Posted on July 23, 2026July 23, 2026

If a Department of Defense solicitation or contract requires a particular Cybersecurity Maturity Model Certification (CMMC) status, the contractor must obtain and maintain that status for the information systems included in the applicable assessment scope.

For years, defense contractors could self-report their compliance with federal cybersecurity requirements.

The CMMC program introduced a more formal process for verifying that required safeguards are in place. Depending on the solicitation, contract, CMMC level, and implementation phase, an organization may need a Level 1 self-assessment, a Level 2 self-assessment, a Level 2 C3PAO certification assessment, or a Level 3 government assessment.

For small and mid-sized defense contractors, this makes cybersecurity readiness a real priority. The Department has suspended Phase II and pending implementation milestones while it conducts a 60-day review, but Phase I self-assessment requirements and existing DFARS safeguarding obligations remain in effect.

If you’re still figuring out whether CMMC applies to your business, or you know it does and aren’t sure where to start, this guide is for you.

Read on to learn:

• What CMMC compliance requires today and what changed with CMMC 2.0

• What’s at stake if your business isn’t compliant when a contract requires it

• How defense contractor SMBs are getting CMMC-ready without building an internal compliance department from scratch

Editor’s Note (July 2026): On July 13, 2026, the Department announced the immediate suspension of CMMC Phase II requirements, which had been scheduled to begin November 10, 2026, along with pending and future implementation milestones. Phase I self-assessment requirements remain in effect while a CMMC Reform Task Force conducts a 60-day review of the program. During this interim period, the Department has stated that it will enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments. The suspension does not remove contractors’ existing obligations under DFARS 252.204-7012 to safeguard covered defense information.

What Is CMMC Compliance?

CMMC stands for Cybersecurity Maturity Model Certification. It is the Department of Defense’s framework for assessing whether contractors and applicable subcontractors have implemented required safeguards for sensitive government information.

The core idea is straightforward: when a DoD contract requires a particular CMMC status, the contractor must demonstrate that the cybersecurity controls protecting the information within the assessment scope are implemented and working.

Why Enforcement Is Tightening Now

The CMMC program isn’t new. The DoD has been developing and refining the framework since 2019, and defense contractors have been required to meet NIST SP 800-171 standards since 2017.

What changed is the enforcement. With the 48 CFR rule taking effect in 2025, CMMC requirements began appearing in DoD contracts. The Department has since suspended Phase II and pending implementation milestones while conducting a 60-day review of the CMMC program.

Although portions of the implementation timeline may change, the direction has not. Defense contractors are still expected to protect sensitive government information, and many organizations remain subject to existing DFARS and NIST SP 800-171 cybersecurity requirements today. Preparing now puts contractors in a stronger position regardless of the final rollout schedule.

Who Needs to Be CMMC Compliant?

Applicability depends on the specific solicitation or contract, the clauses it contains, whether the organization receives or handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), which systems process, store, or transmit that information, and whether an applicable exception applies.

CMMC requirements may extend beyond prime contractors to subcontractors and suppliers that process, store, or transmit FCI or CUI in support of a DoD contract. They do not automatically apply to every vendor in a contractor’s supply chain.

If your company supports a DoD contract, determine whether you receive FCI or CUI and whether the applicable contract clauses require a particular CMMC status. The first step is understanding what information you actually handle and where it moves through your environment.

The Data Categories: Federal Contract Information (FCI) vs. Controlled Unclassified Information (CUI)

The type of data your business handles is a key factor in determining the CMMC level that may apply. There are two categories to understand:

Federal Contract Information (FCI)

Information provided by or generated for the government under a contract. If your business handles Federal Contract Information (FCI), but not the more sensitive category below, you’re likely looking at Level 1.

Controlled Unclassified Information (CUI)

Sensitive unclassified information that requires safeguarding under federal policy but isn’t classified. CUI covers a wide range of sensitive information, including technical specifications, engineering drawings, and procurement data. Systems that process, store, or transmit CUI may fall within a Level 2 assessment scope, but the required assessment type is identified in the applicable solicitation or contract.

Not all information connected to a federal contract is automatically FCI or CUI. Contractors should identify the information they actually receive or generate, review applicable contract markings and clauses, and document where that information is processed, stored, and transmitted.

For contractors subject to CMMC requirements, the key question is which category of information they handle and which systems fall within the applicable assessment scope.

What Changed With CMMC 2.0

The original CMMC framework had five levels. The final 32 CFR Part 170 CMMC Program rule was published on October 15, 2024, and became effective on December 16, 2024. The current framework has three levels:

Level 1: Foundational

For contractor information systems that process, store, or transmit FCI but not CUI. Level 1 incorporates the 15 safeguarding requirements in FAR 52.204-21 and requires an annual self-assessment.

Level 2: Advanced

Level 2 applies to contractor information systems that process, store, or transmit CUI and incorporates the 110 security requirements in NIST SP 800-171 Revision 2. The required assessment type is identified in the applicable solicitation or contract. Depending on the requirement and implementation phase, Level 2 may involve a self-assessment or an assessment by an authorized C3PAO. During the current Phase II suspension, the Department is maintaining Phase I self-assessment requirements while reviewing future implementation milestones.

Level 3: Expert

Level 3 is intended for organizations supporting the Department’s highest-priority programs and facing advanced persistent threats. It builds on a current Final Level 2 C3PAO status for the applicable scope, includes all 110 Level 2 requirements and 24 selected security requirements from NIST SP 800-172, and, under the established framework, is assessed by the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center.

For many small and mid-sized government contractors that handle CUI, Level 2 is where much of the preparation work is concentrated.

Don’t Assume You’re Off the Hook

One of the most common blind spots in the defense industrial base (DIB) is the assumption that CMMC compliance is someone else’s problem.

Prime and upper-tier contractors must flow applicable requirements down to subcontractors that will process, store, or transmit FCI or CUI in support of the contract. That means your prime may require evidence of a current NIST SP 800-171 assessment or applicable CMMC status before award or renewal.

If you have not had that conversation yet, it is worth having. Review your contract clauses and confirm what information you receive, which requirements have been flowed down, and what assessment status may be required.

What Are the Risks of Not Being CMMC Compliant?

For contractors, the consequences of falling short on CMMC compliance aren’t abstract. They show up directly in your ability to win and keep business.

You May Be Ineligible for Contracts Requiring a Specific CMMC Status

If a solicitation requires a particular CMMC status, the contractor must have a current status at that level, or higher, for the applicable information systems before award and must maintain that status during contract performance. Conditional status may be permitted in certain circumstances.

For DoD contractors that have relied on self-attestation for years, this is a meaningful shift. The required evidence may be a self-assessment, a C3PAO certification assessment, or a government assessment, depending on the contract and required CMMC level.

Your Prime Can Cut You Out of the Supply Chain

Even if you are a subcontractor with no direct relationship to a government agency, applicable safeguarding and CMMC requirements may flow down when your work involves FCI or CUI.

Some prime contractors require subcontractors to demonstrate applicable cybersecurity readiness or assessment status before participating in programs involving FCI or CUI. If you cannot provide the required evidence, you may be ineligible for that work.

Advanced Persistent Threats Are the Reason This Exists

Advanced threats, typically state-sponsored actors targeting defense programs, have repeatedly exploited weak points in the defense industrial base to access sensitive government data.

The attack doesn’t always come through the prime. It often comes through a smaller subcontractor with weaker defenses and access to CUI. If you have weak cybersecurity defenses, they put your business at risk and create a gap in national security that adversaries actively look for.

The Compliance Journey Gets Harder the Longer You Wait

Even with the DoD’s suspension of Phase II and pending implementation milestones, waiting to address existing safeguarding obligations can create unnecessary risk.

Building a compliant cybersecurity program takes time. Organizations need to document policies, remediate security gaps, implement technical controls, and prepare for future assessments when they become applicable.

Contractors who use this period to strengthen their cybersecurity posture will be far better positioned than those who wait until new contract requirements appear.

What Are the CMMC Compliance Requirements and What Can Assessment and Readiness Cost?

Understanding your CMMC level is one thing. Knowing what it takes to obtain and maintain the required CMMC status is another.

Breaking Down the CMMC Assessment Process

For contractors that require third-party CMMC certification, preparation involves more than passing an assessment—it requires implementing, documenting, and maintaining the applicable security controls.

Your specific CMMC assessment or certification requirements depend on the CMMC level and assessment type specified in your contract. Here’s how it breaks down:

Level 1

• Meet the 15 safeguarding requirements in FAR 52.204-21

• Demonstrate access control, physical protection, and basic systems hygiene

• Annual self-assessment submitted through the Supplier Performance Risk System (SPRS)

• Only authorized users with a legitimate need should have access to federal contract information

Level 2

• Meet all 110 security controls outlined in NIST SP 800-171

• Demonstrate access control, configuration management, risk assessment, media protection, personnel security, and communications protection

• Assessment procedures are documented and reviewed as part of the CMMC assessment process

• Depending on the applicable solicitation, contract, and implementation phase, Level 2 may require either a self-assessment or a certification assessment conducted by an authorized C3PAO; contractors subject to the latter must successfully complete the assessment and maintain their CMMC-certified status.

• When an external cloud service provider stores, processes, or transmits covered defense information, DFARS 252.204-7012 generally requires the provider to meet security requirements equivalent to the FedRAMP Moderate baseline. The contractual environment must also address applicable cyber-incident reporting, evidence preservation, forensic support, and related DFARS obligations

Contractors should evaluate all external service providers that may handle CUI or security protection data, including Microsoft 365 and Azure environments, hosted applications, backup providers, security platforms, MSP tools, and other cloud services. Using a reputable commercial platform does not automatically make the contractor’s configuration or overall environment compliant.

Level 3

• All 110 Level 2 requirements plus 24 selected requirements from NIST SP 800-172, with a current Final Level 2 C3PAO status for the applicable scope

• Assessed directly by the DoD’s Defense Industrial Base Cybersecurity Assessment Center

CMMC Assessment and Readiness Costs: What to Budget

The total CMMC certification cost varies based on your required CMMC level, assessment type, IT environment, current security posture, and the remediation needed before an assessment. For contractors that will require a Level 2 C3PAO certification assessment, planning estimates may include costs such as the following. Actual costs vary considerably based on assessment scope, environment size, readiness, and the service providers involved:

• Assessment preparation: ~$20,000

• C3PAO certification assessment: ~$76,000

• Reporting assessment results: ~$3,000

• Annual affirmations: ~$1,500 per year

These illustrative figures cover the certification assessment process itself. They do not include the cost of remediating gaps in your security controls before you are ready to be assessed, which for many SMBs is where the larger investment sits. Contractors should obtain current estimates based on their own assessment scope rather than treating these figures as a standard price.

The cost will vary based on the size and complexity of your environment, how many systems handle controlled unclassified information, the boundaries of the assessment scope, and how much remediation is needed before assessment.

One thing worth knowing: obtaining a required CMMC status is not a one-time exercise. Maintaining compliance requires ongoing attention to security controls, periodic reassessment when applicable, and annual affirmations of your cybersecurity posture.

What Are the Business Benefits of CMMC Beyond Compliance?

Obtaining and maintaining the CMMC status specified in an applicable solicitation or contract may be a condition of award and continued contract performance. The preparation involved may also provide business benefits beyond eligibility.

You Become Easier to Work With

Prime contractors may require subcontractors to provide evidence of a current NIST SP 800-171 assessment, a current SPRS submission, the applicable CMMC status, or supporting contractual assurances before award. A well-documented cybersecurity posture may reduce onboarding friction and help demonstrate readiness.

You Gain a Competitive Edge

Businesses with the required CMMC status may be better positioned to compete for contracts containing CMMC requirements. Organizations that have already completed the necessary preparation may also be able to respond more efficiently when a solicitation includes those requirements.

You May Improve Eligibility for Future Opportunities

A current CMMC status may make an organization eligible to compete for solicitations that include corresponding cybersecurity requirements.

You Build a More Resilient Business

The security controls required for CMMC alignment cover areas such as access control, risk assessment, and configuration management. Implementing and documenting these controls can support a more structured cybersecurity program and make systems easier to manage.

You Can Verify Compliance Faster When It Matters

When a contract opportunity requires a current CMMC status, organizations that have completed the required assessment and remediation work can provide evidence more efficiently. Organizations that have not may face delays.

You May Reduce Rushed Remediation and Avoidable Exposure

Building a sustainable compliance program can reduce the likelihood of rushed remediation, contract delays, and avoidable cybersecurity exposure. Once the foundation is in place, ongoing maintenance can become part of normal security operations.

How Should Government Contractors Start Preparing for CMMC?

For most small and mid-sized defense contractors, the biggest obstacle to achieving compliance isn’t understanding what’s required. It’s having the internal bandwidth to actually do it.

CMMC preparation requires documented security controls, gap assessments, remediation efforts, evidence collection, assessment scoping, and, when specified by the applicable requirement, a formal third-party or government assessment—all while your team is still running day-to-day operations. That is a significant lift for a business without a dedicated compliance or IT security function.

Where a Managed IT Partner Fits In

Many defense contractor SMBs working through this process seek outside support. Managed IT service providers that specialize in cybersecurity compliance can help businesses navigate the CMMC framework.

The right MSP brings experience with CMMC requirements, understands the evidence assessors may expect, and can help you prepare for the applicable assessment process without pulling your team away from the work that drives your business.

At RTS, we work with SMBs navigating exactly this kind of challenge. We help defense contractors assess their current cybersecurity posture, align with DFARS, NIST SP 800-171, and evolving CMMC requirements, remediate security gaps, and prepare for future assessment requirements with a clear, practical roadmap.

The regulatory landscape may evolve, but protecting sensitive defense information isn’t optional. Contractors who continue strengthening their cybersecurity now will be better prepared regardless of how the final CMMC rollout unfolds.

If you are ready to strengthen your CMMC readiness and want support from an experienced managed IT services partner, reach out to Lenny Giller at lenny@reliabletechnology.co to start the conversation.