CMMC compliance: a practical guide for defence contractors and subcontractors

CMMC compliance is now a condition of winning and keeping many US defence contracts — and it reaches deep into the supply chain, down to the machine shop or software house that never deals with the Pentagon directly. This guide explains the levels, who needs which, how assessments and SPRS scores work, where the phased rollout stands in late 2026, and how to run CMMC as a set of managed risks rather than a one-off project.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 13 min read

What CMMC is and why it exists

Defence contractors have been required since 2017 to implement NIST SP 800-171 under DFARS clause 252.204-7012 whenever they handle Controlled Unclassified Information (CUI). The problem was verification: compliance was largely self-declared, and DoD reviews repeatedly found gaps between what contractors claimed and what they had in place. CMMC adds verification — self-assessments with a senior official’s affirmation at the lower end, independent third-party assessments in the middle and government assessments at the top.

Two rules make up the programme:

• The programme rule, 32 CFR part 170, effective 16 December 2024, defines the levels, assessment types, scoring, POA&M rules and affirmations.
• The acquisition rule in 48 CFR (DFARS), effective 10 November 2025, puts CMMC into contracts through clause 252.204-7021. From that date contracting officers could require a CMMC status as a condition of award.

“CMMC 2.0” is the name commonly used for the current, streamlined model of three levels, which replaced the five-level draft announced in 2020. If you see five levels in older material, it is out of date.

The three CMMC levels

The level is driven by the type of information, not by the size of your company or the value of the contract.

FCI or CUI: which do you handle?

Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release — a purchase order with delivery details, for example. Almost every defence supplier handles some FCI. Controlled Unclassified Information is a narrower set of categories that need safeguarding under law or policy, such as controlled technical information, export-controlled drawings and specifications. CUI should be marked, and your contract should tell you when it is involved. If in doubt, ask the contracting officer or the prime — guessing too high wastes money, and guessing too low is a compliance failure.

Who needs CMMC compliance, and at which level

CMMC applies to defence contractors and subcontractors at every tier whose contract or subcontract involves FCI or CUI on information systems they own or operate. Commercially available off-the-shelf (COTS) items sold without FCI or CUI are excluded.

• Primes must hold the level stated in the solicitation for the systems that handle the contract’s information.
• Subcontractors receive the requirement through flow-down. The level matches the information that flows to them: a prime working at Level 2 may pass only FCI to a subcontractor, who then needs Level 1. If CUI flows down, Level 2 flows down too.
• Service providers that store, process or transmit CUI for you — managed service providers, cloud services — become part of your assessment scope. Cloud services that handle CUI are expected to meet the FedRAMP Moderate baseline or equivalent.

The practical test: follow the information. Map where FCI and CUI arrive (email, portals, file transfers), where they are stored and processed, and who can touch them. That map defines your assessment scope, and narrowing it — for example by keeping CUI in a dedicated enclave rather than across the whole corporate network — is usually the biggest single lever on cost and effort.

Self-assessment vs C3PAO certification

At Level 2 the solicitation states whether a self-assessment is enough or whether you need a certification assessment by a C3PAO (a CMMC Third-Party Assessment Organisation authorised by the Cyber AB, the programme’s accreditation body). The DoD’s own planning assumed that, once the programme is fully rolled out, most organisations needing Level 2 would need third-party certification, but the choice is made contract by contract.

Treat a self-assessment with the same rigour as a third-party one. The affirming official — a senior person who signs that the organisation meets and will maintain the requirements — is making a representation to the government. The US Department of Justice has used the False Claims Act against contractors that misrepresented their cybersecurity compliance, through its Civil Cyber-Fraud Initiative launched in 2021.

SPRS scores explained

The Supplier Performance Risk System (SPRS) is where the DoD looks up a contractor’s cybersecurity status. Separately from CMMC, DFARS clauses 252.204-7019 and 252.204-7020 already require contractors subject to 252.204-7012 to have a current NIST SP 800-171 assessment score (not older than three years) in SPRS.

The score follows the DoD Assessment Methodology. You start at 110 and subtract a weighted value — 5, 3 or 1 points — for each requirement that is not met. Because the weights add up, the lowest possible score is minus 203. A few key points:

• 110 means every requirement is met. It is the only fully compliant score.
• 88 (80%) is the floor for a Conditional Level 2 status. Below that, you cannot use a POA&M to get to a conditional status.
• The weights reflect impact. Missing multi-factor authentication or encryption of CUI costs far more points than a missing policy detail — so remediation should start with the high-value requirements.
• Accuracy matters more than the number. A score of 110 that does not survive scrutiny is worse than an honest 85 with a credible plan.

POA&Ms and conditional status

A Plan of Action and Milestones (POA&M) lists requirements not yet met, with actions and dates. Under CMMC, POA&Ms are deliberately restricted:

• They are not allowed at Level 1 — all 15 requirements must be met.
• At Level 2 you can reach a Conditional status with a score of at least 88 and the remaining gaps on a POA&M, but only for requirements the rule allows. In general that means lower-weighted (1-point) requirements; higher-weighted requirements and a list of specifically excluded ones must be met at assessment. Check the current list in 32 CFR 170.21 before planning around it.
• The POA&M must be closed — and the closure verified in a close-out assessment — within 180 days of the conditional status date. If it is not, the conditional status expires, with consequences for contracts that depend on it.

The practical lesson: a POA&M is a short bridge, not a long-term holding pen. Requirements you cannot meet within six months need fixing before the assessment, not after it.

The phased rollout and where it stands in 2026

The acquisition rule introduced CMMC in four phases, so that the assessor ecosystem and the supply chain could keep up. The schedule below is the one set by the rule; the later phases were suspended in July 2026, as explained underneath.

What happened in 2026. On 13 July 2026 the Department of Defense — which now also uses the name Department of War — suspended the move to Phase 2 and later milestones and set up a reform task force to review the programme over 60 days, with a public request for information. Legal commentators were consistent on three points: the suspension is not a repeal (removing the rule would require new rulemaking), Phase 1 requirements continue, and the underlying obligations in DFARS 252.204-7012, NIST SP 800-171 and SPRS reporting are unchanged. Reports in October 2026 describe the task force’s options as including a restart of Phase 2 for a narrower group of contracts and a move to NIST SP 800-171 Revision 3, but at the time of writing we have not seen a final official decision. Check the DoD CIO CMMC pages for the current position.

How CMMC relates to NIST SP 800-171

CMMC does not invent new controls at Level 2 — it verifies NIST SP 800-171. Level 2 maps one-to-one to the 110 security requirements of Revision 2 (February 2020), organised in 14 families such as access control, audit and accountability, configuration management, identification and authentication, incident response and system and communications protection. NIST published Revision 3 in May 2024 with a restructured set of requirements and organisation-defined parameters, but the DoD has continued to assess against Revision 2 so far. If you are building controls now, implementing Revision 2 fully is the requirement; designing with Revision 3 in mind avoids rework later.

The core documents an assessor expects are:

• A System Security Plan (SSP) describing the scope, boundaries and how each requirement is implemented.
• Policies and procedures for each requirement family.
• Evidence that controls operate: configurations, logs, access reviews, training records, incident response tests.
• An asset inventory categorising CUI assets, security protection assets and out-of-scope assets.

Many of the same controls appear in other frameworks. If you already work to ISO/IEC 27001, the NIST Cybersecurity Framework or a cybersecurity risk assessment process, you will have a head start — but CMMC assessors check the specific 800-171 wording, so map rather than assume.

A CMMC compliance roadmap

1. Confirm what you handle. Review current contracts and bids for FCI and CUI, the DFARS clauses included and the CMMC level stated.
2. Scope. Map information flows and decide the boundary. Consider an enclave for CUI to keep the assessment manageable.
3. Gap assessment. Assess every requirement against the CMMC assessment guide, honestly, and calculate your SPRS score.
4. Prioritise remediation. Fix 5-point and POA&M-ineligible requirements first. Multi-factor authentication, FIPS-validated encryption for CUI, logging and incident response are common gaps.
5. Check your providers. Confirm that cloud and managed service providers in scope meet the requirements and that responsibilities are written down — the same approach as a third-party risk assessment, with CMMC-specific questions.
6. Document. Write the SSP and collect evidence as you go, not in the month before the assessment.
7. Assess and affirm. Perform the self-assessment or book a C3PAO; post results and affirmations in SPRS.
8. Maintain. Re-affirm annually, monitor changes to scope and keep evidence current. CMMC status lapses if the environment drifts.

What drives the cost

We do not quote a typical price, because the range is wide and depends almost entirely on your starting point. The main drivers are:

The DoD published its own cost estimates in the rulemaking; if you need a budget figure for a business case, start from those and adjust for your scope rather than relying on vendor averages.

CMMC risks as risk register entries

CMMC is usually run as a compliance project with a checklist. That works for the assessment but misses the business question: what could stop us winning or keeping defence work, and what would it cost? A risk register answers that, and connects CMMC to the rest of your compliance risk management. Score the entries on the same risk matrix as your other risks so the board sees them in proportion.

Scores are illustrative residual scores on a 5×5 matrix. A few key risk indicators keep the programme visible between assessments: current SPRS score against target, open POA&M items and days remaining, requirements without current evidence, and in-scope suppliers without a confirmed CMMC status.

Common mistakes

• Assuming the 2026 suspension means CMMC has gone away. The rule remains, Phase 1 continues and 7012 obligations never paused.
• Scoping too wide. Putting the whole company in scope when CUI touches a handful of people multiplies cost.
• Scoping too narrow. Forgetting email, backups, endpoints or the managed service provider that administers the environment.
• Treating the SSP as paperwork. Assessors test it against reality; inconsistencies cost findings.
• Leaning on the POA&M. Many requirements cannot be deferred, and the 180-day clock is short.
• Ignoring the supply chain. Your delivery depends on subcontractors meeting their level too.
• One-off compliance. Annual affirmations mean controls must keep working; build them into normal operations, including your vulnerability management process.