# CMMC Level 2: what must defense contractors do now?

> CMMC Level 2 applies to contractors that handle Controlled Unclassified Information and requires all 110 NIST SP 800-171 Revision 2 requirements. Since November 10, 2025, DoD solicitations can require it as a condition of award, mostly through a self-assessment posted in SPRS and affirmed annually. On July 13, 2026, the Department suspended Phase 2, the planned November 10, 2026 start of required C3PAO assessments.

Source: https://www.cyberaccord.com/insights/cmmc-level-2-defense-contractors · Regulatory update by CyberAccord Security Team, CyberAccord · Published 2026-11-05 · Last reviewed 2026-11-05

The third-party assessment mandate is on hold. The self-assessment, the annual affirmation and the DFARS safeguarding duties are not.

![Cover graphic for the CMMC Level 2 regulatory update: four rising steps along a timeline for the four phases, with the second step outlined in dashed gold to mark the suspended Phase 2.](https://www.cyberaccord.com/assets/insights/cmmc-level-2-defense-contractors-cover.webp)

Cover image: Cover graphic for the CMMC Level 2 regulatory update: four rising steps along a timeline for the four phases, with the second step outlined in dashed gold to mark the suspended Phase 2.

## Key takeaways

- CMMC Level 2 requirements are identical to the 110 requirements of NIST SP 800-171 Revision 2 (32 CFR 170.14(c)(3)), and the level applies wherever a contract involves Controlled Unclassified Information.
- Phase 1 began on November 10, 2025, when the DFARS CMMC rule took effect; since then solicitations can require Level 1 (Self) or Level 2 (Self) as a condition of award.
- On July 13, 2026, the Department of War suspended Phase 2, which would have started requiring Level 2 (C3PAO) assessments on November 10, 2026. Phase 1 self-assessment requirements remain in place.
- A Level 2 self-assessment needs every requirement MET for Final status; a Conditional status needs a score of at least 0.8 of the maximum, a limited plan of action and a closeout within 180 days.
- An affirming official must affirm continuing compliance in SPRS after each assessment and annually, and DFARS 252.204-7012 still requires incident reports to DoD within 72 hours.

CMMC Level 2 is the level that applies to defense contractors and subcontractors that handle Controlled Unclassified Information (CUI). Its requirements are the 110 requirements of NIST SP 800-171 Revision 2. The program rule has been in force since December 16, 2024, and the contract clauses since November 10, 2025. In July 2026 the Department of War, as the Department of Defense now also styles itself, suspended the next phase of the rollout. This update sets out what that suspension changed and what it did not, as of late October 2026.

## What does CMMC Level 2 require?

The CMMC Program rule, 32 CFR Part 170, sets three levels. Level 1 covers the fifteen basic safeguarding requirements in FAR 52.204-21(b)(1)(i) through (xv) for Federal Contract Information (FCI). Level 3 adds selected requirements from NIST SP 800-172. Level 2 sits between them: under 170.14(c)(3), "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."

Revision 2 is the version incorporated by reference in 170.2, even though NIST has since published Revision 3. Build to Revision 2 for CMMC.

Level 2 comes in two forms:

- **Level 2 (Self).** The contractor assesses itself under 170.16 and enters the results in the Supplier Performance Risk System (SPRS).
- **Level 2 (C3PAO).** An authorized or accredited CMMC Third-Party Assessment Organization performs the assessment under 170.17 and submits the results to the CMMC instance of eMASS, which passes them to SPRS.

Both measure the same 110 requirements against the same assessment objectives in NIST SP 800-171A. Scoring follows 170.24: the maximum score equals the number of Level 2 requirements, and each requirement NOT MET subtracts one, three or five points. A system security plan is mandatory (CA.L2-3.12.4).

## Which contractors need Level 2, and which kind?

Under 170.3(d), the DoD program manager or requiring activity selects the CMMC status for each procurement, based on whether FCI or CUI will be processed, stored or transmitted on contractor systems. The solicitation provision at DFARS 252.204-7025 names the required level: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC).

The requirement flows down the supply chain. Section 170.23(a) sets the minimum for subcontractors:

- A subcontractor that handles only FCI needs Level 1 (Self).
- A subcontractor that handles CUI needs at least Level 2 (Self).
- If the prime contract requires Level 2 (C3PAO) or Level 3 (DIBCAC), a subcontractor that handles CUI needs at least Level 2 (C3PAO).

A machine shop that receives controlled drawings from a prime is in the same position as the prime for the systems that touch those drawings.

> **Next step:** Not sure your SPRS score would survive a government-led assessment? We can review it against NIST SP 800-171 with you. [Explore Defense Manufacturing](https://www.cyberaccord.com/industries/defense-manufacturing) · [Book a free consultation](https://www.cyberaccord.com/contact)

## What is the CMMC phase-in schedule?

Section 170.3(e) phases the program into contracts over four phases. Phase 1 begins on the effective date of the DFARS acquisition rule, and each later phase begins one calendar year after the one before. The DFARS final rule (90 FR 43560) was published on September 10, 2025 and took effect on November 10, 2025, which fixes the dates below.

| Phase | Start date | What 170.3(e) says DoD intends |
|---|---|---|
| 1 | November 10, 2025 | Level 1 (Self) or Level 2 (Self) as a condition of award. DoD may, at its discretion, require Level 2 (C3PAO) instead. |
| 2 | November 10, 2026 | Adds Level 2 (C3PAO) as a condition of award for applicable contracts. Suspended on July 13, 2026. |
| 3 | November 10, 2027 | Level 2 (C3PAO) for all applicable contracts, including option periods, and Level 3 (DIBCAC) for applicable contracts. |
| 4 | November 10, 2028 | Full implementation in all applicable solicitations and contracts, including option periods on older contracts. |

The DFARS rule's preamble describes the same structure from the contracting side: for the first three years, the clause is used where program offices decide to apply a CMMC requirement; after that, it applies to all contracts that involve FCI or CUI on contractor systems, except those solely for commercially available off-the-shelf items.

**Figure 1. The four phases scheduled in 32 CFR 170.3(e). Phase 2, the start of required C3PAO assessments, was suspended in July 2026.**

![A timeline of the four CMMC implementation phases set by 32 CFR 170.3(e). Phase 1 starts November 10, 2025, the effective date of the DFARS rule, with Level 1 and Level 2 self-assessments. Phase 2 was due on November 10, 2026 to add Level 2 C3PAO assessments and is marked as suspended on July 13, 2026. Phase 3 starts November 10, 2027 with C3PAO assessments for all applicable contracts and Level 3. Phase 4, full implementation, starts November 10, 2028.](https://www.cyberaccord.com/assets/insights/cmmc-phase-in-timeline.svg)

Image description: A timeline of the four CMMC implementation phases set by 32 CFR 170.3(e). Phase 1 starts November 10, 2025, the effective date of the DFARS rule, with Level 1 and Level 2 self-assessments. Phase 2 was due on November 10, 2026 to add Level 2 C3PAO assessments and is marked as suspended on July 13, 2026. Phase 3 starts November 10, 2027 with C3PAO assessments for all applicable contracts and Level 3. Phase 4, full implementation, starts November 10, 2028.

## What changed with the July 2026 suspension?

On July 13, 2026, the Department of War announced the immediate suspension of the CMMC Phase II requirements that were scheduled for November 10, 2026, together with pending and future CMMC implementation milestones in its solicitations and contracts. The release states that "All Phase I self-assessment requirements remain firmly in place." It says that, in the interim, the Department will enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments, and it set up a CMMC Reform Task Force to report within 60 days.

According to Holland & Knight's summary of the implementing memoranda, contracting officers were directed to amend active solicitations to remove Level 2 (C3PAO) and Level 3 requirements, and to modify existing contracts before the next option period or at the next scheduled administrative modification. Until a contract is modified, its terms still bind.

Two points matter for planning:

- **The regulation has not changed.** As of late October 2026, the eCFR text of 32 CFR 170.3(e) still sets out all four phases, and DFARS 252.204-7021 is still the November 2025 clause. The suspension is a policy decision about what goes into solicitations, not a rewrite of the rule.
- **The direction of travel is not settled.** We have not seen a published task force report or a new start date for third-party assessments. Treat any date you read for Phase 2 as unconfirmed until the Department publishes it.

> [!WARNING]
> The suspension does not reduce what you must already do. DFARS 252.204-7012 still requires NIST SP 800-171 on covered systems and incident reports within 72 hours. Level 2 (Self) still requires an honest score in SPRS and an annual affirmation by a senior official. An affirmation that does not match reality is a legal risk, not only a security one.

## What does a Level 2 self-assessment involve?

Section 170.16 sets the procedure. The contractor assesses every Level 2 requirement in its assessment scope against NIST SP 800-171A and enters the results in SPRS. The SPRS entry includes the CMMC level, the status date, the assessment scope, the CAGE codes covered, the overall score and any plan of action and milestones (POA&M).

There are two possible results:

- **Final Level 2 (Self)** means every requirement is MET.
- **Conditional Level 2 (Self)** allows a limited POA&M under 170.21(a)(2). The score divided by the number of Level 2 requirements must be at least 0.8. No requirement on the POA&M may be worth more than one point, except encryption that is in place but not FIPS-validated (SC.L2-3.13.11). Some requirements can never go on the POA&M, including the system security plan, external connections, control of public information, and the three physical access requirements for escorting visitors, keeping access logs and managing physical access devices.

A conditional status must be closed out by a new self-assessment of the open items, posted to SPRS within 180 days of the conditional status date. If it is not, the conditional status expires and the contractor is ineligible for new awards at that level until it achieves a new status.

The status lasts three years. DFARS 252.204-7021 treats a Final Level 2 status as current for up to three years, provided nothing has changed and the affirmation is not older than one year. Under 170.22, an affirming official, the senior person responsible for compliance, must affirm continuing compliance in SPRS after each assessment, after a POA&M closeout and annually after the final status date.

Section 170.16(a)(1)(iv) also reserves DoD's right to have DCMA's DIBCAC assess a self-assessed contractor. If that assessment finds the requirements were not met, its results take precedence over the self-assessed status.

## How do you keep the Level 2 scope manageable?

The assessment covers the CMMC Assessment Scope, which you must define before you assess (170.19). Table 3 to 170.19(c)(1) sorts assets into categories:

| Asset category | What it is | How it is treated |
|---|---|---|
| CUI Assets | Process, store or transmit CUI | Assessed against all Level 2 requirements |
| Security Protection Assets | Provide security functions to the scope | Assessed against the requirements relevant to what they do |
| Contractor Risk Managed Assets | Can, but are not intended to, handle CUI because of your policies | Documented in the SSP; limited checks if questions arise |
| Specialized Assets | IoT, operational technology, test equipment and similar | Documented and managed under your risk-based policies |
| Out-of-Scope Assets | Cannot handle CUI and do not protect CUI assets | You must be able to justify the classification |

Many manufacturers limit cost by keeping CUI in a defined enclave rather than across the whole business. Two scoping rules then matter. A cloud service provider that stores CUI must be FedRAMP Moderate authorized or meet the equivalent baseline. An external service provider that handles security protection data for you, such as a managed security provider, has its services assessed within your scope as Security Protection Assets, and the arrangement must be documented in your SSP. The DoW CIO publishes a Level 2 Scoping Guide and a Level 2 Assessment Guide that expand on these rules.

> [!NOTE]
> Shop-floor machines often count as Specialized Assets. They still need to be in the asset inventory, the SSP and the network diagram, so do not leave them off because they cannot run endpoint software.

## What do the DFARS clauses add?

The contract clauses turn the program rule into obligations of award and performance:

- **DFARS 252.204-7025** makes an offeror ineligible for award without the required current CMMC status and a current affirmation in SPRS for each system that will handle FCI or CUI. The proposal must list the CMMC unique identifiers (CMMC UIDs) that SPRS assigns to those systems.
- **DFARS 252.204-7021** requires the contractor to keep the required status for the duration of the contract, handle FCI or CUI only on systems that hold that status, affirm annually, close out any POA&M, report changes in CMMC UIDs to the contracting officer, and flow the requirement down to subcontractors.
- **DFARS 252.204-7012** requires adequate security under NIST SP 800-171, reporting of cyber incidents within 72 hours of discovery, and preservation of images of affected systems for at least 90 days after the report.
- **DFARS 252.204-7019** requires offerors that must implement NIST SP 800-171 to have a current assessment, not more than three years old, with summary scores in SPRS.

## Where to start

1. **Find your CUI.** List which contracts and parts carry CUI markings, who receives them and which systems they touch.
2. **Draw the scope.** Decide whether an enclave is practical, then categorize every asset under Table 3 to 170.19(c)(1).
3. **Write or refresh the system security plan.** No Level 2 assessment can pass without one, and it cannot sit on a POA&M.
4. **Run an honest self-assessment** against all 110 requirements and NIST SP 800-171A. Compare the score with what is in SPRS today.
5. **Close the high-value gaps first.** Five-point requirements such as multi-factor authentication cannot go on a POA&M.
6. **Name the affirming official** and set a calendar for the annual affirmation.
7. **Check your subcontractors** and confirm what level each one needs under 170.23.
8. **Watch each solicitation** for the level it names, and watch for the Department's next announcement on third-party assessments.

Our [defense manufacturing](https://www.cyberaccord.com/industries/defense-manufacturing) work covers each of these steps. We assess gaps against [NIST SP 800-171](https://www.cyberaccord.com/compliance/nist), help write the system security plan, and can act as your [virtual CISO](https://www.cyberaccord.com/services/advisory/vciso) to own the program. For the technical controls, we run [managed security](https://www.cyberaccord.com/services/managed-security) for endpoints, email and cloud alongside your IT provider, and [cloud security](https://www.cyberaccord.com/services/cloud-security) for CUI enclaves. Any service we provide inside your scope is documented in your SSP and assessed with it. We are not a C3PAO and do not issue a CMMC status. If you want a second view on where your score stands, [talk to us](https://www.cyberaccord.com/contact).

## Get your Level 2 evidence ready before the next solicitation

We help defense manufacturers and their suppliers scope the CUI environment, close NIST SP 800-171 gaps, write the system security plan and prepare an honest SPRS score. We prepare you; an authorized C3PAO performs any certification assessment.

- Defense Manufacturing: https://www.cyberaccord.com/industries/defense-manufacturing
- Book a free consultation: https://www.cyberaccord.com/contact

## Frequently asked questions

### Does the Phase 2 suspension mean we can stop CMMC work?

No. The suspension paused the planned requirement for C3PAO assessments. Phase 1 self-assessments, SPRS posting, annual affirmations and the DFARS 252.204-7012 safeguarding and 72-hour reporting duties all remain, and DoD has said it will enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments.

### What score do we need for a Conditional Level 2 status?

Under 32 CFR 170.21, the score divided by the 110 Level 2 requirements must be at least 0.8. Only requirements worth one point, plus non-FIPS-validated encryption, may go on the plan of action, several requirements such as the system security plan can never be deferred, and the plan must be closed out within 180 days.

### Is CyberAccord a C3PAO?

No. We do not perform CMMC certification assessments or issue a CMMC status. We help you prepare: scoping, gap assessment against NIST SP 800-171, the system security plan, remediation and the evidence an assessor will ask for.

## Sources

- [32 CFR Part 170, Cybersecurity Maturity Model Certification (CMMC) Program](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170), Electronic Code of Federal Regulations (eCFR), 2026
- [Cybersecurity Maturity Model Certification (CMMC) Program (final rule, 89 FR 83092)](https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program), Federal Register, 2024-10-15
- [DFARS: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041, final rule, 90 FR 43560)](https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of), Federal Register, 2025-09-10
- [DFARS 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements (NOV 2025)](https://www.acquisition.gov/dfars/252.204-7021-contractor-compliance-cybersecurity-maturity-model-certification-level-requirements.), Acquisition.gov, 2025-11
- [DFARS 252.204-7025, Notice of Cybersecurity Maturity Model Certification Level Requirements (NOV 2025)](https://www.acquisition.gov/dfars/252.204-7025-notice-cybersecurity-maturity-model-certification-level-requirements.), Acquisition.gov, 2025-11
- [DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (MAY 2024)](https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.), Acquisition.gov, 2024-05
- [DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements (NOV 2023)](https://www.acquisition.gov/dfars/252.204-7019-notice-nistsp-800-171-dod-assessment-requirements.), Acquisition.gov, 2023-11
- [Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements](https://www.war.gov/News/Releases/Release/Article/4542329/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/), U.S. Department of War, 2026-07-13
- [DOW Suspends CMMC Phase II Requirements](https://www.hklaw.com/en/insights/publications/2026/07/dow-suspends-cmmc-phase-ii-requirements), Holland & Knight, 2026-07-31
- [CMMC Resources & Documentation (Level 2 Scoping Guide and Level 2 Assessment Guide)](https://dodcio.defense.gov/CMMC/Resources-Documentation/), DoW CIO
- [NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations](https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final), NIST Computer Security Resource Center

Last reviewed 2026-11-05. General guidance, not legal advice.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com