What Are the CMMC Requirements for Defense Contractors?

The Cybersecurity Maturity Model Certification (CMMC) program sets cybersecurity assessment requirements for defense contractors and subcontractors. The program rule is at 32 CFR Part 170 (89 FR 83092, effective December 16, 2024), and the DFARS acquisition rule at 48 CFR 204.75 and clause 252.204-7021 (90 FR 43560) took effect November 10, 2025. The Learn Laws® news item on DoD regulatory priorities covers the rollout.

Who is covered. Part 170 applies to DoD contract and subcontract awardees that will process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on contractor information systems (32 CFR 170.3). It covers commercial item acquisitions above the micro-purchase threshold, except those only for commercially available off-the-shelf items. It does not apply to federal systems that contractors operate for the government.

The three levels.

• Level 1. The 15 basic safeguarding requirements in FAR 52.204-21(b)(1). An annual self-assessment with each requirement met is needed, and plans of action are not allowed (32 CFR 170.15).
• Level 2. The requirements of NIST SP 800-171 Revision 2. Depending on the contract, this is a self-assessment or a certification assessment by an authorized third-party assessment organization (C3PAO) (32 CFR 170.16 and 170.17).
• Level 3. Selected requirements from NIST SP 800-172, assessed by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DCMA DIBCAC). A Final Level 2 (C3PAO) status for the same systems is a prerequisite (32 CFR 170.18).

Status and award. Contracting officers check the Supplier Performance Risk System (SPRS) and may not award to an offeror without a current CMMC status at the required level or higher (48 CFR 204.7503). Levels 2 and 3 can be held in a conditional status for up to 180 days, and award can occur at that status, but Level 1 requires a final status (48 CFR 204.7502). Under 252.204-7021, Final Level 2 and Level 3 statuses are current for up to 3 years, and each status needs an affirmation of continuous compliance by an affirming official at least annually.

Phased rollout. Phase 1 began with the DFARS rule and focuses on Level 1 and Level 2 self-assessments. Phase 2 begins November 10, 2026, one calendar year after Phase 1, and adds Level 2 C3PAO requirements for applicable contracts (32 CFR 170.3(e)). Phases 3 and 4 follow at one-year intervals, ending in full implementation, including option periods (32 CFR 170.3(e)).

Related clauses. CMMC sits alongside the safeguarding and incident reporting duties in DFARS 252.204-7012. The FAQ on the DFARS 72-hour cyber incident reporting rule covers reporting duties under the 7012 clause. Training staff on handling controlled information is part of compliance training, and the FAQ on what HIPAA training involves shows a similar approach to role-based data security training.