What is CMMC 2.0 and what changed from the original program?
CMMC 2.0 is the 2021 revision of the Cybersecurity Maturity Model Certification program. It streamlined the model from five levels to three, implements only NIST standards, allows self-assessment for all Level 1 and some Level 2 contractors, and permits limited plans of action and milestones (POA&Ms) for conditional certification. The program is now set out in the CMMC Program rule (32 CFR Part 170), which was published on 15 October 2024 and took effect on 16 December 2024. The DFARS rule that writes CMMC into contracts followed on 10 September 2025 and took effect on 10 November 2025, which started Phase 1.
The version that applies to your organization depends on the information it handles, not on the program's name. Level 1 covers the 15 safeguarding requirements of FAR 52.204-21 for Federal contract information (FCI). Level 2 covers the 110 requirements of NIST SP 800-171 Rev. 2 for controlled unclassified information (CUI), and Level 3 adds 24 selected NIST SP 800-172 requirements for the most critical programs. The final rule states that CMMC adds no security requirements beyond those already in FAR 52.204-21 and NIST SP 800-171 Rev. 2. It verifies implementation of requirements that already apply to your contracts. Start by listing which contracts and clauses you hold and where FCI and CUI actually reside in your systems.
The program status changed on 13 July 2026, when the Department of War suspended CMMC Phase II. That phase had been scheduled to start on 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. A CMMC Reform Task Force began a 60-day review. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Your organization owns its controls and the evidence for them, and an implementation partner can prepare systems and documentation. Only a C3PAO issues Level 2 certification results and only DCMA DIBCAC issues Level 3 results. Confirm the current status on the DoW CIO About CMMC page before you commit to a level.
Which parts of the original program changed in CMMC 2.0
CMMC 2.0 narrowed the original program in a few deliberate ways: fewer levels, NIST-only requirements, more self-assessment, tighter oversight of assessors and limited POA&Ms. Each change alters what a contractor must prepare, who checks it and how much of the work can be done in-house.
Five levels reduced to three
The original model had five maturity levels. The 2021 revision, which the final rule describes as CMMC 2.0, keeps three: Level 1 for Federal contract information, Level 2 for CUI and Level 3 for the most critical programs. Planning starts by identifying which level your contracts actually require, since that choice determines whether you need a self-assessment or a third-party certification. Ask the contracting officer or prime to name the level in writing, because the level can differ from one solicitation to the next.
NIST-only requirements
The revised program drops custom practices and relies only on NIST standards. Level 1 follows FAR 52.204-21, and Level 2 follows NIST SP 800-171 Rev. 2. The final rule states that CMMC adds no security requirements beyond those already in force, so the work is to prove implementation of controls you already owe under existing contract clauses. Confirm which revision your contract cites, since NIST has since published Rev. 3 and the revision in force controls what you must implement.
Self-assessment for some contractors
Under the revised program, Level 1 contractors and some Level 2 contractors may self-assess rather than hire a third-party assessor. Self-assessment shifts the evidence burden onto your own team, who must score each requirement against the NIST assessment objectives and post the result to SPRS. Expect to document your scoring method and keep evidence in final form, because drafts do not count. Whether a given Level 2 contract allows self-assessment depends on its clause and the current Phase status, so confirm that with the contracting office.
Stronger oversight of assessors
The revised program adds oversight of the organizations and people who perform certification assessments. C3PAOs must be authorized or accredited through The Cyber AB, and Level 3 assessments are performed by DCMA DIBCAC. For a contractor, this means assessor eligibility is something you verify, not assume. Check authorization status on the accreditation body's marketplace before signing, and keep consulting and assessment roles separate, because an assessor that helped you build the program may face a conflict of interest.
Limited POA&Ms for conditional status
The revised program permits a plan of action and milestones only in narrow cases, which lets a contractor reach conditional certification while closing remaining gaps. A POA&M does not excuse everything. Requirements that are not eligible for deferral must be fully met at the time of assessment, and open items carry a closeout deadline. Before relying on a POA&M, map each open requirement to the eligibility rules and set a dated closeout plan with an owner.
How the rule and DFARS clause made CMMC enforceable
The program became binding in two legal steps: a 32 CFR Part 170 rule that defined the program, then a DFARS rule that placed CMMC requirements into DoD contracts. Together they moved CMMC from policy into the terms a contractor signs.
Publish the CMMC Program rule in the Federal Register
On 15 October 2024, the Department of Defense published the CMMC Program rule at 32 CFR Part 170. It set out the three levels, the NIST-based requirements, the assessment types and the roles of self-assessors, C3PAOs and the CMMC Accreditation Body. The output for contractors was a defined program, but not yet a contract obligation. Confirm the final text in the eCFR, since the Federal Register version is the published rule of record.
Take effect of the program rule
The program rule took effect on 16 December 2024. From this date, the CMMC requirements in 32 CFR Part 170 were in force as regulation, but DoD still needed a contract mechanism before any company was required to meet them. Contractors should treat this date as the point when the rules became fixed, not when a contract began to require them.
Publish the DFARS acquisition rule
On 10 September 2025, DoD published the DFARS rule that puts CMMC into the acquisition process. It lets contracting officers include CMMC requirements in solicitations and awards and sets how contractors show their status. The output is the legal basis for CMMC to appear in contract terms rather than only in regulation. Contractors should read the Federal Register notice to see how the rule applies to solicitations they expect to bid on.
Start Phase 1 on the DFARS effective date
The DFARS rule took effect on 10 November 2025, which started Phase 1 under 32 CFR 170.3(e)(1). In Phase 1, contracting officers could include CMMC requirements in new awards, and contractors had to show the level their contracts required. Confirm with the contracting officer which level a specific solicitation requires, because the phase schedule has since changed.
Insert clause 252.204-7021 into contracts
Clause 252.204-7021, Contractor compliance with CMMC level requirements, is the contract term that binds the contractor to the level stated in the solicitation. It requires the contractor to maintain its CMMC status for the life of the contract and to flow the requirement down to subcontractors that handle FCI or CUI. The output is an enforceable obligation in each covered award. Ask the contracting officer for the exact clause version and the level in the award before pricing the work.
Apply provision 252.204-7025 to solicitations
Provision 252.204-7025, Notice of CMMC level requirements for solicitations, tells offerors which CMMC level applies and what status they must hold before award. Offerors respond to this provision with their current status, which the contracting officer checks against records in SPRS and eMASS. The output is an eligibility check at the bid stage. Contractors should confirm their posted status in SPRS matches the level they will certify before they submit an offer.
Keep SPRS entries and affirmations current
Once a contract requires CMMC, the contractor must keep its assessment status posted and affirmed as the rules require. Self-assessment results, certification records and annual affirmations by the Affirming Official remain the evidence the contracting officer relies on. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place after the July 2026 Phase II suspension, so these records are the continuing obligation to maintain now.
Where the program stands in October 2026
On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start on 10 November 2026. Phase II would have required Level 2 C3PAO certification for applicable contracts, along with later implementation milestones. The department also started a 60-day review by a CMMC Reform Task Force. Contractors should treat the suspension as a pause in the next步 requirement, not a repeal of the program. Phase I self-assessments, SPRS postings, annual affirmations and the obligations under DFARS 252.204-7012 all remain in place. A company that handles CUI still needs a current, accurate System Security Plan and an SPRS score it can support.
The public record does not agree on every detail. The DoW CIO *About CMMC* page, as of 17 October 2026, says implementation is paused in Phase 1, which began on 10 November 2025, and that the program may only require self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e), however, still lists the original four-phase schedule. Where a rule and an agency page differ, the rule governs what the regulation says, but the agency's current enforcement position determines what a contracting officer will actually ask for. Read both sources, then check the status directly with the contracting officer on each solicitation and subcontract.
Before you make staffing, budget or third-party assessment decisions based on the phase dates, ask your contracting officer in writing which CMMC level and assessment type applies to each contract, whether a certification will be required within the performance period, and how the Reform Task Force review may change the schedule. Keep that written answer with your contract file. The DoW CIO About CMMC page is the natural next read for the current implementation summary, but it is not a substitute for the contract's own clauses.
What the change means for executives, compliance leads and procurement
Executives own the budget, the risk acceptance and the decision about which contracts the company pursues. The 2021 revision of the program removed levels and narrowed the requirements to NIST standards, which makes the scope easier to define. It did not remove the cost of implementing the controls. The Department of War's 13 July 2026 suspension of Phase II moved the date when third-party certification could be required, but it left Phase I self-assessments, SPRS postings and DFARS 252.204-7012 obligations in place. Confirm with your contracting officers and your own contract portfolio which obligations apply now and which are only planned.
- Confirm the current phase: Check the DoW CIO page and the eCFR text together, because the published sources do not fully agree in October 2026.
- Ask for a level-by-contract view: Request a list of contracts showing the required level, the information type and the status of each affirmation.
- Ask for a cost breakdown: Request a quote that separates implementation work, assessment fees and recurring affirmation effort.
- Keep risk acceptance in-house: Decisions about accepting residual gaps, POA&M use and which contracts to bid on stay with the organization.
- Track the review: Assign someone to watch the outcome of the CMMC Reform Task Force review, since the 60-day review could change dates.
Before approving spend, check which obligations are already binding and which depend on a future phase.
Compliance leads run the work that makes the 110 NIST SP 800-171 Rev. 2 requirements provable. Under the Level 2 model, each requirement is judged against its assessment objectives in NIST SP 800-171A, and a requirement counts as met only when all applicable objectives have evidence in final form. The practical task is therefore a documentation and evidence program, not a list of tools. Start with a clear scope, then confirm which requirements each system and provider covers.
- Confirm the level required: Map each contract to Level 1 for Federal contract information or Level 2 for CUI, using the contract clause text.
- Check evidence finality: Drafts do not count, so confirm that policies, plans and system security documentation are approved and dated.
- Map the Rev. 2 requirements to owners: Assign each of the 14 domains to a named person who signs off on its evidence.
- Plan for the Rev. 2 and Rev. 3 gap: Ask how the program will handle the NIST withdrawal of Rev. 2 while the Department of War enforces it.
- Document the POA&M position: Record which requirements, if any, are open and whether they fall within the permitted limits.
Your own environment decides whether the evidence exists, so verify each control against a running system before you sign off.
Procurement reviews implementation partners, assessors and contract terms. The key distinction is that an implementation partner prepares systems, controls and evidence, while only an independent C3PAO issues a Level 2 certification. A partner that also assesses the same organization creates a conflict of interest, so procurement should confirm roles in writing before any work begins. Procurement also has to check the contract clauses that flow down to suppliers, since the requirement can reach subcontractors and cloud or managed service providers.
- Separate the roles in writing: The scope should state that the organization owns its controls and that the partner does not issue reports or certificates.
- Verify assessor authorization: For certification work, confirm the assessor's status on The Cyber AB Marketplace rather than accepting a claim.
- Ask for deliverables: Request a written scope listing the systems, documents and evidence to be produced, plus the fixed timeline.
- Check flow-down terms: Confirm which clause, such as DFARS 252.204-7021, applies to each supplier and what they must provide.
- Confirm exit terms: Ask who keeps the evidence, configuration records and documentation if the engagement ends.
Before signing, confirm that the partner has no assessment role in the same engagement and that the scope matches the contracts in question.
Why Rev. 2 still matters after NIST published Rev. 3
NIST withdrew SP 800-171 Rev. 2 on 14 May 2024, the day it published Rev. 3, but that withdrawal does not change what CMMC Level 2 asks for. The CMMC Program rule in 32 CFR 170.14(c)(3) still ties the Level 2 security requirements to NIST SP 800-171 Rev. 2, and 32 CFR 170.4 counts them as 110 requirements. The rule was written before Rev. 3 existed as a final publication, so the Level 2 requirement IDs in the CMMC Model (such as AC.L2-3.1.1) still trace back to Rev. 2 numbering. Rev. 3 consolidates the requirements to 97, so a contractor that organizes its work around Rev. 3 will not map cleanly onto the assessment objectives the rule uses.
On 13 July 2026 the Department of War said it will enforce Rev. 2 in the interim, the same day it suspended CMMC Phase II. That statement is the most recent official position in the supplied record, but it is an interim position. Readers should not assume it will hold unchanged through the CMMC Reform Task Force review. Practically, this means the controls you implement and the evidence you keep should be built against the Rev. 2 requirements and the NIST SP 800-171A assessment objectives, while you track any change to the rule. Work with your team to record which Rev. 2 requirement each control satisfies, so a later move to Rev. 3 becomes a mapping exercise rather than a rebuild.
Confirm with your contracting officer which NIST version applies to your contract. The clause and the solicitation govern, and a contracting officer can tell you what the program office expects for your awards, including any requirement tied to the Department of War's interim position. Get the answer in writing and file it with your system security plan. Ask the same question of any prime contractor that flows requirements down to you, because the version a prime cites may differ from the one in your own contracts. If the answer is unclear, do not assume the newer revision applies, and do not assume the older one will persist beyond the review period.
Original CMMC levels compared with CMMC 2.0 levels
This table compares the three CMMC levels in the current program with what each one requires, what it protects and how it is assessed. The original program used five levels, and the 2021 revision streamlined them into three, so read each row as the current requirement for that level. The main takeaway is that the requirement source now comes only from NIST and FAR standards, and that Level 2 is the level where self-assessment and third-party certification diverge.
| Level | Information protected | Requirement source | Assessment type |
|---|---|---|---|
| Level 1 | Federal contract information (FCI) | The 15 safeguarding requirements of FAR 52.204-21 | Annual self-assessment, affirmed by an Affirming Official |
| Level 2 | Controlled unclassified information (CUI) | NIST SP 800-171 Rev. 2, 110 requirements | Self-assessment or C3PAO certification, depending on the contract and the program status |
| Level 3 | CUI in the most critical programs | 24 selected NIST SP 800-172 requirements with DoD-assigned parameters | Assessment by DCMA DIBCAC |
| Original five-level model | Streamlined into the three levels above | Replaced by NIST-only requirements with no added security requirements | Confirm the current assessment type for each level with the contracting officer |
| Requirement source | Level 2 requirements are identical to NIST SP 800-171 Rev. 2 | NIST withdrew Rev. 2 in May 2024, but the rule still incorporates it | Confirm which revision your contract references |
| Assessment standard | Level 2 is assessed against NIST SP 800-171A objectives | Each requirement must be met with evidence in final form | Drafts do not count toward a MET result |
Common questions about CMMC 2.0
Is CMMC 2.0 a new program or a revision of the original CMMC?
CMMC 2.0 is a revision of the original program, not a separate program. The 2021 revision streamlined the model from five levels to three, implemented only NIST standards, allowed self-assessment for all Level 1 and some Level 2 contractors, increased oversight of assessors, and allowed limited POA&Ms for conditional certification. The rule that codifies it, 32 CFR Part 170, was published in the Federal Register on 15 October 2024 and took effect on 16 December 2024. The DFARS rule that writes CMMC into contracts through clause 252.204-7021 and provision 252.204-7025 was published on 10 September 2025 and took effect on 10 November 2025. Organizations should read the current rule text, not older summaries of the original five-level model.
Does CMMC Level 2 add new security requirements beyond NIST SP 800-171?
No. CMMC Level 2 uses the same security requirements as NIST SP 800-171 Revision 2, and 32 CFR 170.14 counts them as 110 requirements. The CMMC final rule states that Level 2 adds none beyond NIST SP 800-171 Rev. 2, and Level 1 adds none beyond FAR 52.204-21. CMMC verifies implementation of requirements that already apply to contracts handling Controlled Unclassified Information. The main change is that the requirements are now checked through a defined assessment process with the documented assessment objectives in NIST SP 800-171A. Note that NIST withdrew Revision 2 when it published Revision 3, yet the CMMC rule still incorporates Revision 2, so the reference version matters for your contract.
Is a self-assessment enough to meet CMMC Level 2?
It depends on the contract and the information involved. Under the revised model, some Level 2 contractors may use a self-assessment, while others need a certification assessment by a C3PAO. Self-assessments are performed by the organization itself, scored against the requirements, and posted to SPRS with an annual affirmation by an Affirming Official. The Department of War suspended CMMC Phase II on 13 July 2026, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Confirm with the contracting officer which assessment type your solicitation requires, since the answer can change while the suspension review is underway.
What is a limited POA&M under CMMC 2.0?
A limited plan of action and milestones (POA&M) lets a contractor with a conditional status keep some requirements open for a limited time while it closes them. Under the revised model, it is permitted only in narrow cases, and the detailed thresholds, point limits and closeout windows are set in 32 CFR Part 170. The rule also specifies requirements that cannot be deferred at all. Treat the POA&M as a temporary bridge, not a substitute for implementation, and track each open item with an owner and a closeout date. Because the exact rules are detailed and have been affected by the Phase II suspension, read the current text in the Federal Register and the eCFR before relying on any POA&M, and confirm the conditions with your contracting officer or assessor.
Does the Phase II suspension end the CMMC obligation?
No. The suspension of Phase II does not remove the underlying obligations. The Department of War suspended Phase II on 13 July 2026 and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and the DFARS 252.204-7012 obligations remain in place. The DoW CIO's About CMMC page states that implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2, but the eCFR text of 32 CFR 170.3(e) still contains the original four-phase schedule. Contractors should not treat the pause as a reason to stop preparing. Ask your contracting officer which requirements apply to your current contracts, and watch the official DoW and eCFR pages for the outcome of the review.
What must our organization do itself, and what can a partner do?
Your organization owns its controls, its policies, its risk decisions and its affirmations. Those responsibilities cannot be transferred to a consultant or implementation partner. In practice, your team must decide the scope, name the Affirming Official, approve the system security plan, and make the final calls on which requirements are met. An implementation partner such as DeployOpen can plan, implement, harden, document and back up self-hosted open-source platforms inside your own infrastructure, and prepare systems and evidence for an assessment. DeployOpen does not issue certifications or audit reports. Only an independent assessor, such as a C3PAO for Level 2 certification, can do that. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that written scope.
How DeployOpen works on this
DeployOpen helps defense contractors prepare the systems and evidence that CMMC 2.0 expects, working inside the client's own cloud accounts, data centers or air-gapped networks. Assessments are performed by independent assessors, and DeployOpen does not issue reports or certificates.
How we scope
- Engagements are fixed-scope, with the systems, controls and deliverables agreed in writing before work starts.
- We confirm which environments hold federal contract information or CUI so the written scope matches the work that follows.
- Scope documents name the in-scope assets, the responsibilities your organization keeps, and the items your assessor will need to see.
How we build
- We plan, implement and harden self-hosted open-source platforms that support the NIST SP 800-171 Rev. 2 requirements behind Level 2.
- Configuration, access, logging and backup settings are documented as they are built, so evidence is produced during operation rather than reconstructed later.
- We test the controls we implement and record results, so gaps are found and tracked before an assessor reviews the environment.
How we hand over
- You receive the system documentation, configuration records and evidence artifacts in final form, organized by requirement ID.
- Your organization owns its controls and keeps the approvals, the System Security Plan and any Plan of Action and Milestones decisions.
- We confirm with your team which items an independent assessor will require, so handover matches what the assessment will ask for.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after the initial engagement ends.
- Retainers can keep platforms patched, evidence current and configurations reviewed between assessments, as your program requires.
- Before any retainer starts, confirm in writing which CMMC phase and assessment type your contracts currently require.
Sources and further reading
- CMMC Program final rule, 32 CFR Part 170 (Federal Register, 15 October 2024) ↗
- eCFR: 32 CFR Part 170 ↗
- DFARS CMMC acquisition rule (Federal Register, 10 September 2025) ↗
- Department of War: CMMC Phase II requirements suspended (13 July 2026) ↗
- DoW CIO: About CMMC ↗
- DoW CIO: CMMC Model Overview, Version 2.13 (September 2024) ↗
