Questions defense contractors ask when they plan for CMMC: cost, levels, the assessment process, POA&M rules, timeline, scoping, readiness, subcontractor flowdown, cloud and service providers, Level 1, and choosing a C3PAO.
What CMMC Level 2 costs: DoD's published estimates for self-assessment and C3PAO certification, what those estimates leave out (implementing NIST SP 800-171), what drives cost (scope, assets, enclaves, external service providers, cloud), recurring costs over the three-year cycle, and the effect of the July 2026 Phase II suspension.
The three CMMC levels and four assessment types: what information each protects, which requirements apply, who performs the assessment, how often, whether a POA&M is allowed, and which level a contract can require while Phase II is suspended.
How a CMMC Level 2 certification assessment runs from contracting a C3PAO to the certificate: The Cyber AB's four-phase CMMC Assessment Process, assessment methods and sampling, scoring, the 10-day re-evaluation window, eMASS and SPRS submissions, hashed artifacts, appeals and affirmation. Also how a Level 2 self-assessment differs.
How to pick a CMMC Third-Party Assessment Organization for a Level 2 certification assessment: who may assess, how to verify authorization on The Cyber AB Marketplace, the requirements C3PAOs and their assessors must meet, conflict of interest rules separating consultants from assessors, and what to put in the contract.
When CMMC allows a plan of action and milestones: the 88-point threshold, the 1-point limit and its encryption exception, the six requirements that can never be deferred, the 180-day closeout, what happens if it lapses, and how a POA&M differs from an operational plan of action.
The CMMC rollout schedule and where it stands in October 2026: the rule and DFARS effective dates, the four phases in 32 CFR 170.3, the 13 July 2026 Phase II suspension, the 3 September 2026 DFARS class deviation, the 2028 clause date, and what contractors must still do now.
How to define the CMMC assessment scope: Level 1 scoping around FCI, the five Level 2 asset categories and what each costs in assessment effort, documentation every in-scope asset needs, VDI and enclave approaches that shrink scope, specialized assets, and how Level 3 scope nests inside Level 2.
How to judge whether an organization is ready for a CMMC Level 2 assessment: what a C3PAO checks before it starts, the documents and evidence that must already be final, scoping, ESP responsibility matrices, scoring a mock assessment, artifact hashing and retention, and who may help prepare without being barred from assessing.
How CMMC flows down the defense supply chain: which level a subcontractor needs based on the FCI or CUI it handles and the prime's requirement, what the prime must verify before awarding a subcontract, the DFARS flow-down clause, affirmations and SPRS, and how the 2026 suspension changes required levels.
How CMMC treats cloud providers, managed service providers and other external service providers: when a provider counts as an ESP, the FedRAMP Moderate or equivalent rule for cloud services handling CUI, assessing non-cloud ESPs in the contractor's scope, customer responsibility matrices, and how assessors verify FedRAMP status and equivalency.
How a CMMC Level 1 self-assessment works for contractors that handle only Federal contract information: the 15 FAR 52.204-21 requirements and their 17 mapped NIST SP 800-171A objectives, scoping, all-or-nothing scoring, SPRS entries, annual affirmation, record retention and DoD's cost estimate.
Which companies need CMMC and at which level: the FCI and CUI test, primes and subcontractors at every tier, the COTS exemption, universities, how many companies DoD expects to need certification, and what the 2026 suspension and the 2028 clause date change.
What people mean by CMMC 2.0: the move from five levels to three, NIST-only requirements, self-assessments and limited POA&Ms, the rule and DFARS dates that made it law, and where the program stands in October 2026.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.