What is CMMC? The plain-English guide

CMMC stands for Cybersecurity Maturity Model Certification. It is how the U.S. Department of Defense verifies that its contractors and subcontractors protect sensitive federal information. If you want to win or keep DoD work, you have to meet the CMMC level your contracts require and record it in the government's SPRS system.

Three. Level 1 covers Federal Contract Information (FCI) and is a self assessment of 15 safeguarding requirements. Level 2 covers Controlled Unclassified Information (CUI) and is 110 requirements from NIST SP 800-171, self assessed and scored out of 110. Level 3 is the highest tier, for the most sensitive programs, assessed by the government.

It comes down to what information your contracts hand you. If you only handle Federal Contract Information, non public information under a contract, you need Level 1. If the government sends you Controlled Unclassified Information, you need Level 2. DFARS 252.204-7012 governs CUI but sits in nearly every DoD contract, so the clause alone does not decide it; whether CUI actually flows to you, and the CMMC level the solicitation names, do. Not sure which you handle? Take the free 2 minute check.

Phase 1 took effect on November 10, 2025 and remains in force: applicable DoD contracts require a current CMMC self assessment, affirmed in SPRS by a senior official. On July 13, 2026, DoD Chief Information Officer Kirsten Davies signed a memorandum suspending CMMC Phase 2 and opening a top to bottom review of the program, with a CMMC Reform Task Force to report within 60 days and a Request for Information closing August 14, 2026. On September 3, 2026, DFARS class deviation 2026-O0025 Revision 3 turned the July 13, 2026 suspension of CMMC Phase 2 into binding direction to contracting officers: third party (C3PAO) assessment requirements come out of solicitations and contracts, and CMMC Level 1 and Level 2 may be satisfied by self assessment. The program rule, 32 CFR Part 170, is still on the books and still provides for third party certification, so the solicitation sets the track. No new date was set. Phase 2 is paused, not cancelled, and what the pause removed is the deadline pressure, not the requirement.

The Department's own estimates, from the CMMC program rule (89 FR 83092): $5,977 a year of labor for a small business's Level 1 self assessment and affirmation, $34,277 for a Level 2 self assessment year and $101,752 for a certification year, all assuming the requirements are already implemented. A consultant bills readiness as a project; a platform compresses it into a subscription. The single biggest cost lever at Level 2 is scope, how much of your business actually touches CUI.

Level 1 is always self assessed and affirmed in SPRS by a senior official, annually, with no third party auditor. Level 2: Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. Level 3 is government assessed.

Not unless your solicitation names it. As of September 3, 2026, a DFARS class deviation directs contracting officers to remove third party assessment requirements from contracts, and Level 1 and Level 2 may be satisfied by self assessment. The program rule still provides for certification, so the solicitation sets the track. DFARS 252.204-7012, NIST SP 800-171 Rev 2, the SPRS score and the annual affirmation are unchanged. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.