The State of CMMC for
Small Defense Contractors
How ready the small business defense base really is for the Cybersecurity Maturity Model Certification, in plain business English.
The Custodia Small Business CMMC Readiness Index
The small business defense base scores 33 out of 100 on CMMC readiness in this inaugural edition. The mandate is sized, the Phase 2 clock is suspended, and the floor is low. Phase 1 self assessment has been in force since November 2025, and most firms are not where the rule already requires them to be.
How this number is calculated
The index is an equal weight mean of three public indicators, computed by Custodia from the cited sources. This inaugural edition uses defense base wide proxies. Future editions add Custodia platform telemetry specific to small business Level 1 readiness. Methodology is published so the number is reproducible.
- Self-assessment score health (61/100): The average self reported NIST 800-171 score sits near negative 12 on a scale that runs from negative 203 to positive 110. Normalized to a 0 to 100 scale, that is 61. Source: U.S. Department of Defense.
- Certification readiness (12/100): Roughly 1,000 organizations have reached Level 2 certification against an estimated 8,350 that will need a third party assessment. That is about 12 percent. Source: The Cyber AB.
- Assessor capacity (26/100): Current certification run rate is near 2,100 per year against 8,350 organizations that need an assessment, roughly 26 percent of annual demand. Source: The Cyber AB.
The universe
How many of us does this actually hit?
The Department of Defense sized this itself. Its Regulatory Impact Analysis for the CMMC program estimates that more than 337,000 contractors and subcontractors are affected, and roughly 230,000 of them are small entities. About two thirds of the entire affected population is small business.
Most of that population sits at Level 1, the basic safeguarding tier for Federal Contract Information. Only an estimated 8,350 medium and large entities are pushed to Level 2, where an outside assessor is required. In other words, the rule is overwhelmingly a small business event, and it is overwhelmingly a Level 1 event.
For context, the defense industrial base is roughly 59,678 companies and 1.1 million workers, and small businesses won more than 183 billion dollars in federal prime contracts in FY2024. The base that this rule touches is not a niche. It is the backbone of how the government buys.
CMMC is not a big business problem with a small business footnote. It is a small business problem at Level 1, by the government's own numbers.
The gap
How far behind is everyone, really?
The single most revealing number in federal cybersecurity is the average self reported score. On a scale that tops out at 110, the average sits near negative 12. The bar is a perfect score. The base is starting deep in the hole.
Worse, the self reported numbers tend to be optimistic. When the Defense Industrial Base Cybersecurity Assessment Center validated scores that contractors reported themselves, it found many self reported perfect scores were not accurate. That gap between what firms claim and what they can prove is exactly what the move to third party assessment is meant to close.
Level 1 does not produce a 0 to 110 score. It is a binary check of 15 requirements, pass or fail. But the same readiness gap shows up: most small firms have never run a real self assessment, and they discover the gaps only when a prime asks for proof.
The floor is low and the self reporting is generous. The affirmation you sign is what turns that from a paperwork problem into a contract problem.
Who is exposed
Is my industry actually in the blast radius?
Exposure is not about whether you feel like a cybersecurity company. It is about whether you touch Federal Contract Information, and almost every federal contract creates it. A statement of work, a delivery schedule, a non public email from a contracting officer: that is all FCI, and FCI triggers Level 1.
The dollars make the reach concrete. Custodia analysis of USAspending shows a single trade, machine shops, drawing more than 75 million dollars in federal obligations in FY2025, spread across thousands of awards to mostly small firms. Repeat that across metal fabrication, construction and facilities, IT services, logistics, and professional services, and the in scope population is most of the small business base.
The firms most surprised to be in scope are the ones who do not think of themselves as defense companies at all: the welder, the parts supplier, the facilities contractor, the staffing firm. The rule does not care about your self image. It cares about your data.
If you hold a federal contract, assume you hold FCI, and assume Level 1 applies until you can prove it does not.
The readiness curve
Is anyone actually getting certified?
After years of warning, actual readiness is tiny. By early 2026 roughly 1,000 organizations had reached Level 2 certification, about 1 percent of the roughly 76,600 entities DoD expects to need Level 2 certification (89 FR 83092, table 5). The assessor side is thin too: around 103 authorized assessor organizations and several hundred certified assessors to serve thousands of companies.
That math creates a queue. Certificates are being issued at a rate in the low hundreds per month against a Level 2 population in the thousands. The Department of Defense named that shortfall itself when it suspended Phase 2 in July 2026, citing severe shortages in third party assessment capacity as one reason the program needed a review.
Level 1 firms self assess, so they are not in the assessor queue. Their risk is different and quieter: they can wait until a prime or a solicitation asks for proof, and then have days, not months, to produce it.
Readiness is a single digit percentage and the assessor pipeline is narrow. Being early is a competitive advantage, not just a compliance checkbox.
The cost of compliance
What is this going to cost me, in time and money?
The good news for the small business base is that Level 1 is the affordable tier. The Department of Defense estimates a Level 1 self assessment near 6,000 dollars for a small entity and near 4,000 dollars for a larger one, and most of that is internal time, not vendor fees.
Level 1 is 15 requirements, self assessed, with no outside assessor required. The expensive path is letting a vendor reframe a 15 requirement self assessment as a full Level 2 rebuild when your contracts only involve FCI. That mismatch, paying for Level 2 infrastructure to solve a Level 1 problem, is the most common way small firms overspend.
Ongoing maintenance, the annual affirmation and keeping evidence current, is a modest recurring cost when the work is done once and kept up, and a painful one when it is rebuilt from scratch every year.
Level 1 is cheap if you scope it correctly and do it once. The cost risk is buying the wrong level, not the right one.
The risk
What happens if I get it wrong?
The affirmation a senior official signs is not a formality. Under the Department of Justice Civil Cyber-Fraud Initiative, knowingly misrepresenting your cybersecurity posture to win or keep federal work is treated as fraud. Aerojet Rocketdyne settled for 9 million dollars in 2022 and Penn State for 1.25 million dollars in 2024, both over false cybersecurity representations.
Once the acquisition rule made the CMMC affirmation a condition of award in November 2025, that affirmation became material to payment, which is the exact element these cases turn on. The exposure is real, but it is also specific: it attaches to knowingly signing something you cannot back up, not to honest gaps you are working to close.
The practical guardrail is boring and effective. Run a real self assessment, write down the result for each requirement, keep the evidence, and only sign once it is true.
The risk is not honest mistakes. It is signing an affirmation you cannot defend. Documentation is the defense.
The small business squeeze
Are small firms getting pushed out?
The defense base has been consolidating for thirty years. The Congressional Research Service documents the aerospace and defense prime field shrinking from 51 companies to 5, and the Department of Defense has flagged a decline in small business prime contractors as a national security concern.
Compliance burden is a consolidation force. Every requirement that is easy for a large firm with a security team and hard for a three person shop pushes work up the chain. CMMC done badly accelerates that squeeze. CMMC done simply, at the right level, is how a small firm stays in the game.
Small businesses still won more than 183 billion dollars in federal prime contracts in FY2024. The opportunity is enormous. The question is whether the small firms that can do the work can also clear the compliance bar to bid for it.
Compliance is becoming a gate on who gets to compete. Clearing it cheaply is a small business survival skill.
The forecast
Where is this going next year?
The rollout changed direction in July 2026. On July 13 the Department of Defense suspended Phase 2 and launched a 60 day top to bottom review of the CMMC program, in a memo signed by DoD Chief Information Officer Kirsten Davies. A CMMC Reform Task Force will deliver findings and recommendations within 60 days, so around September 11, 2026. The memo cites prohibitive compliance costs, severe shortages in third party assessment capacity, and complex regulatory timelines that were forcing new entrants and small businesses to opt out of defense contracts and freezing critical suppliers out of the market. Responses to the associated request for information are due by 12pm Eastern on Friday, August 14, 2026.
Phase 2 would have required third party assessment across contracts involving sensitive but unclassified information starting November 10, 2026. That date is suspended and is no longer an operative deadline. Almost nothing else moved. Phase 1 remains in force, so applicable contracts have required a CMMC self assessment since November 2025. DFARS 252.204-7012 is unaffected. NIST SP 800-171 Rev 2 baseline compliance, self assessments across the defense base, and select government led assessments are still enforced. False Claims Act exposure for a knowingly false affirmation is unchanged. The 32 CFR Part 170 program rule from December 2024 and the 48 CFR acquisition rule from November 2025 are both still on the books.
So Phase 2 is paused, not cancelled. What the suspension removed is the deadline pressure, not the requirement. For a small firm the job in front of you is the one that has been live since November 2025: run a real self assessment, keep the evidence, and sign an affirmation you can defend. Primes still ask, solicitations still carry the clause, and for firms that touch CUI the obligations underneath Level 2, DFARS 7012 and NIST SP 800-171, still apply, so readiness work keeps its value.
Phase 2 is paused, not cancelled. The suspension took away the deadline, not the requirement, and Phase 1 self assessment is live today.
What to do about it
If you hold or want federal work, the move is the same: confirm whether Federal Contract Information touches your business, then meet the 15 Level 1 requirements and post your annual affirmation. Do it during the quiet phase, not the week a contract demands it.
Start with the free CMMC qualifier to see where you stand, read the plain English Level 1 guide, and check the real cost of Level 1 and the False Claims Act risk so you scope it correctly the first time.
CMMC news and key dates
The dates that decide what CMMC asks of you. We keep this timeline current as the rules move.
On July 13, 2026, DoD Chief Information Officer Kirsten Davies signed a memorandum suspending CMMC Phase 2 and opening a top to bottom review of the program, with a CMMC Reform Task Force to report within 60 days and a Request for Information closing August 14, 2026. On September 3, 2026, DFARS class deviation 2026-O0025 Revision 3 turned the July 13, 2026 suspension of CMMC Phase 2 into binding direction to contracting officers: third party (C3PAO) assessment requirements come out of solicitations and contracts, and CMMC Level 1 and Level 2 may be satisfied by self assessment. The program rule, 32 CFR Part 170, is still on the books and still provides for third party certification, so the solicitation sets the track. No new date was set. Phase 2 is paused, not cancelled, and what the pause removed is the deadline pressure, not the requirement.
Level 2 today: Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way.
- Phase 1 self assessment requirements on applicable contracts, in force since November 10, 2025
- DFARS 252.204-7012 and the incident reporting it requires
- The 110 requirements of NIST SP 800-171 Revision 2
- The SPRS score and its posting
- The annual affirmation signed by your senior official (32 CFR 170.22)
- False Claims Act exposure for a knowingly false affirmation
- 32 CFR Part 170, the program rule, and the 48 CFR DFARS acquisition rule, both still codified
If your contracts carry CMMC Level 1 today, nothing about your obligation moved. If you handle CUI, the underlying Level 2 obligations still apply. What the suspension removed is the deadline pressure, not the requirement.
- Sep 3, 2026Class deviation makes the suspension binding on contracting officers
On September 3, 2026, DFARS class deviation 2026-O0025 Revision 3 turned the July 13, 2026 suspension of CMMC Phase 2 into binding direction to contracting officers: third party (C3PAO) assessment requirements come out of solicitations and contracts, and CMMC Level 1 and Level 2 may be satisfied by self assessment. The program rule, 32 CFR Part 170, is still on the books and still provides for third party certification, so the solicitation sets the track. No new date was set.
- Sep 11, 2026CMMC Reform Task Force report date
The 60 day review opened on July 13 reached its report date. A report alone changes no contract obligation; only a deviation, a DFARS rule change, or an amendment to 32 CFR Part 170 does. We will update this timeline when a published change lands.
- Aug 14, 2026RFI responses due
Responses to the CMMC reform Request for Information were due by 12pm ET, the window for contractors to tell DoD what the program should become.
- Jul 13, 2026Phase 2 suspended, 60 day review opened
On July 13, 2026, DoD Chief Information Officer Kirsten Davies signed a memorandum suspending CMMC Phase 2 and opening a top to bottom review of the program, with a CMMC Reform Task Force to report within 60 days and a Request for Information closing August 14, 2026. The memo cites prohibitive compliance costs, severe shortages in third party assessment capacity, and complex regulatory timelines that were pushing small businesses and new entrants out of DoD contracts. Phase 2 would have phased third party assessment requirements into solicitations starting November 10, 2026. That date is no longer operative, and no replacement date has been set.
- Nov 10, 2025DFARS acquisition rule effective (Phase 1)
The 48 CFR rule that puts CMMC into contracts took effect, beginning the phased rollout with Level 1 and Level 2 self assessment requirements.
- Dec 16, 2024CMMC Program Rule effective
32 CFR Part 170, the rule that establishes the CMMC program, its levels, and its assessment structure, became effective.
- Oct 15, 2024Final CMMC program rule published
The final rule published in the Federal Register (89 FR 83092), locking in the 3-level model and the scoring for Level 2.
Want the plain-English version of what changed and when it hits you? Read what CMMC is, the 32 CFR Part 170 rule, and the 48 CFR acquisition rule.
See where your business stands in 4 minutes.
The free Custodia qualifier checks your exposure against all 15 Level 1 requirements. No card, no jargon.
Methodology and sources
This report compiles primary U.S. government data, defense ecosystem figures, and Custodia analysis of public contract data. Every figure above links to its source. The readiness index is computed by Custodia from the cited indicators, with the method shown in the index panel. Figures are current as of the publication date and will be updated in the next edition. This is the inaugural 2026 edition; the report is published annually.
- U.S. Department of Defense. Regulatory Impact Analysis, CMMC Program (32 CFR Part 170). https://downloads.regulations.gov/DOD-2023-OS-0063-0003/content.pdf
- Office of the Federal Register. 32 CFR Part 170, CMMC Program. https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170
- Federal Register. CMMC Program final rule. https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program
- Federal Register. DFARS CMMC acquisition rule (48 CFR), effective November 10, 2025. https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of
- U.S. Department of Defense. CMMC Phase 2 suspension and program review memorandum, Office of the DoD Chief Information Officer, July 13, 2026. https://dodcio.defense.gov/CMMC/
- U.S. Department of Defense. Supplier Performance Risk System, NIST SP 800-171 assessments. https://www.sprs.csd.disa.mil/nistsp.htm
- The Cyber AB. CMMC ecosystem marketplace and town hall figures. https://cyberab.org/marketplace
- Congressional Research Service. The U.S. Defense Industrial Base, Background and Issues for Congress (R47751). https://www.congress.gov/crs-product/R47751
- U.S. Small Business Administration. Small Business Procurement Scorecard, FY2024. https://www.sba.gov/federal-contracting/contracting-data/small-business-procurement-scorecard
- National Defense Industrial Association. Vital Signs, the health of the defense industrial base. https://www.ndia.org/policy/publications/vital-signs
- U.S. Department of Justice. Civil Cyber-Fraud Initiative. https://www.justice.gov/civil/cyber-fraud-initiative
- Custodia analysis of USAspending.gov. Federal contract obligations by industry, FY2025. https://www.usaspending.gov/
Cite this report: Custodia. The State of CMMC for Small Defense Contractors (2026). https://bidfedcmmc.com/state-of-cmmc