Who needs CMMC certification

A prime contractor is in scope when it will process, store or transmit Federal contract information (FCI) or controlled unclassified information (CUI) while performing a DoD contract. Under 32 CFR 170.23(a), that trigger applies to primes and to subcontractors at every tier, and the prime carries the added duty to flow the requirements down to its subcontractors. The contract clause, DFARS 252.204-7021, is the mechanism that puts the required CMMC level into the contract. Until 9 November 2028, the clause goes into a contract only when the program office or requiring activity specifies a level. From 10 November 2028, it applies whenever contractor systems will process, store or transmit FCI or CUI, except for contracts solely for COTS items.

• Trigger: handling FCI or CUI in performing the contract, not the size of the award or the company.
• Clause logic: until 9 November 2028, the requiring activity names the level; from 10 November 2028, the clause applies by default to FCI or CUI systems.
• Flow-down: the prime must pass the required level to subcontractors that will handle FCI or CUI.
• Current status: the 13 July 2026 suspension of Phase II and the 3 September 2026 class deviation mean requiring activities may specify Level 1 (Self) or Level 2 (Self) for now.
• Confirm with the contracting officer: which level each solicitation names and whether the clause appears in the contract.

Before bidding, ask the contracting officer in writing which CMMC level the solicitation requires and whether the 2026 deviation changes it.

A subcontractor at any tier is subject to CMMC when its subcontract involves FCI or CUI. The test is what the subcontractor will handle, not where it sits in the supply chain. A second-tier supplier that receives technical drawings marked CUI is in scope, even if the prime never shares them directly. Subcontractors cannot rely on the prime's certification, and the level a subcontractor must meet is set by the requirement passed down under the flow-down, not by the subcontractor's own choice.

• Trigger: any subcontract where the sub will process, store or transmit FCI or CUI.
• Level: determined by the requiring activity or prime, based on the information handled.
• Affirmation: the subcontractor's affirming official must attest to continuing compliance, as described in 32 CFR 170.22.
• Flow-down: the prime must flow the requirement to the sub, and the sub must flow it further if its own subs handle FCI or CUI.
• Illustrative example: a machine shop that receives CUI drawings from a prime is in scope even though it delivers finished parts.

Ask each prime which level it requires you to hold, and map every data flow that would bring your company into scope.

The CMMC rule does not apply to contracts and subcontracts that exclusively deliver COTS products to a DoD buyer. COTS is defined in FAR 2.101. The exemption is narrow. It covers the delivery of the product itself, not the way the supplier runs its own business. A company that sells COTS items but uses those same products inside its own systems to process, store or transmit CUI is not exempt for that use, and its internal environment falls under the normal CMMC analysis.

• Exemption: contracts and subcontracts solely for delivering COTS products to a DoD buyer.
• Limit: the exemption does not cover the supplier's own systems that handle CUI.
• Common mistake: assuming a COTS sale removes the company from CMMC when its engineers or support staff use CUI on internal systems.
• Mixed work: a contract that includes non-COTS development or services is not solely COTS, so the exemption may not apply.
• Check: map where CUI enters, is stored and leaves your environment, separate from what you ship.

Ask your contracting officer to confirm in writing whether a given contract is solely COTS, and document the internal CUI systems that fall outside the exemption.

The final rule responds to university comments and separates two situations. When DFARS 252.204-7012 appears in a contract, all contractor-owned systems that process, store or transmit CUI are subject to NIST SP 800-171, whether or not the contractor is doing fundamental research. Universities engaged solely in fundamental research that uses only public information, with no FCI or CUI, are unlikely to face any CMMC requirement. The line is therefore drawn by the information in the systems, not by the label on the research.

• Fundamental research with public information: unlikely to face any CMMC requirement.
• Contracts holding CUI: university-owned systems that process, store or transmit CUI are subject to NIST SP 800-171 when DFARS 252.204-7012 is in the contract.
• Mixed programs: a lab that receives CUI for one project may be in scope for the systems supporting that project even if other work is open research.
• Level in practice: confirm with the sponsor which CMMC level, if any, the contract requires for the systems in question.
• Scope discipline: isolating CUI workloads in defined enclaves can limit which university systems need assessment.

Review each sponsored agreement for the DFARS clauses it includes, and confirm with the contracting office which systems hold CUI.

Your organization owns the CMMC requirement from start to finish. Contract eligibility, the CUI boundary, the systems in scope and the controls that protect them all sit with your leadership and staff, whoever helps you build them. The Affirming Official is a senior person in your company who must personally affirm continuing compliance, and that affirmation is a company decision, not a consultant decision.

• Scope decisions: Your team decides which systems, people, facilities and external providers process, store or transmit FCI or CUI, and documents that boundary.
• Control ownership: Each of the 110 Level 2 requirements needs a named owner who operates the control day to day and keeps its evidence current.
• Affirmations and SPRS entries: The Affirming Official signs affirmations and the organization is responsible for accurate score postings in SPRS.
• Plan of action decisions: Whether to use a POA&M, and for which requirements, is a risk decision your leadership must record and defend.
• Assessment readiness: You choose the assessor, schedule the work and hold final-form evidence for the assessment.

Before relying on any partner, confirm internally who holds each of these responsibilities and who signs off on the final scope.

An implementation partner helps your organization build and document the environment that meets the requirements. DeployOpen, for example, plans, configures, hardens and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, and prepares the system security plan, policies, configuration baselines and evidence that your team will present. The partner works for you under a written scope. It does not assess your controls and it does not issue reports, attestations or certificates.

• Systems work: Configuring access control, logging, encryption, backup and patching on systems you own, so the controls exist before anyone tests them.
• Documentation: Drafting the system security plan, procedures and responsibility matrices for your review, with your staff approving the final versions.
• Evidence preparation: Producing logs, configuration exports, scan results and records that your control owners can review and retain.
• Testing support: Running security testing or mock assessments to find gaps before an official assessor arrives.
• Independence limit: A partner that also assesses your environment for certification would have a conflict of interest, so the partner should not be the assessor.

Ask any partner to state in writing which tasks it performs, which it will not perform, and how it separates preparation from assessment.

The assessor is the independent party that determines whether each requirement is met. Which assessor applies depends on the level and assessment type. For Level 1 and Level 2 self-assessments, your organization performs the assessment itself and posts the result, and the Affirming Official affirms it. For a Level 2 certification assessment, a C3PAO authorized or accredited by The Cyber AB performs the work. For Level 3, DCMA DIBCAC performs the assessment. Under the 2026 Phase II suspension, check which assessment type a given solicitation or contract currently requires.

• Level 1 and Level 2 self-assessment: Your organization conducts it, scores it and records results, with no outside assessor required by the rule for that assessment type.
• Level 2 certification assessment: A C3PAO performs the assessment and issues the outcome, and it must be independent of any consultant that helped you prepare.
• Level 3 assessment: DCMA DIBCAC performs the assessment.
• Assessment methods: Assessors test each requirement against the assessment objectives in NIST SP 800-171A, using evidence in final form.
• Conflicts of interest: The same firm generally cannot both prepare and certify your environment.

Before signing, verify the assessor's authorization or accreditation directly through The Cyber AB, and confirm with your contracting officer which assessment type your contract requires.