On this page · 11 sections
- What changed on 13 July 2026, and what did not
- CMMC Level 1 vs Level 2, side by side
- Which level applies to you
- Software and IT subcontractors: where you sit
- Self-assessment vs C3PAO in 2027
- SPRS: the score every bid checks
- Worked cost example: a 45-person machine shop
- The FedRAMP link for software vendors
- What to do before your next bid
- How eCorpIT can help
- References
Summary. On 13 July 2026 the Department of War (DoW) suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) programme, which was due to start on 10 November 2026, and set up a reform task force. DoW's CMMC page says the programme is paused in Phase 1, which began on 10 November 2025, and may require only self-assessments at two levels. Level 1 protects Federal Contract Information (FCI): a yearly self-assessment and affirmation against the 15 requirements in FAR 52.204-21, with no plan of action and milestones (POA&M) allowed. Level 2 protects Controlled Unclassified Information (CUI): a self-assessment every three years against the 110 requirements of NIST SP 800-171 Revision 2, a yearly affirmation, and a POA&M only at a score of 88 or more, closed within 180 days. Both results go into SPRS. DFARS 252.204-7012 still applies in full. A third-party (C3PAO) assessment is no longer heading towards being the default, but the rule still provides for one, and a Level 2 (C3PAO) status meets any Level 2 (Self) clause. Our verdict: FCI-only suppliers should finish Level 1 now; CUI handlers should self-assess at Level 2 to a score they can defend; buy a C3PAO assessment only when a prime asks in writing or you want cover against Phase 2 returning.
About this article. Written for US defence suppliers and the software, IT and cloud firms that work for them. We checked every rule on 13 November 2026 against primary sources: the eCFR text of 32 CFR part 170, the DFARS and FAR clauses on acquisition.gov, the Federal Register, the Unified Agenda on reginfo.gov, FedRAMP's rules and DoW's own announcements (read via Internet Archive copies of October and November 2026, as DoW's sites refused our requests). This is general information, not legal advice; confirm your obligations with your contracting officer or counsel. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
What changed on 13 July 2026, and what did not
DoW is the secondary name the Department of Defense has used since Executive Order 14347 of 5 September 2025; the regulations still say DoD.
The suspension's main target was one planned switch. Under 32 CFR 170.3, Phase 2 would have begun one calendar year after Phase 1, adding a Level 2 assessment by a certified third-party assessment organisation (C3PAO) as a condition of award for applicable contracts. DoW's announcement also suspended the later implementation milestones and opened a 60-day review. Everything owed in Phase 1 stays. DoW says Phase 1 self-assessment requirements remain in place, that it will enforce NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments, and that the pause does not remove the duty to protect information under DFARS 252.204-7012.
The table draws on those two DoW sources, 32 CFR 170.3 and the eCFR version history, which shows no amendment to part 170 since 16 December 2024.
| Item | Before 13 July 2026 | As of 13 November 2026 |
|---|---|---|
| Phase 1 (self-assessments as a condition of award) | In force since 10 November 2025 | Unchanged |
| Phase 2 (Level 2 C3PAO for applicable CUI awards) | Due 10 November 2026 | Suspended, no new date |
| Phases 3 and 4 | Due 10 November 2027 and 2028 | Suspended with Phase 2 |
| Assessments DoW says it may require | Self, C3PAO and DIBCAC, phased in | Self-assessments at Levels 1 and 2, plus selected government-led assessments |
| Standard for CUI | NIST SP 800-171 Revision 2 | Unchanged |
| DFARS 252.204-7012 (safeguarding, 72-hour reporting) | In force | Unchanged |
| DFARS 252.204-7019 and 7020 (SPRS score under 3 years old) | In force | Unchanged |
| 32 CFR part 170 text | Effective 16 December 2024 | Not amended |
| Reform task force | None | Report was due within 60 days; not published |
Reported details matter for planning. A Clark Hill alert of 17 July 2026 says DoW CIO Kirsten Davies and Under Secretary for Acquisition and Sustainment Michael Duffey cited internal estimates that the next phases could cost small and mid-sized businesses more than $7 billion a year, with roughly 100 accredited C3PAO assessors for more than 100,000 companies. It adds that officials did not rule out cancelling the programme. Federal News Network reported on 27 October 2026 that it had obtained an early-September summary of the task force's findings, with options such as restarting Phase 2 for a narrower group within 90 days and, through rulemaking, extending the POA&M window to 270 days. Treat these as reported, not official: DoW has not published the report and declined to comment to the outlet.
The regulations have not moved. The CMMC rule took effect on 16 December 2024, and the DFARS clauses that put CMMC into contracts took effect on 10 November 2025 under DFARS Case 2019-D041. Our Federal Register search on 13 November 2026 found no later rule changing the programme. One forward item exists: DoW's 2026 regulatory agenda lists an amendment to part 170 (RIN 0790-AM01) setting a deadline and transition period for moving from NIST SP 800-171 Revision 2 to Revision 3, as an interim final rule targeted for July 2026. It had not appeared by 13 November 2026, so Revision 2 is still the standard you assess against.
CMMC Level 1 vs Level 2, side by side
The comparison comes from 32 CFR 170.15, 170.16 and 170.22 and from DFARS 252.204-7021.
| Level 1 (Self) | Level 2 (Self) | |
|---|---|---|
| Information protected | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Source of requirements | FAR 52.204-21 | NIST SP 800-171 Revision 2 |
| Number of requirements | 15 | 110 |
| Who assesses | The contractor itself | The contractor itself; a C3PAO assessment is the separate Level 2 (C3PAO) status |
| How often | Every year | Every three years |
| Affirmation by a senior official | After each yearly assessment | After each assessment and every year after |
| POA&M allowed | Never | Only at 88 of 110 or more, only for 1-point items (one encryption exception), never for six named requirements |
| POA&M close-out | Not applicable | Within 180 days, or the conditional status expires |
| Where results go | SPRS, with level, status date, scope, CAGE codes and result | SPRS, with level, status date, scope, CAGE codes, score and POA&M status |
| Current for award purposes | Final status and affirmation each no older than 1 year | Final status no older than 3 years, affirmation no older than 1 year |
| Cloud for the protected data | No CMMC-specific rule | FedRAMP Moderate (or higher) or equivalent under DoD policy |
| Evidence retention | 6 years from the status date | 6 years from the status date |
| Also satisfies | Nothing else | Level 1 for the same scope |
FAR 52.204-21 lists its 15 basic safeguarding requirements as items (i) to (xv). Under 32 CFR 170.21, a POA&M needs a score of at least 0.8 of the total, which is 88 of 110, and six requirements can never sit on one: external connections (AC.L2-3.1.20), control of public information (AC.L2-3.1.22), the system security plan (CA.L2-3.12.4), and three physical access items: escorting visitors, physical access logs and managing physical access (PE.L2-3.10.3 to 3.10.5). The encryption exception lets SC.L2-3.13.11 go on a POA&M when encryption is in place but not FIPS-validated. Without a system security plan you cannot reach even a conditional Level 2 status.
Which level applies to you
The level follows the information, not the company. 32 CFR 170.23 applies CMMC to primes and subcontractors at every tier that process, store or transmit FCI or CUI, and sets the minimum for each subcontract. DFARS 252.204-7021 flows the clause down to subcontracts involving FCI or CUI, except those for commercially available off-the-shelf (COTS) items.
| Choose | If |
|---|---|
| Level 1 (Self) | You handle FCI only, such as contract specifications or delivery schedules not meant for public release, and no CUI |
| Level 2 (Self) | You process, store or transmit CUI, such as controlled technical drawings, for the contract; this is the minimum for a CUI subcontract |
| Level 2 (C3PAO) | You handle CUI and the prime contract requires Level 2 (C3PAO) or Level 3 (DIBCAC); the rule then makes Level 2 (C3PAO) your minimum, though DoW now says it may require only self-assessments |
| A voluntary C3PAO assessment | A prime insists on it in writing, or you want a three-year status that already meets any Level 2 (Self) clause |
| No CMMC flow-down | You supply only COTS items |
| FedRAMP Moderate or equivalent | You are a cloud provider whose service stores a contractor's CUI (see the FedRAMP section below) |
Two cautions. A Level 2 (Self) status earned for an enclave covers that enclave only, so systems outside it that handle FCI still need Level 1. And DoD keeps the right to send assessors from the Defense Contract Management Agency's DIBCAC to check a Level 2 self-assessment; under 32 CFR 170.16 their findings override any existing CMMC status.
Software and IT subcontractors: where you sit
Software houses, MSPs and SaaS vendors often assume CMMC is a factory problem. It also sits apart from the commercial frameworks in our Cyber Essentials vs ISO 27001 vs SOC 2 comparison. The flow-down rules split technology suppliers into three groups.
You receive or build with CUI. A development shop that receives controlled specifications, CUI-marked source code or test data from a defence programme is a subcontractor handling CUI. DFARS 252.204-7021 requires the prime to flow the clause down and to confirm before award that you hold a current CMMC status at the required level. Level 2 (Self) is your floor, and DFARS 252.204-7012 flows down with it, including incident reporting to DoD within 72 hours.
You run IT for a contractor (an external service provider). An MSP or managed security provider that handles CUI for a client does not get its own CMMC level under 170.16. Its services are assessed inside the client's scope against all Level 2 requirements, and the client's system security plan must document the arrangement, backed by your service description and customer responsibility matrix. Expect to share evidence during their self-assessment.
You host the CUI (a cloud service provider). For Level 2, 170.16 allows a cloud service only if it holds FedRAMP Moderate (or higher) status on the FedRAMP Marketplace or meets equivalent requirements under DoD policy. DFARS 7012 sets the same baseline and adds duties on incident reporting, malicious software, media preservation, forensic access and damage assessment. Our FedRAMP 20x guide for SaaS vendors explains why that wording now sits awkwardly with FedRAMP's class names.
Self-assessment vs C3PAO in 2027
During the pause, self-assessment is what DoW says it may require, and it is not a light option. You assess against the NIST SP 800-171A (June 2018) procedures, score with the method in 32 CFR 170.24, post the result to SPRS and have a named affirming official attest to it.
A C3PAO assessment still has uses. DFARS 252.204-7021 asks for the specified level or higher, and 32 CFR 170.17 says a Level 2 (C3PAO) status also satisfies Level 1 (Self) and Level 2 (Self) for the same scope, so it meets those clauses for three years with yearly affirmations. Nothing in DoW's announcement bars a company from commissioning one. Clark Hill advises checking whether primes have set their own CMMC deadlines or evidence demands regardless of DoW's timeline, and reviewing teaming and subcontract language. A former official told Federal News Network that about 2,500 companies already hold Level 2 CMMC status and that assessment bookings were pulled back after the pause.
The case for waiting is real too. If the task force narrows or replaces Phase 2, an assessment bought now may cover requirements that change, especially under the Revision 3 rule. Assessor capacity was one problem DoW itself cited, so slots may be easier to book once the rules settle.
| Choose | When |
|---|---|
| Self-assessment only | Your contracts and primes ask for Level 2 (Self), your score is defensible line by line, and you can live with a possible DIBCAC check |
| Voluntary C3PAO now | A prime requires it in writing, you bid on programmes likely to return to C3PAO first, or you want an outside opinion before affirming |
| C3PAO later | You are below 88 of 110 today; fix the gaps first, because an assessment only records them |
SPRS: the score every bid checks
The Supplier Performance Risk System (SPRS) now holds two related records, and contractors mix them up.
The first is the NIST SP 800-171 DoD Assessment under DFARS 252.204-7019 and 7020. To be considered for award, a contractor that must implement NIST SP 800-171 needs an assessment no more than three years old, unless the solicitation sets a shorter period, for each covered system. A Basic Assessment is self-performed and records a summary score out of 110 and the date you expect to reach 110.
The second is the CMMC record itself. Under 170.16, a Level 2 self-assessment entry includes the level, status date, assessment scope, all CAGE codes in scope, the overall score (the rule's example is 105 out of 110) and POA&M status. Each assessment gets a 10-character CMMC unique identifier (CMMC UID) that you give the contracting officer, and the affirming official renews the affirmation in SPRS every year.
Keep the two aligned. A Basic Assessment score of 110 next to a CMMC record with an open POA&M invites questions, and so does a CMMC UID whose scope does not match the CAGE codes on your bid.
Worked cost example: a 45-person machine shop
DoW publishes no price for a self-assessment, and C3PAO fees are quote-based. The cost you control is your own people's time. We use the US Bureau of Labor Statistics median wage for information security analysts: $129,180 a year, or $62.11 an hour, in May 2025. It is a wage, not a loaded cost, so treat results as a floor.
The company: a 45-person precision machining subcontractor that receives controlled technical drawings (CUI) from one prime and only FCI from another. It keeps CUI in a separate enclave on a FedRAMP Moderate cloud tenant. The hours are our illustrative assumptions over a three-year cycle, not DoW figures.
| Scenario | Assumed hours over 3 years | Arithmetic | Internal labour (USD) |
|---|---|---|---|
| A. FCI-only systems, Level 1 (Self) yearly | 40 hours x 3 years = 120 | 120 x $62.11 | $7,453.20 |
| B. CUI enclave, Level 2 (Self) | 600 in year 1 + 80 in each of years 2 and 3 = 760 | 760 x $62.11 | $47,203.60 |
| C. Same enclave, voluntary Level 2 (C3PAO) | Scenario B + 120 hours of assessor support = 880 | 880 x $62.11 | $54,656.80 plus the C3PAO's quote |
Scenario B front-loads the cost: 600 x $62.11 = $37,266.00 lands in year 1, mostly writing the system security plan and closing gaps. The model excludes software, licences and any C3PAO fee. Here the C3PAO route adds 120 hours, or about 16% more internal time (120 / 760). Most of the money goes on reaching a defensible 110, whichever route you choose.
The FedRAMP link for software vendors
If your product stores CUI for defence customers, you sit where CMMC meets FedRAMP. Both 32 CFR 170.16 and DFARS 252.204-7012 still speak of the FedRAMP Moderate baseline. FedRAMP's Consolidated Rules for 2026, in effect since 4 July 2026, certify cloud services by class, and FedRAMP says there is no direct correlation between class and impact level; Class C covers most Low and Moderate security objectives. FedRAMP lists 11 June 2027 as the date it stops accepting new Rev5 applications, and its 20x roadmap says future dates are estimates. Until DoD updates its wording or policy, expect defence customers to ask a 20x Class C holder to show how its controls meet the Moderate baseline. That FedRAMP 20x guide covers the class choice and timing.
What to do before your next bid
- Classify each contract's information. Read the clauses and markings: 52.204-21 alone means FCI; 252.204-7012 or CUI markings mean Level 2.
- Draw your assessment scope. An enclave for CUI keeps Level 2 work to the systems that need it.
- Write or refresh the system security plan. It is one of the six requirements that can never sit on a POA&M.
- Score against NIST SP 800-171A with evidence for every line. Record the score and the date you expect to reach 110. Our comparison of Vanta, Drata and Secureframe covers three evidence-collection tools.
- Use POA&Ms sparingly. Only eligible items, only at 88 or above, and start the 180-day clock knowingly.
- Name the affirming official and put the yearly affirmation in the compliance calendar.
- Check your cloud. Confirm FedRAMP Moderate status or equivalence, and file the customer responsibility matrix with your system security plan.
- Paper your MSP. Get the service description and responsibility matrix your assessment will rely on.
- Test incident reporting. Reports to DoD need a DoD-approved medium assurance certificate, so get one before an incident, and know the 90-day image preservation rule.
- Keep evidence for 6 years from the status date, at either level.
- Track the task force and the Revision 3 rule monthly, and re-read your primes' flow-down terms when either moves.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Through our cybersecurity services we help defence suppliers and their software vendors scope CUI enclaves, configure cloud tenants and automate the evidence a NIST SP 800-171 self-assessment needs, while assessments themselves stay with you, accredited C3PAOs and DoD. Talk to us at /contact-us/.
Last updated: 13 November 2026.
