The Cybersecurity Maturity Model Certification (CMMC) program requires Defense Industrial Base contractors to prove, not just promise, that they protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It now appears in Department of Defense contracts. If you handle only FCI you need CMMC Level 1: 15 basic safeguards and an annual self-assessment. If you handle CUI you need Level 2: the 110 requirements of NIST SP 800-171 Rev. 2, assessed either by yourself or, increasingly, by an authorized third-party assessor (C3PAO). From November 10, 2026, the rollout's second phase begins and DoD solicitations will require Level 2 C3PAO certification where it applies.
This checklist is a practical summary, not legal advice. Confirm the level in each solicitation with your contracting officer and the rule text in 32 CFR Part 170.
Where the rollout stands
The CMMC program rule (32 CFR Part 170) took effect on December 16, 2024. The acquisition rule that puts CMMC into contracts (48 CFR, DFARS 252.204-7021) took effect on November 10, 2025 and started a four-phase rollout:
| Phase | Start date | What DoD can require |
|---|---|---|
| Phase 1 | November 10, 2025 | Level 1 and Level 2 self-assessments as a condition of award |
| Phase 2 | November 10, 2026 | Level 2 certification assessments by a C3PAO |
| Phase 3 | November 10, 2027 | Level 3 assessments by DoD's DIBCAC |
| Phase 4 | November 10, 2028 | Full implementation in all applicable contracts |
A C3PAO assessment typically takes months to schedule and prepare for. If you expect to bid on CUI work in 2027, the time to start is now.
Which level do you need?
| Level | Information | Requirements | Assessment |
|---|---|---|---|
| Level 1 | FCI only | 15 requirements from FAR 52.204-21 | Annual self-assessment and annual affirmation in SPRS. No POA&Ms allowed |
| Level 2 (self) | CUI | 110 requirements of NIST SP 800-171 Rev. 2 | Self-assessment every three years, plus annual affirmation |
| Level 2 (C3PAO) | CUI | 110 requirements of NIST SP 800-171 Rev. 2 | Third-party certification every three years, plus annual affirmation |
| Level 3 | CUI in the highest-priority programs | Level 2 plus 24 selected requirements from NIST SP 800-172 | DIBCAC assessment every three years. Requires a final Level 2 C3PAO certification first |
The solicitation states the required level. If you only receive purchase orders, drawings without CUI markings and general contract information, Level 1 may be all you need. If you receive technical drawings, specifications or other data marked CUI, plan for Level 2.
The checklist
1. Find and scope your CUI
- List every contract and the data it brings in. Look for CUI markings and DFARS 252.204-7012 in the contract.
- Map where CUI flows: email, file shares, engineering workstations, CAD/CAM systems, shop-floor machines and removable media.
- Categorize assets as CUI assets, security protection assets, contractor risk managed assets, specialized assets (such as OT and test equipment) or out of scope, as 32 CFR 170.19 describes.
- Shrink the boundary. The fewer people and systems that touch CUI, the cheaper every later step becomes. Many small manufacturers create a separate CUI enclave rather than bringing the whole company into scope.
2. Choose compliant cloud and service providers
- A cloud service that stores, processes or transmits CUI must be FedRAMP Moderate authorized or meet the FedRAMP Moderate equivalency standard. For Microsoft shops this usually means Microsoft 365 GCC High rather than commercial Microsoft 365.
- Your MSP or MSSP is an External Service Provider. If they manage systems in your CMMC scope, their services and access are assessed too. Ask how they support CMMC before you sign.
- Flow the required level down to subcontractors who receive your FCI or CUI.
3. Write the System Security Plan (SSP)
- Describe the boundary, the environment and how each of the 110 requirements is implemented. Assessors test what the SSP says, so make it accurate rather than aspirational.
- Keep network diagrams, the asset inventory and data flow diagrams current and attached.
4. Close the gaps that matter most
Small contractors most often fall short on:
- Multi-factor authentication for all users and for privileged and network access. See our guide to phishing-resistant MFA.
- FIPS-validated encryption for CUI at rest and in transit, including laptops and backups.
- Audit logging that is collected centrally, protected and actually reviewed.
- Incident response capability, tested at least once. DFARS 252.204-7012 also requires reporting cyber incidents to DoD within 72 hours, which needs a DoD-approved medium assurance certificate to file.
- Configuration baselines and change control for workstations, servers and network devices.
- Vulnerability scanning and remediation on a defined schedule. See vulnerability scan vs penetration test.
- Security awareness training that covers insider threats and CUI handling.
- Physical protection of areas where CUI is printed, stored or machined, including visitor logs.
5. Score yourself and post it in SPRS
- Use the DoD Assessment Methodology. The maximum score is 110, and each unmet requirement subtracts 1, 3 or 5 points, so a score can be negative.
- Contractors subject to DFARS 252.204-7019 have been required to post a current score in the Supplier Performance Risk System (SPRS) since 2020. Make sure yours is honest and current.
6. Use POA&Ms carefully
- At Level 2, you can achieve conditional status with a Plan of Action and Milestones if you score at least 88 of 110 and the open items are ones the rule allows to be deferred. Most higher-weighted requirements cannot be on a POA&M.
- All POA&M items must be closed and verified within 180 days, or the conditional status expires.
- Level 1 does not allow POA&Ms at all.
7. Prepare for the assessment
- Gather evidence for every requirement: policies, screenshots, configurations, logs, training records and interview-ready staff.
- Run a mock assessment against the CMMC Assessment Guide before booking a C3PAO.
- Book early. Assessor capacity is limited as Phase 2 begins.
8. Keep it current
- A senior official must affirm continued compliance in SPRS every year, at every level.
- Re-scope after any major change: a new ERP, new facility, new cloud service or a merger.
Why accuracy matters: False Claims Act risk
CMMC affirmations are statements to the government. The Department of Justice's Civil Cyber-Fraud Initiative has already produced settlements with contractors that misrepresented their NIST SP 800-171 compliance, including Aerojet Rocketdyne ($9 million in 2022) and Pennsylvania State University ($1.25 million in 2024). An honest score with a credible plan is far safer than an optimistic one.
What it costs a small contractor
Costs depend almost entirely on scope. A tightly scoped enclave for ten users is a very different project from bringing a 150-person manufacturer into scope. Budget for: a gap assessment, remediation (often MFA, encryption, logging and GCC High migration), documentation, ongoing monitoring, and the C3PAO assessment itself. Our risk assessment is a common first step to size the work, and a vCISO can own the program without a full-time hire.
Frequently Asked Questions
When does CMMC Level 2 third-party certification start?
Phase 2 of the rollout begins on November 10, 2026. From then, DoD solicitations can require a Level 2 certification assessment by a C3PAO as a condition of award. Phase 1 self-assessment requirements have applied since November 10, 2025.
What is the difference between FCI and CUI?
FCI is non-public information provided by or generated for the government under a contract. CUI is a narrower category of sensitive information that requires safeguarding under law or policy, such as controlled technical information. FCI needs Level 1; CUI needs Level 2 or higher.
Can we use commercial Microsoft 365 for CUI?
Generally not. A cloud service handling CUI must be FedRAMP Moderate authorized or equivalent. Most defense contractors use Microsoft 365 GCC High, or keep CUI in a separate compliant enclave.
What SPRS score do we need for CMMC Level 2?
To pass outright, you need all 110 requirements met. Conditional status is available with a score of at least 88 if the remaining items are POA&M-eligible, and they must be closed within 180 days.
Does our MSP need to be CMMC certified?
An MSP that manages systems in your CMMC scope is an External Service Provider, and its services and access are evaluated as part of your assessment. Choose a provider that understands CMMC and can supply evidence for the controls it operates.
How long does it take to get ready for a C3PAO assessment?
For a small contractor starting from a basic IT setup, six to twelve months is common, driven by scoping, any migration to GCC High, remediation and gathering evidence. Contractors already close to NIST SP 800-171 can be ready faster.
Bidding on CUI work in 2027? Defensible scopes your CUI, closes the gaps and prepares the evidence your C3PAO will ask for. Talk to our team.
