CMMC 2.0: What Defense Contractors Need to Know
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a DoD requirement that affects every contractor handling Controlled Unclassified Information (CUI) or Federal Contract Information (FCI). This guide covers what it is, what it requires, and how to prepare.
What Is CMMC 2.0?
CMMC 2.0 is the Department of Defense's framework for verifying that defense contractors have adequate cybersecurity practices in place to protect sensitive government information. It replaced the original CMMC 1.0 model in November 2021 and was formally embedded into the DFARS acquisition process through a program rule effective December 16, 2024.
Unlike previous self-attestation models, CMMC 2.0 introduces third-party assessment requirements for contractors handling the most sensitive CUI. The CMMC requirement itself flows through DFARS clause 252.204-7021. If your contract includes that clause, CMMC applies to you. Contractors subject to DFARS 252.204-7012 also carry NIST SP 800-171 implementation obligations regardless of CMMC status.
The Department of Defense (now also styled the Department of War) officially paused Phase 2 of the CMMC rollout on July 13, 2026, which would have introduced mandatory third-party C3PAO assessment requirements for Level 2 contractors. All other CMMC 2.0 requirements remain in force: the program rule is still effective, Level 1 and Level 2 self-attestation requirements can still appear in contracts, NIST SP 800-171 implementation obligations under DFARS 252.204-7012 are unchanged, and SPRS reporting requirements continue. Contractors should continue building their compliance posture. The pause affects assessment timing, not the underlying regulatory requirements.
The Three Levels of CMMC 2.0
CMMC 2.0 streamlined the original five-level model down to three. Your required level depends on the type of information your contract involves.
Applies to contractors handling Federal Contract Information (FCI) only. Requires annual self-attestation against 15 basic safeguarding requirements drawn from FAR 52.204-21. No third-party assessment required.
Applies to contractors handling Controlled Unclassified Information (CUI). Aligns fully with NIST SP 800-171 Rev 2, which contains 110 security requirements across 14 domains. Most defense contractors fall into this level.
Applies to contractors on the most critical DoD programs, handling the most sensitive CUI. Builds on Level 2 with additional requirements drawn from NIST SP 800-172. Assessments are conducted by DCMA DIBCAC (Defense Contract Management Agency, Defense Industrial Base Cybersecurity Assessment Center).
Where Things Stand in 2026
The CMMC 2.0 program rule became effective December 16, 2024. The DFARS rule that began contract implementation, which allows CMMC requirements to appear in solicitations and contracts, took effect November 10, 2025. DoD is phasing requirements into contracts through a multi-phase rollout. Phase 1, which began with the November 2025 DFARS rule, allows Level 1 and Level 2 self-attestation requirements to appear in new contracts. Phase 2, which would have introduced mandatory C3PAO third-party assessment requirements for Level 2 contractors, was officially paused by DoD on July 13, 2026. The pause affects assessment scheduling, not the underlying NIST SP 800-171 implementation obligations. Contractors subject to DFARS 252.204-7012 must still implement all 110 requirements and maintain their SPRS scores. Preparation should continue regardless of the Phase 2 pause.
The 14 Domains of NIST SP 800-171 (Level 2)
Level 2 maps directly to NIST SP 800-171 Rev 2. Here are the 14 domains every Level 2 contractor must address.
Common Contractor Missteps
These are the gaps assessors find most often. Knowing them before your assessment is the difference between a clean result and a costly remediation cycle.
Submitting a SPRS score is a reporting requirement, not a compliance certification. A score of 110 does not mean you pass a C3PAO assessment. Assessors verify implementation, not scores.
The SSP is the foundation of your assessment. Contractors frequently have an SSP that is outdated, incomplete, or does not accurately reflect their actual environment. Assessors will compare your SSP to what they observe.
Many contractors have CUI spread across systems that were never intended to be in scope. Failing to define and document your CUI boundary before assessment means more systems to secure and more findings.
Not every gap is a disqualifier, but undocumented gaps are. A well-maintained POA&M demonstrates that you know where you stand and have a credible remediation plan.
Having a written IR plan is required. Having one that has never been exercised is a finding. Assessors ask for evidence of tabletop exercises or drills, not just the document.
DFARS 252.204-7012 requires reporting cyber incidents to DoD within 72 hours. Many contractors are unaware of this obligation or lack a process to execute it under pressure. This is where F.I.R.C.E. was built to help.
How to Prepare for a CMMC Assessment
Identify every system, location, and process that touches CUI. Narrow the scope before you start remediating. A smaller, well-defended boundary is better than a large, poorly defended one.
Evaluate your current practices against all 110 requirements. Use the CMMC Readiness Assessment tool to identify gaps before a C3PAO does.
Document your environment, your controls, and how each NIST requirement is met. This is a living document, not a one-time exercise.
For every requirement you cannot fully meet today, document the gap, the remediation plan, and the target completion date. Assessors expect to see this.
Access control, incident response, and configuration management all depend on people doing the right thing. CLP-eligible training ensures your team understands what is required and why.
Run a tabletop exercise. Walk through a simulated cyber incident from detection through the 72-hour DoD reporting requirement under DFARS 252.204-7012. Document the exercise as evidence.
Related Compliance Guides
Understand the technical frameworks behind CMMC, how 800-171 and 800-53 relate, and where F.I.R.C.E. fits into your 72-hour incident response obligation.
CLP-eligible, self-paced courses covering the full regulatory framework. Built by a 20-year federal procurement practitioner.
Ready to Build Your CMMC Compliance Foundation?
Our FAR/DFARS/CMMC training programs are built for defense contractors who need to understand the regulatory framework, not just pass a quiz. CLP-eligible, self-paced, and updated for 2026.