level 2? Level 1 protects FCI and covers the 15 basic safeguarding requirements from FAR 52.204-21, assessed by an annual self-assessment. Level 2 protects CUI and covers all 110 requirements in NIST SP 800-171 Revision 2, assessed either by self-assessment or by a third-party C3PAO on a three-year cycle — the contract specifies which.

When does CMMC become mandatory? It already is. Requirements began appearing in DoD solicitations on November 10, 2025 under DFARS 252.204-7021, starting with self-assessments. Level 2 C3PAO certification becomes a condition of award where required beginning November 10, 2026, with Level 3 following in 2027 and full implementation by 2028.

How much does CMMC certification cost? It depends on the required level, the complexity of your network, your current security posture, and assessor demand. A Level 1 self-assessment is mostly internal effort; a Level 2 C3PAO certification is a multi-month project with meaningful outside cost. Be skeptical of any flat figure.

Can I win a contract before I'm fully certified? You must have the CMMC status the solicitation requires recorded in SPRS at the time of award. That status can be conditional — earned by scoring at least 88 of 110 points and carrying eligible gaps on a POA&M — but those gaps must be closed within 180 days, and certain critical requirements cannot be deferred.

Does CMMC apply to subcontractors? Yes. Requirements flow down based on the data the subcontractor handles: FCI only means Level 1, CUI means Level 2, and CUI under a prime that holds a Level 2 (C3PAO) or Level 3 status means Level 2 (C3PAO).

All primary. Verified as of June 2026.