CMMC 2.0 — Cybersecurity Maturity Model Certification

Why does it matter?

CMMC replaces an unchecked promise with a verified status. Before it, DFARS 252.204-7012 required NIST SP 800-171 compliance but, as DoD's own CMMC 101 brief notes, no compliance assessment and no plan of action close-out date. Under Part 170 a program manager selects a level and assessment type for each procurement, and the contractor must hold it before award (32 CFR 170.3(d)).

Key benefits include:

• A status checked before award

The contractor must have, and keep for the life of the contract, a current CMMC status at or above the required level for every system that processes FCI or CUI (DFARS 252.204-7021(d)).

• Three levels tied to three source documents

Level 1 uses the 15 requirements of FAR 52.204-21, Level 2 the 110 of NIST SP 800-171 Rev. 2, and Level 3 adds 24 selected from NIST SP 800-172 (32 CFR 170.14).

• Limited remediation windows

A Conditional status allows a plan of action and milestones at Levels 2 and 3, closed out within 180 days. Level 1 allows none (170.21).

• Supply chain coverage

Primes flow the right level down to every subcontractor that handles FCI or CUI, and subcontractors affirm before award (170.23; DFARS 252.204-7021(d)(4)).

• Annual accountability

An Affirming Official, a senior representative of the organization, affirms continuing compliance in SPRS after each assessment and every year after (170.22).

How does it work?

Part 170 (89 FR 83092, published October 15, 2024) defines the levels, the assessment types and the assessment ecosystem. The DFARS rule (90 FR 43560, published September 10, 2025, effective November 10, 2025) places the provision at 252.204-7025 and the clause at 252.204-7021 in solicitations and contracts. The requiring activity names one of four statuses: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC).

Part 170 phases the requirement in over four stages, each starting one calendar year after the last (170.3(e)). Phase 1 began on November 10, 2025 with Level 1 and Level 2 self-assessments. Phase 2, planned for November 10, 2026, would add Level 2 (C3PAO) as a condition of award, Phase 3 would require Level 2 (C3PAO) and Level 3 (DIBCAC) in all applicable solicitations, and Phase 4 is full implementation, which DFARS 204.7504 dates from November 10, 2028.

On July 13, 2026 the Department of War suspended the phased schedule, including the Phase 2 transition, set up a CMMC reform task force for a program review, and told program managers they may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) while the suspension lasts. The Part 170 text on eCFR, current to October 9, 2026, still shows its December 16, 2024 version, so the regulation itself has not been amended.

Key Elements

• Levels and statuses

Level 1 (Self) protects FCI with 15 requirements, Level 2 protects CUI with 110, and Level 3 adds 24 enhanced requirements for CUI (170.14). A status is Conditional or Final, except Level 1, which allows no plan of action. A Final Level 1 status is current for one year and a Final Level 2 or 3 status for three (DFARS 252.204-7021(a)).

• Assessment Scope

Before any assessment the organization specifies the assets to be assessed. At Level 2 they fall into CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets, each with its own documentation duties (170.19).

• SPRS and eMASS

Self-assessment results and affirmations go into the Supplier Performance Risk System (SPRS). C3PAO and DIBCAC results go into the CMMC instantiation of eMASS, which passes them to SPRS, and each assessment receives a ten-character CMMC unique identifier (170.15 to 170.18; DFARS 252.204-7021(a)).

• Affirming Official

A senior representative of each organization, prime or subcontractor, affirms continuing compliance after every assessment and annually. DFARS treats a status as current only while the affirmation is less than one year old (170.22; DFARS 252.204-7021(a)).

• Assessment ecosystem

The Accreditation Body authorizes C3PAOs, which use CMMC Certified Assessors and Professionals. DCMA DIBCAC performs Level 3 assessments and may assess any contractor under DFARS 252.204-7020, and its results take precedence over an earlier status (170.6 to 170.13, 170.16(a)(1)(iv)).

• Subcontractor flow-down

A subcontractor handling only FCI needs Level 1 (Self). One handling CUI needs at least Level 2 (Self), or Level 2 (C3PAO) when the prime contract requires Level 2 (C3PAO) or Level 3 (DIBCAC) (170.23).

What does it cover?

The program covers DoD solicitations and contracts under which a contractor or subcontractor processes, stores or transmits FCI or CUI on unclassified contractor information systems, including commercial products and services but not contracts solely for commercially available off-the-shelf items (170.3; DFARS 204.7504). It does not apply to Federal information systems that contractors operate on the Government's behalf (170.3(b)). DoD's CMMC FAQ states that it applies to domestic and international companies alike.

What are its objectives?

The rule has one stated aim, to verify that defense contractors safeguard FCI and CUI, and it turns that aim into duties for the contractor.

Hold a current CMMC status at or above the level the contract names for every information system that handles FCI or CUI.

Define and document the Assessment Scope before each assessment (170.19).

Score each assessment under the CMMC Scoring Methodology and enter the results in SPRS (170.24).

Close any plan of action within 180 days or lose the Conditional status (170.21).

Affirm continuing compliance every year through an Affirming Official (170.22).

Flow the correct level down to subcontractors before award (170.23).

Framework in Context

CMMC verifies requirements that already exist: FAR 52.204-21 for FCI, and DFARS 252.204-7012 with NIST SP 800-171 Rev. 2 for CUI. It is the second version of a program whose first DFARS interim rule took effect on November 30, 2020; DoD announced the revised program in November 2021, and its statutory basis is section 1648 of the National Defense Authorization Act for Fiscal Year 2020. A cloud service provider that holds CUI must meet the FedRAMP requirements in DFARS 252.204-7012 (170.19(c)(2)). The CMMC Level 2 and CMMC Level 3 pages on this site cover those levels in detail.

Common Framework Mappings

CMMC maps most directly to NIST SP 800-171, NIST SP 800-172 and DFARS 252.204-7012, which supply its requirements. Organizations also map it to NIST SP 800-53, ISO/IEC 27001, the NIST Cybersecurity Framework and the CIS Critical Security Controls to reuse evidence, and to FedRAMP where a cloud provider holds CUI.

Mapped frameworks include:

CIS Controls v8.1

DFARS 252.204-7012

FedRAMP Rev. 5

ISO 27001:2022

NIST CSF 2.0

NIST 800-171 Rev.2

NIST SP 800-172

NIST 800-53 Rev.5