CMMC 2.0 Compliance Guide: What Defense Contractors Still Have to Do

When Sarbanes-Oxley took effect in 2002, the defense contractor community watched from a distance. SOX was a public company problem. Four years later, when the first generation of defense contractors faced enforcement of cybersecurity attestation requirements, the pattern was identical: a compliance regime dismissed as distant until it arrived at the door. GDPR followed the same arc. When enforcement began in May 2018, European data protection authorities spent the first eighteen months clearing their backlog of violations that organizations had been warned about for two years.

CMMC 2.0 followed that arc until July 13, 2026, when the Department of War suspended Phase II [DoD CIO Memorandum 26-P-1023]. The final rule took effect December 16, 2024 [32 CFR Part 170]. Phase 1 introduced contract clauses in 2025, requiring Level 1 contractors to self-assess and upload SPRS scores before award. Phase 2 was scheduled for November 10, 2026 and would have made third-party certification a prerequisite for applicable contracts handling Controlled Unclassified Information. That milestone is suspended, along with Phase 3 in 2027 and Phase 4 in 2028, and all three are held in abeyance until further notice. What did not move: DFARS 252.204-7012, all 110 NIST SP 800-171 Rev 2 requirements, Level 1 and Level 2 self-assessment where solicitations call for them, and the annual SPRS affirmation. For Level 2 certification, minimum preparation time still runs six months under ideal conditions.

Three factors separate contractors who earn their C3PAO assessment clean from those who fail. The first is knowing which level applies to their specific operations. The second is understanding the gap between a passing SPRS score and actual assessment readiness. The third is starting the remediation work before a solicitation forces it. The framework has three levels, but only two carry stakes for most contractors today. Start with the one that governs your contracts.

The CMMC 2.0 Framework: Three Levels, One Compliance Mandate

CMMC 2.0 replaced the five-level original framework with three levels mapped directly to existing federal standards. The restructuring reduced compliance costs for contractors who handle only Federal Contract Information, while tightening requirements for those handling Controlled Unclassified Information. The level that applies to your organization is determined by the type of information in your contracts, not by your size or revenue [32 CFR Part 170 §170.3].

Level 1: Foundational (15 Practices)

Level 1 applies to contractors that access, process, store, or transmit Federal Contract Information. FCI is information provided by or generated for the government under a contract to develop or deliver a product or service, but not intended for public release [FAR 52.204-21]. The 15 practices align one-to-one with the 15 requirements in FAR 52.204-21(b)(1)(i) through (xv), covering basic cyber hygiene: access control, identification and authentication, media protection, physical protection, system and communications protection, and system and information integrity.

Level 1 requires annual self-assessment. The contractor’s senior official affirms the assessment results in SPRS, the Supplier Performance Risk System. No third-party assessor is required. The assessment must reflect the actual security posture at the time of affirmation, not an aspirational state. Affirming inaccurate SPRS scores exposes contractors to False Claims Act liability [31 U.S.C. §§ 3729-3733], a point the Department of Justice has enforced aggressively since the Cyber Fraud Initiative launched in October 2021.

Level 2: Advanced (110 Practices)

Level 2 applies to contractors handling Controlled Unclassified Information. CUI is government-created or government-controlled information that requires safeguarding per law, regulation, or government-wide policy, and is marked or unmarked per the CUI Program [32 CFR Part 2002]. The 110 practices map directly to NIST SP 800-171 Revision 2, covering 14 domains: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. (NIST finalized SP 800-171 Revision 3 in May 2024, but DoD has not yet incorporated it into CMMC through rulemaking; CMMC assessments continue against Revision 2 as the operative baseline per DoD policy and DFARS PGI guidance until Revision 3 is formally adopted through rulemaking.)

Level 2 was set to require C3PAO assessment for most contractors in the CUI space. A small subset of Level 2 programs may permit annual self-assessment where the DoD determines the information is not critical to national security. The contracting officer specifies which pathway applies in each solicitation. Phase 2 would have made third-party assessment mandatory on November 10, 2026. The Department of War suspended it on July 13, 2026, so no contractor loses award eligibility on that date. Level 2 self-assessment and the annual affirmation remain required where the solicitation calls for them, and both remain live representations to the Government [32 CFR Part 170 §170.3(e)(2); DoD CIO Memorandum 26-P-1023].

Level 3: Expert (NIST SP 800-172)

Level 3 targets contractors supporting the DoD’s highest priority programs. It incorporates all 110 Level 2 practices plus additional practices drawn from NIST SP 800-172, which addresses advanced persistent threats. Assessment is government-led, conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), a unit of the Defense Contract Management Agency (DCMA). Level 3 requirements and assessment procedures are still being finalized as of early 2026. Contractors identified for Level 3 will receive specific guidance through their program offices [32 CFR Part 170 §170.18].

The audit fix. Pull every active contract and every contract in your pipeline. For each one, identify whether it involves FCI only or CUI. If CUI is present, check the solicitation language for DFARS clause 252.204-7012 and the CMMC level specified. Document your current SPRS score against the 110 NIST SP 800-171 r2 practices. Map the delta between your current score and the 110-point maximum. That delta is your remediation workload before any assessment engagement begins.

CMMC 2.0 Compliance Timeline: What the Suspension Changed

The November 10, 2026 Phase 2 date was suspended on July 13, 2026 and is no longer a forcing function. C3PAO queues that were expected to bottleneck through 2026 have lost the deadline that was filling them. The operational timeline now works backward from the date a specific solicitation requires certification, not from a governmentwide cliff. That is a better position to prepare from than the one contractors were in a month ago, and a worse position to mistake for permission to stop.

The Phase Timeline

Phase 1 began with contract clauses in 2025, requiring Level 1 self-assessments and SPRS uploads as contract conditions. Contracting officers have been incorporating CMMC requirements into solicitations across the Defense Industrial Base since early 2025. Phase 1 is unaffected by the suspension and remains in force. Phase 2 was scheduled to activate the C3PAO assessment requirement on November 10, 2026. Phase 3 would have followed in 2027 and Phase 4 in 2028. All three are suspended and held in abeyance until further notice [32 CFR Part 170 §170.3(e)(3); DoD CIO Memorandum 26-P-1023]. A CMMC Reform Task Force reports in mid-September 2026.

The Six-Month Minimum Preparation Window

A Level 2 assessment-ready state requires a minimum of six months of active remediation under ideal conditions: an organization starting from a documented SPRS score, with existing IT governance, and staff who understand the NIST SP 800-171 r2 control domains. Most defense contractors in the DIB are not starting from ideal conditions. Many have SPRS scores below zero (the scoring model allows negative scores when deficiencies outnumber compliant practices). A contractor at a -100 SPRS score carries significant practice deficiencies and faces a substantial remediation workload before scheduling an assessment. Note: SPRS scoring is weighted: individual practices carry values of 1, 3, or 5 points depending on their criticality, so -100 does not map one-to-one to 100 individual gaps. The lowest possible score is -203: the 110-point maximum less the 313 points available for deduction across the 109 scored requirements [NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, Annex A]. The remediation workload depends on which weighted practices are deficient. At 2-4 weeks per practice domain, that timeline extends well past six months.

The assessment itself takes 3-5 days of on-site or virtual examination, plus 2-4 weeks for report preparation and review. Factor in plan of action and milestone (POA&M) resolution time for any findings the assessor identifies. Assessments with open POA&Ms do not result in certification. Certification is the output of a clean assessment or an assessment with POA&Ms fully resolved. Build the assessment into the schedule at least 90 days before any contract award date requiring Level 2 certification.

The audit fix. Pull your SPRS score and confirm it reflects the system you actually run today. That number is a live representation to the Government and carries False Claims Act exposure whether or not an assessor ever reads it. If the score was built on controls you planned rather than controls you operate, correct the score before you correct anything else. Then, if a current or pending solicitation names a C3PAO requirement, contact accredited C3PAOs through The Cyber AB’s Marketplace (cyberab.org) and get written confirmation of availability before committing to an award date.

NIST SP 800-171 Gap Assessment: Where Most Contractors Fall Short

A NIST cybersecurity assessment against the 110 practices of NIST SP 800-171 r2 reveals the same failure patterns across the Defense Industrial Base. The domains with the highest deficiency rates are not the technically demanding ones. Access control, configuration management, and system and communications protection generate more POA&M findings than incident response or media protection, because they require continuous operational discipline rather than one-time documentation [NIST SP 800-171 r2].

The Five Most Commonly Failed Domains

Access control accounts for a disproportionate share of CMMC Level 2 findings. Practice 3.1.1 requires limiting system access to authorized users and transactions. Practice 3.1.2 requires limiting access to functions authorized users are permitted to execute. The gap: most contractors have implemented some form of access control but have not documented user roles, access justifications, and periodic access reviews in a form that satisfies CMMC assessment evidence requirements [NIST SP 800-171 r2 §3.1]. Your assessor asks for the access control policy, the access review records, and evidence that privileged access is separated from standard user access. All three must exist as artifacts, not as verbal explanations.

Configuration management generates findings when contractors cannot demonstrate baseline configurations for all systems in scope. Practice 3.4.1 requires establishing and maintaining baseline configurations. Practice 3.4.2 requires establishing and enforcing security configuration settings. Organizations running Windows, Linux, and cloud workloads without documented Center for Internet Security Benchmark configurations, or without deviation tracking, fail these practices consistently [NIST SP 800-171 r2 §3.4].

System and communications protection, specifically practices around network boundary protection and CUI encryption, trips contractors who have not formally identified their Assessment Boundary. Before any CMMC assessment, the contractor must define which systems, personnel, and processes are in scope. Scope creep in the assessment boundary inflates the remediation workload. Scope reduction through network segmentation (isolating CUI systems from the rest of the environment) is the single highest-ROI CMMC preparation investment for most mid-size contractors.

The System Security Plan Requirement

Practice 3.12.4 requires a System Security Plan describing how NIST SP 800-171 r2 requirements are implemented in the contractor’s environment [NIST SP 800-171 r2 §3.12.4]. The SSP is the assessment’s primary evidence artifact. An assessor reviews the SSP before the on-site or virtual examination begins. A weak SSP signals an unprepared contractor. A strong SSP demonstrates that leadership understands the environment, understands the controls, and has made deliberate decisions about implementation.

The SSP must describe the system boundary, the types of CUI processed, the security requirements and how they are met (or mitigated through POA&M), and the operational environment including hardware, software, external service providers, and interconnections. Template-driven SSPs that do not reflect the actual environment create contradictions the assessor surfaces immediately. Write the SSP from the ground up, reflecting the actual architecture, not the desired architecture.

The audit fix. Run a documentation audit against the 14 NIST SP 800-171 r2 domains. For each domain, identify the required evidence artifacts: policies, procedures, configuration records, system logs, access review records, and assessment reports. Mark each artifact as “exists,” “partial,” or “missing.” Every “missing” entry is a POA&M candidate. Every “partial” entry needs a remediation plan. Prioritize access control, configuration management, and system and communications protection. These three domains generate more than 40% of C3PAO assessment findings across the DIB.

Working With C3PAOs and The Cyber AB Ecosystem

The Cyber AB, formerly the CMMC Accreditation Body, manages the accreditation ecosystem for CMMC. It accredits C3PAOs, certifies individual CMMC assessors (CCAs), and operates the Marketplace where contractors find accredited organizations [The Cyber AB, cyberab.org]. Understanding how the ecosystem works prevents the most common preparation mistake: engaging an unaccredited consultant for assessment work.

C3PAO Selection Criteria

Certified Third-Party Assessment Organizations conduct Level 2 assessments. Only C3PAOs accredited by The Cyber AB produce valid CMMC certifications. Consultants who are not C3PAOs, regardless of their CMMC expertise, cannot conduct certifying assessments. Some organizations offer “CMMC readiness assessments” that are not the same as certifying assessments. Readiness assessments are valuable preparation tools. They do not produce CMMC certificates. Verify C3PAO accreditation status directly through the Cyber AB Marketplace before signing any assessment engagement.

When evaluating C3PAOs, request their current assessment backlog and average assessment timeline. Ask for references from contractors in your size range and industry vertical. Understand their evidence collection process: do they use the CMMC Assessment Process (CAP) methodology published by The Cyber AB? Assessors using the CAP produce consistent, defensible findings. Ask whether the assessment team includes Certified CMMC Assessors with current credentials, not assessors in the provisional or candidate pipeline.

Preparing Your Assessment Team

The assessment involves interviews, document review, and system demonstrations. Every person the assessor interviews must understand the controls they own. A network engineer who cannot explain the organization’s boundary protection approach fails the interview for practice 3.13.1 regardless of whether the technical control exists. Prepare your technical staff by walking through the SSP with them before the assessment. Each person should be able to describe what they do, how it satisfies the relevant practice, and where the evidence lives.

Identify an assessment coordinator who owns the logistics. This person manages document requests, schedules interview sessions, coordinates system access for demonstrations, and serves as the primary C3PAO point of contact. The assessment coordinator does not need to be a security expert. They need to be organized, available, and empowered to get the assessor what they need without delay. Assessment stalls due to unavailable evidence or inaccessible personnel signal disorganization and create negative impressions that affect assessor confidence in the overall program.

The audit fix. Conduct a mock assessment 30 days before your C3PAO engagement. Assign an internal reviewer (or an independent consultant not associated with your C3PAO) to walk through all 110 practices using the CMMC Assessment Process methodology. For each practice, the reviewer should ask for the evidence artifact, interview the control owner, and verify that the evidence matches the SSP description. Document every finding. Resolve every finding before the C3PAO arrives. A clean mock assessment is the strongest indicator of a clean certifying assessment.

The Vulnerability Management and Incident Response Baseline

CMMC Level 2 assessment finds the most technically substantive gaps in vulnerability management and incident response. These are not documentation problems. They are operational program problems that cannot be solved in the 30 days before an assessment.

Vulnerability Management Requirements

Practice 3.11.2 requires periodic scanning of organizational systems and applications to identify vulnerabilities [NIST SP 800-171 r2 §3.11.2]. Practice 3.11.3 requires remediation of vulnerabilities in accordance with risk assessments. The assessment asks for: documented vulnerability scanning frequency, the last three scan reports, evidence of remediation tracking, and a risk-based prioritization methodology. Contractors who run scans but do not track remediation produce scan reports without remediation records, which fails 3.11.3.

A NIST cybersecurity assessment against your current vulnerability management program typically reveals two failure patterns. First: scanning tools in place but no formal tracking process tying findings to remediation tickets and closure dates. Second: scanning scoped to servers and endpoints but not to network devices, applications, and external-facing assets in the assessment boundary. Both patterns generate POA&M findings. Build a vulnerability management program that covers the full assessment boundary and tracks every finding from discovery through closure.

Incident Response Capability

Practice 3.6.1 requires establishing an operational incident handling capability including preparation, detection, analysis, containment, recovery, and user activities [NIST SP 800-171 r2 §3.6.1]. Practice 3.6.2 requires tracking, documenting, and reporting incidents to designated officials. Practice 3.6.3 requires testing the incident response capability.

Testing is the gap. Most contractors have incident response policies. Few have tested them against a documented exercise scenario within the last 12 months. CMMC assessors ask for test records, not just the policy. A documented incident response exercise conducted within the last year, with after-action findings and remediation, satisfies 3.6.3. A policy document without a test record does not. Schedule your incident response test before the assessment. Document the scenario, participants, findings, and the corrective actions taken.

The audit fix. Audit your vulnerability management and incident response programs against NIST SP 800-171 r2 Sections 3.11 and 3.6. For vulnerability management: confirm that scans cover all in-scope assets, that remediation tracking exists in a ticketing system with closure dates, and that high-severity findings have been remediated within 30 days of detection. For incident response: confirm that your plan exists, that it covers all six phases, that it has been tested in the last 12 months, and that the test produced documented findings and corrective actions. If either program has gaps, start remediation this week. Neither program can be built in the 30 days before an assessment.

CMMC 2.0 as Competitive Advantage in the Defense Industrial Base

Early certification converts a compliance requirement into a contract differentiator. Contracting officers awarding CUI contracts face a constrained pool of contractors who can demonstrate a verified 800-171 posture. Organizations that hold a clean SPRS score and a current SSP position themselves as immediately awardable. The competitive calculus survived the suspension. With no governmentwide date pushing everyone into the queue at once, contractors who prepare now separate themselves on evidence rather than on timing.

The SPRS Score as a Business Development Signal

SPRS scores are visible to contracting officers through the SPRS system. A high SPRS score on NIST SP 800-171 demonstrates security program maturity before the formal certification requirement activates. Contractors with documented SPRS scores at or near 110 signal to program offices that they are assessment-ready. Contractors with low or negative scores signal remediation workload and risk of delayed certification. Source selection evaluators have used SPRS scores as evaluation criteria in competitive procurements since 2021.

Subcontractor Flow-Down Requirements

Prime contractors bear responsibility for confirming that subcontractors handling CUI meet CMMC requirements. DFARS 252.204-7021 (effective November 2025) is the subcontractor flow-down clause for CMMC requirements; it requires primes to confirm that subcontractors have achieved the required CMMC level before award and maintain it throughout performance [DFARS 252.204-7021; verify current clause text at acquisition.gov for any subsequent revisions]. Primes who cannot confirm subcontractor compliance face contract performance risk. DIB subcontractors who achieve Level 2 certification early become preferred partners for CUI-handling programs. Certification is both a direct contract eligibility credential and a subcontractor selection differentiator.

Frequently Asked Questions

What is the CMMC 2.0 compliance guide for defense contractors?

CMMC 2.0 is a certification framework requiring defense contractors to demonstrate cybersecurity maturity based on the type of information they handle. Level 1 (15 practices) applies to contractors with Federal Contract Information and requires annual self-assessment. Level 2 (110 practices aligned to NIST SP 800-171 r2) applies to contractors with Controlled Unclassified Information. C3PAO assessment was scheduled to become mandatory at Phase 2 on November 10, 2026. That requirement is suspended, and Level 2 self-assessment with annual affirmation continues. Level 3 applies to contractors supporting high-priority programs and uses NIST SP 800-172 [32 CFR Part 170].

Is the CMMC 2.0 Phase 2 deadline still in effect?

No. Phase 2 was scheduled for November 10, 2026 and would have activated contract clauses requiring C3PAO-validated Level 2 certification across DoD contracts handling CUI. The Department of War suspended it on July 13, 2026, along with Phase 3 and Phase 4, and placed all milestones in abeyance until further notice [DoD CIO Memorandum 26-P-1023]. A CMMC Reform Task Force reports in mid-September 2026. Phase 1 is not affected: Level 1 self-assessments and SPRS uploads remain contract conditions [32 CFR Part 170 §170.3(e)(1)].

How long does CMMC Level 2 certification take?

Level 2 certification requires a minimum of six months under ideal conditions: a completed NIST SP 800-171 r2 self-assessment, active remediation, SSP documentation, and a scheduled C3PAO engagement. Contractors starting from a low or negative SPRS score need longer. The C3PAO assessment itself takes 3-5 assessment days plus 2-4 weeks for report preparation. Open POA&M items must be resolved before certification is issued.

What is an SPRS score and how does it affect CMMC compliance?

The Supplier Performance Risk System score reflects a contractor’s self-assessed compliance with NIST SP 800-171 r2. The scoring model starts at 110 and subtracts points for each practice not fully implemented. Negative scores are possible. Contracting officers see SPRS scores before award. Inaccurate SPRS affirmations expose contractors to False Claims Act liability. For Level 2, a current SPRS score remains required. The C3PAO certification that was to accompany it at Phase 2 is suspended [32 CFR Part 170 §170.24; DoD CIO Memorandum 26-P-1023].

Who can conduct a CMMC Level 2 assessment?

Only Certified Third-Party Assessment Organizations accredited by The Cyber AB produce valid CMMC Level 2 certifications. Individual assessors must hold current Certified CMMC Assessor credentials. Consultants without C3PAO accreditation can assist with readiness preparation but cannot issue certifying assessments. Verify accreditation status through The Cyber AB Marketplace at cyberab.org before signing any assessment engagement agreement.

What is the relationship between CMMC 2.0 and NIST SP 800-171?

CMMC Level 2’s 110 practices map directly to the 110 requirements in NIST SP 800-171 Revision 2. Organizations that have implemented NIST SP 800-171 r2 and documented their implementation in a System Security Plan have completed the foundational work for Level 2 certification. The C3PAO assessment verifies that implementation through document review, interviews, and system demonstrations. CMMC adds the third-party verification layer that NIST SP 800-171 self-assessment alone did not provide [NIST SP 800-171 r2; 32 CFR Part 170]. NIST SP 800-171 Revision 3 was finalized by NIST in May 2024, but DoD has not yet incorporated it into CMMC. Revision 2 remains the operative assessment standard until DoD completes a rulemaking incorporating Revision 3 [DoD CMMC FAQ v3, November 2025].

Do CMMC requirements apply to subcontractors?

CMMC requirements flow down to subcontractors at all tiers who handle FCI or CUI. Prime contractors must confirm that subcontractors achieve and maintain the required CMMC level before subcontract award and throughout performance [DFARS 252.204-7021 (effective November 2025); verify current clause text at acquisition.gov]. Subcontractors who handle CUI were to become ineligible for CUI work without Level 2 certification at Phase 2. With Phase 2 suspended, that eligibility cliff is gone, but the flow-down obligation to implement NIST SP 800-171 Rev 2 and report an accurate SPRS score continues unchanged. The flow-down requirement means small subcontractors are not exempt from CMMC based on size.

Subscribe to The Authority Brief for next week’s analysis.