# What Is CMMC? The DoD Cybersecurity Rule, Explained for Small Shops

URL: https://limehawk.io/reports/what-is-cmmc
Published: 2026-10-02
Author: Corey Watson, Managing Member
Topic: Guides
Read time: 7 min

CMMC is the DoD's program for proving contractors protect FCI and CUI. Three levels, phased in from November 10, 2025, and paused in Phase 1 since July 2026.

> **TL;DR** CMMC (Cybersecurity Maturity Model Certification) is how the Department of Defense checks that contractors and subcontractors actually protect the contract information they handle. The rule is 32 CFR Part 170. "CMMC 2.0" is the November 2021 rework that cut the original five levels to three. Level 1 covers Federal Contract Information with 15 FAR safeguards. Level 2 covers CUI with the 110 requirements in NIST SP 800-171 Rev 2. Level 3 adds 24 requirements from NIST SP 800-172. Phase 1 started November 10, 2025. On July 13, 2026, the department suspended Phase 2, so contracts can only ask for Level 1 or Level 2 self-assessments for now. The security requirements themselves didn't change.

- Phase 1 in effect since: November 10, 2025

## What is CMMC?

CMMC is the Department of Defense's program for verifying that companies in its supply chain protect two kinds of information: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The rule lives at [32 CFR Part 170](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170). Your contract names a CMMC level, and you have to meet it to be awarded the work.

Most of the security rules aren't new. The [program rule](https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program) says the CMMC safeguarding requirements "are the same as those required by FAR Subpart 4.19 and DFARS clause 252.204-7012," plus some NIST SP 800-172 requirements at the top level. Those clauses have been in contracts for years. What CMMC adds is proof: an assessment, a score in the Supplier Performance Risk System (SPRS), and a senior official at your company signing off every year.

If you make parts for a DoD prime, the prime flows the requirement down to you. That's how most small manufacturers meet CMMC for the first time. It shows up as a line in a subcontract, or as a request for your SPRS entry.

## What does "CMMC 2.0" mean?

CMMC 2.0 is the revised program DoD announced in November 2021. It replaced the original model, which the 2024 rule describes as "five progressively advanced levels" that every contractor would have had certified. After more than 750 public comments and an internal review that began in March 2021, DoD cut the model to three levels and took out the CMMC-only practices.

According to the [final program rule](https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program), the main changes were:

- **"Streamlining the model from five to three certification levels."** Old Levels 2 and 4 went away. Old Level 3 became the new Level 2, and old Level 5 became the new Level 3.
- **Self-assessment** for all of Level 1 and some of Level 2, instead of third-party certification for everyone.
- **Requirements tied directly to NIST and the FAR**, with no extra CMMC-only practices or maturity processes.
- **A time-limited POA&M process** for closing a few gaps after the assessment.

The rule that finally made it law was published October 15, 2024 and took effect December 16, 2024. People still say "CMMC 2.0" to mean this version. The regulation itself just says CMMC.

## What are the three CMMC levels?

The level depends on the information you handle. FCI only means Level 1. CUI means Level 2. Level 3 is for a small set of contracts with the most sensitive CUI. Here's how [32 CFR 170.14](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170) lays them out:

| Level | Data it protects | Requirements | Assessment |
|---|---|---|---|
| 1 | FCI | 15 safeguards in FAR 52.204-21 | Self-assessment every year |
| 2 | CUI | 110 requirements in NIST SP 800-171 Rev 2 | Self-assessment or C3PAO, every 3 years |
| 3 | CUI on high-priority programs | Level 2, plus 24 from NIST SP 800-172 | Government-led (DIBCAC) |

All three need an annual affirmation in SPRS from a senior official. Not sure which kind of data you have? Start with our explainers on [what FCI is](/reports/what-is-fci) and [what CUI is](/reports/what-is-cui). Then go to the level guide that fits: [CMMC Level 1](/reports/cmmc-level-1) or [CMMC Level 2 requirements](/reports/cmmc-level-2-requirements).

One version note. The rule incorporates NIST SP 800-171 **Revision 2**, even though NIST has since published Revision 3. We explain why that matters in our [NIST 800-171 Rev 3 guide](/reports/nist-800-171-rev-3).

## What is the CMMC timeline?

CMMC went into contracts on November 10, 2025, when the [DFARS acquisition rule](https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of) took effect. That started Phase 1. Section 170.3 planned four phases, each beginning "one calendar year" after the last. Phase 2 was due November 10, 2026. It has been suspended.

Here's the short history:

- **2019:** DoD announces CMMC.
- **November 30, 2020:** The first CMMC rule (the "1.0" version) takes effect in the DFARS.
- **November 2021:** DoD announces the revised program, now called CMMC 2.0.
- **December 16, 2024:** The 32 CFR 170 program rule takes effect.
- **November 10, 2025:** The DFARS rule takes effect. Phase 1 begins, with Level 1 (Self) and Level 2 (Self) as conditions of award.
- **July 13, 2026:** The department [suspends the Phase 2 transition](https://dowcio.war.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf) and starts a 60-day review.

Under that memo, programs "must only include the need for CMMC Level 1 (Self) or Level 2 (Self)." They can't require C3PAO or DIBCAC assessments during the suspension, and existing contracts with those requirements get them removed at the next option or administrative modification. The memo also says "the clause at DFARS 252.204-7012 ... remain[s] in effect," and that "further guidance will be promulgated at the conclusion of the CIO's 60-day review."

## Where does CMMC stand as of October 2026?

CMMC is paused in Phase 1. The DoW CIO's [About CMMC page](https://dowcio.war.gov/cmmc/About/) still says, as of October 2, 2026, that "CMMC implementation is paused in Phase 1" and that "All Phase I self-assessment requirements remain firmly in place." The 60-day review window has closed, but I haven't seen any new guidance or replacement schedule published.

So, for now:

- Level 1 and Level 2 self-assessments still apply where a contract calls for them.
- Third-party C3PAO certification is off the table as a contract requirement until DoD says otherwise.
- [DFARS 252.204-7012](/reports/dfars-252-204-7012) still applies to anyone handling covered defense information, including its 72-hour incident reporting.

Check the solicitation in front of you. Don't rely on a blog's timeline, including this one.

## What should a small shop do this quarter?

Figure out what data you actually have, then get an honest score. The pause gives you time. It doesn't lower the bar. Your prime can still ask for your SPRS entry tomorrow, and DoD can still run a government-led assessment on a self-assessed contractor.

A practical order of work for the next 90 days:

1. **Classify the data.** Pull a few recent purchase orders and drawing packages. Are any marked CUI? That one answer decides Level 1 or Level 2.
2. **Draw the boundary.** List every computer, account, and cloud service that touches that data. Many shops shrink the problem by putting CUI in a [CMMC enclave](/reports/cmmc-enclave) instead of securing the whole office to Level 2. For email and files, look at whether [GCC High](/reports/gcc-high-cmmc) is actually required for you.
3. **Score yourself honestly.** Use the DoD methodology and post the result to SPRS. Our [SPRS score guide](/reports/sprs-score) walks through it.
4. **Write it down.** At Level 2 you need a [system security plan](/reports/system-security-plan-template) that describes systems that really exist. Gaps that qualify go on a [POA&M](/reports/poam-cmmc), within the rule's limits.
5. **Fix the five-point items first.** MFA, account control, logging, incident response, and malware protection carry the heaviest point values at Level 2. If any of those are missing, start there.

Plant-floor equipment usually counts as a Specialized Asset, so an old CNC controller doesn't have to be replaced. It does have to be documented and separated from the office network. We cover that on our [manufacturing IT page](/industries/manufacturing).

## Key takeaways

- CMMC doesn't invent new security rules. It makes you prove you meet FAR 52.204-21 (Level 1) or NIST SP 800-171 Rev 2 (Level 2), and puts that proof in SPRS.
- CMMC 2.0 is the November 2021 revision: five levels became three, and self-assessment became an option at Level 1 and part of Level 2.
- The data decides the level. FCI only means Level 1. CUI means Level 2. Your contract or your prime tells you which applies.
- Phase 1 has been in effect since November 10, 2025. Phase 2 was suspended on July 13, 2026, and the program is paused in Phase 1.
- The pause moved the third-party audits, not the requirements. Self-assessments, SPRS entries, annual affirmations, and DFARS 252.204-7012 all still apply.

## What this looks like when we do it

Limehawk isn't a C3PAO, a Registered Practitioner Organization, or an assessor. We don't certify anyone, and we don't sign your affirmation. A senior official at your company does that.

What we do is the IT underneath it. We inventory and scope the environment, segment the plant floor from the office, enforce MFA, run patching and endpoint protection through our RMM, and pull evidence from the same tools that run the controls. On the shop floor, we isolate legacy Windows and controllers instead of forcing replacements. Our [manufacturing IT support](/industries/manufacturing) page has the details.

Have a prime asking about CMMC and not sure which level applies to you? Book a call and we'll sort it out.