What Is CMMC: Complete Guide for Defense Contractors 2026

Posted: March 27, 2026 to Compliance.

What Is CMMC and Why It Matters in 2026

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's program to verify that defense contractors protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) in their systems and networks. After years of development and revision, CMMC 2.0 is now being enforced through new contract requirements appearing in the Defense Federal Acquisition Regulation Supplement (DFARS).

CMMC replaces the self-attestation model under DFARS 252.204-7012, which allowed contractors to self-report their NIST 800-171 compliance. The fundamental problem with self-attestation was that many contractors claimed compliance they did not actually have. CMMC addresses this by requiring third-party assessments for contractors handling CUI at Level 2 and above.

For defense contractors in 2026, CMMC is not a future consideration. It is a current business requirement that affects your ability to bid on and win DoD contracts. The CMMC compliance guide provides the framework, and this article breaks down everything contractors need to know.

CMMC 2.0 Levels Explained

Level 1: Foundational

Level 1 applies to contractors that handle Federal Contract Information (FCI) but not CUI. It includes 15 basic safeguarding practices derived from FAR 52.204-21. These are fundamental security hygiene items that every organization should already implement.

Level 1 practices include:

• Limit information system access to authorized users
• Limit information system access to the types of transactions and functions authorized users are permitted to execute
• Verify and control/limit connections to external information systems
• Control information posted or processed on publicly accessible information systems
• Identify information system users, processes acting on behalf of users, or devices
• Authenticate users, processes, or devices as a prerequisite to allowing access
• Sanitize or destroy information system media containing FCI before disposal or reuse
• Limit physical access to organizational information systems, equipment, and operating environments
• Escort visitors and monitor visitor activity
• Maintain audit logs of physical access
• Control and manage physical access devices
• Monitor, control, and protect organizational communications at external and key internal boundaries
• Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
• Identify, report, and correct information and system flaws in a timely manner
• Provide protection from malicious code at appropriate locations

Level 1 assessment is self-assessment only, submitted annually to the Supplier Performance Risk System (SPRS).

Level 2: Advanced

Level 2 applies to contractors that handle CUI. It encompasses all 110 security requirements from NIST SP 800-171 Rev. 2 (transitioning to Rev. 3). This is the level that most defense contractors working on DoD programs must achieve.

Level 2 has two assessment paths:

• Self-assessment: For contracts involving less sensitive CUI, contractors conduct their own assessment and submit results to SPRS. This path will apply to a subset of contracts as determined by the DoD.
• Third-party assessment (C3PAO): For contracts involving more sensitive CUI, a CMMC Third-Party Assessment Organization (C3PAO) conducts the assessment. The C3PAO verifies that all 110 requirements are implemented and operating effectively.

Level 3: Expert

Level 3 applies to the highest-value programs involving the most sensitive CUI. It adds requirements beyond NIST 800-171 from NIST SP 800-172. Level 3 assessments are conducted by the Defense Contract Management Agency (DCMA). Few contractors will require Level 3 initially, but it will apply to programs with advanced persistent threat (APT) risk profiles.

The CMMC Assessment Process

Preparation Phase

Before scheduling an assessment, complete these preparation steps:

1. Define your CUI scope: Identify exactly which systems, networks, and personnel handle CUI. Narrowing scope reduces compliance effort and cost.
2. Implement all NIST 800-171 requirements: Every requirement must be fully implemented with supporting evidence.
3. Document your SSP: The System Security Plan is the primary assessment artifact. It describes how every requirement is satisfied.
4. Close POA&M items: While limited POA&Ms may be acceptable, assessors expect substantive progress. Critical requirements cannot have open POA&Ms.
5. Conduct a readiness assessment: Have an independent party (RPO or consultant) evaluate your readiness before the C3PAO assessment.
6. Gather evidence: Screenshots, configuration exports, policy documents, training records, audit logs, and other evidence supporting each requirement.

Assessment Phase

The C3PAO assessment typically takes 3 to 5 days on-site for a Level 2 assessment. Assessors will:

• Review your SSP and supporting documentation
• Interview key personnel (IT staff, security officer, management)
• Inspect systems and configurations
• Test security controls through observation and verification
• Document findings for each of the 110 requirements as MET, NOT MET, or NOT APPLICABLE

Post-Assessment

If all requirements are MET, you receive CMMC certification valid for 3 years, with annual affirmation required. If requirements are NOT MET, you receive a report detailing deficiencies. You can remediate and request re-assessment. There is no partial certification; you either meet the level requirements or you do not.

Common CMMC Compliance Challenges

Scope Creep

The most expensive mistake is allowing CUI to flow throughout your entire network. If CUI touches every system, every system must be in scope for CMMC. Implement CUI enclaves: dedicated, segmented network environments specifically for handling CUI. Keep CUI out of general business systems.

Cloud Service Selection

Cloud services used to process, store, or transmit CUI must meet FedRAMP Moderate baseline (or equivalent). Standard commercial cloud services do not qualify. Microsoft GCC High ($35/user/month), AWS GovCloud, and Google Workspace with Assured Controls are the primary options. Budget for the premium pricing of government cloud services.

MFA Implementation

Multi-factor authentication must be enforced on all accounts accessing CUI, not just admin accounts. This includes VPN access, email, cloud services, and any system in the CUI boundary. MFA must use FIPS-validated cryptographic modules, which eliminates some consumer MFA solutions.

Supply Chain Flow-Down

If your subcontractors handle CUI, they must also achieve CMMC certification. Managing subcontractor compliance adds complexity and timeline risk. Start communicating CMMC requirements to subcontractors immediately.

CMMC Timeline and Enforcement

CMMC requirements are appearing in contracts through a phased rollout:

• 2025: CMMC requirements begin appearing in select new contracts and renewals
• 2026: Broader inclusion across DoD contract types
• 2027-2028: Full enforcement across all applicable DoD contracts

Contractors who wait until CMMC appears in their specific contracts will likely face a bottleneck. C3PAO assessment capacity is limited, and demand is growing. Starting now provides time to remediate gaps, schedule assessments, and achieve certification before it becomes a contract prerequisite.

Frequently Asked Questions