CMMC for suppliers: status checks and evidence request

Clear suppliers for CUI before award. What CMMC Level 1 and 2 require now, what Phase 2's suspension changed, and what to ask each supplier for.

Published September 26, 20269 min read

A prime that confirms each supplier's CMMC status before award can release drawings on day one instead of holding a subcontract at signature. As of September 25, 2026, Phase 1 self-assessments remain in force while the Level 2 (C3PAO) requirement is suspended. USW(A&S) implementing memorandum, Attachment 1.

What is CMMC?

The Cybersecurity Maturity Model Certification (CMMC) is the Department of War program that checks whether defense suppliers at every tier protect non-public Federal contract information (FCI) and controlled unclassified information (CUI), which law or policy requires to be safeguarded. Each contract that carries CMMC names a required level, and suppliers post results in the Supplier Performance Risk System (SPRS).

The program rules sit in 32 CFR Part 170, in effect since December 16, 2024. The contract clause is DFARS 252.204-7021, with the solicitation notice at 252.204-7025, both effective November 10, 2025. 90 FR 43560. Under the FAR Overhaul, class deviation 2026-O0025 moved the CMMC policy text to DFARS 240.371 and kept the clause numbers. Class Deviation 2026-O0025, Revision 3, DFARS 240.371.

What are the three CMMC levels?

CMMC has three levels, and the information a contract involves decides which applies. Level 1 protects FCI with the 15 basic safeguarding requirements in FAR 52.204-21. Level 2 protects CUI with the 110 requirements of NIST SP 800-171 Revision 2. Level 3 protects CUI on selected programs and adds 24 enhanced requirements from NIST SP 800-172. 32 CFR 170.14(c).

The level also sets who assesses. Level 1 and Level 2 (Self) use a company self-assessment; Level 2 (C3PAO) uses a certification assessment by an authorized C3PAO every three years, like Level 2 (Self). Level 3 is assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), and a supplier needs a Final Level 2 (C3PAO) status first. 32 CFR 170.15 through 170.18.

Level 2 and Level 3 results are either Final or Conditional. Conditional means the supplier met the minimum score with open items on a POA&M.

CMMC levels, assessments and phase status as of September 2026

Download image

Matrix of the four CMMC statuses by row: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) and Level 3 (DIBCAC). Columns show the information each protects (FCI or CUI), the requirement set, who assesses and how often, whether a POA&M is allowed, and phase status as of September 25, 2026. Level 1 (Self) and Level 2 (Self) are in effect under Phase 1, which began November 10, 2025. Level 2 (C3PAO) and Level 3 (DIBCAC) are marked suspended on July 13, 2026, and may not be designated in new solicitations.

CMMC status	Information protected	Requirements	Who assesses, and how often	POA&M allowed	Phase status as of 2026-09-25
Level 1 (Self)	FCI	15 safeguarding requirements, FAR 52.204-21(b)(1)	Supplier self-assessment every year; affirmation in SPRS every year	No	In effect since Phase 1 began 2025-11-10
Level 2 (Self)	CUI	110 requirements, NIST SP 800-171 Rev 2	Supplier self-assessment every 3 years; affirmation in SPRS every year	Yes, with a score of at least 88 of 110; close within 180 days	In effect; the only Level 2 type program offices may designate during the suspension
Level 2 (C3PAO)	CUI	110 requirements, NIST SP 800-171 Rev 2	Authorized C3PAO certification assessment every 3 years; affirmation every year	Yes, same limits; C3PAO closeout within 180 days	At DoD discretion in Phase 1 (32 CFR 170.3(e)(1)); Phase 2 (planned 2026-11-10) suspended 2026-07-13; may not be designated
Level 3 (DIBCAC)	CUI on selected programs	24 selected requirements, NIST SP 800-172, plus Final Level 2 (C3PAO)	DCMA DIBCAC assessment every 3 years; affirmation every year	Yes, with at least 80 percent and seven excluded requirements; close within 180 days	Planned from Phase 2 at DoD discretion; suspended 2026-07-13; may not be designated

Level 1 (Self) and Level 2 (Self) are the only CMMC requirements program offices may set while Phase 2 stays suspended.

What is the status of CMMC Phase 2?

CMMC Phase 2 is suspended. Phase 1 began on November 10, 2025. Phase 2 was scheduled for November 10, 2026, when Level 2 (C3PAO) certification would have become a routine condition of award. On July 13, 2026, the Department of War suspended Phase 2 and held every later CMMC milestone in abeyance until further notice.

The Chief Information Officer's memo suspended the transition and ordered a 60-day CMMC Reform Task Force review. DoW CIO memorandum, July 13, 2026. The acquisition memo lets program offices designate only Level 1 (Self) or Level 2 (Self). Active solicitations that asked for Level 2 (C3PAO) or Level 3 (DIBCAC) must be amended. For existing contracts, contracting officers are directed to remove them by modification before the next option is exercised or at the next scheduled administrative modification. USW(A&S) implementing memorandum, Attachment 1.

Class Deviation 2026-O0025, Revision 3, signed September 3, 2026, directs contracting officers to remove or revise CMMC requirements so solicitations and contracts ask for Level 1 (Self) or Level 2 (Self). Class Deviation 2026-O0025, Revision 3, paragraph (b). Revision 2, issued July 16, 2026, carried the same paragraph. DFARS 252.204-7012 remains in effect, including NIST SP 800-171 Revision 2 and cyber incident reports within 72 hours of discovery. DoW CIO memorandum, July 13, 2026. DFARS 252.204-7012(a), (c)(1)(ii).

The 60-day review ran to about September 11, 2026. As of September 25, 2026, the DoW CIO CMMC page shows no task force report, new schedule, or Federal Register notice reinstating Phase 2. 32 CFR 170.3(e), unchanged since December 16, 2024, still says Phase 2 begins one year after Phase 1 and that DoD "intends" then to require Level 2 (C3PAO). The suspension rests on the July 13, 2026 memos and the class deviation, not on an amendment to Part 170. Teams leave November 10, 2026, and other Phase 2 dates out of supplier letters, and check subcontract wording with contracts and counsel.

What must a prime confirm before awarding a subcontract?

When a prime contract includes DFARS 252.204-7021, the prime must confirm, before awarding a subcontract that involves FCI or CUI, that the subcontractor has a current CMMC status at the right level. The subcontractor must also have affirmed continuing compliance in SPRS before award and must reaffirm every year. DFARS 252.204-7021(d)(4) and (f)(2).

The right level follows what you send. A supplier needs Level 1 (Self) for FCI, at least Level 2 (Self) for CUI, and Level 2 (C3PAO) when the prime contract requires Level 2 (C3PAO) or Level 3. 32 CFR 170.23(a). While the suspension lasts, those C3PAO requirements are being removed from prime contracts, so a CUI subcontract under a modified prime contract calls for Level 2 (Self). Check your contract before lowering a flowdown.

"Current" has a precise meaning in the clause: no change in compliance since the status date, and a Final Level 1 status under one year old, a Final Level 2 status under three years old with an affirmation under one year old, or a Conditional status under 180 days old. DFARS 252.204-7021(a). The clause flows to every subcontract involving FCI or CUI, except COTS-only subcontracts. See flowdown clauses.

DoD's DFARS rule says contractors can see only their own CMMC information in SPRS, so DoD expects primes to verify with their suppliers and not to share FCI or CUI with any supplier that has not indicated it meets the required level. 90 FR 43560, section 18.

How do POA&Ms and affirmations keep a status current?

A supplier can hold a Conditional Level 2 status while it fixes gaps worth one point each, listed in a plan of action and milestones (POA&M). The supplier must close those gaps and pass a closeout assessment within 180 days of its status date, or the status expires. A senior official must also reaffirm compliance in SPRS every year.

Level 1 allows no POA&M at all. At Level 2, the score must be at least 88 of 110, or 80 percent. Each open item must carry a weight of one point, except CUI encryption without FIPS-validated modules. Six requirements can never be deferred, including the system security plan and physical access controls for CUI. 32 CFR 170.21. Contracting officers may award suppliers with Conditional status. DFARS 240.371-3(b)(2).

The affirming official is the senior official responsible for compliance. That person affirms in SPRS after each assessment, after a POA&M closeout, and every year after a Final status. 32 CFR 170.22. A buyer should track the 180-day closeout deadline and the affirmation anniversary. See the SPRS lesson.

What should you ask suppliers for now?

Before award, ask each supplier that will handle FCI or CUI for its CMMC level and assessment type, whether the status is Final or Conditional, its status date, its latest SPRS affirmation date, and the CMMC assessment's UID for each system that will hold your data. Those answers show whether you can award and release technical data.

Reuse this evidence-request checklist for every supplier that will touch FCI or CUI:

Ask	What a complete answer looks like
CMMC status	"Final Level 2 (Self)", backed by an SPRS printout or certificate
Status date	Date, plus the 180-day closeout deadline if the status is Conditional
SPRS score	Score for a Level 2 self-assessment, such as 105 of 110, and the systems in scope
Latest affirmation date	Date, with the affirming official's name and title
CMMC UID	The 10-character identifier shown in SPRS for each system
Subcontractor flowdown	Confirmation the supplier flows this requirement to its own FCI or CUI subcontractors

Word the request so it survives the task force outcome, and ask for "the CMMC level and assessment type required by this subcontract, as amended" with no phase dates. Re-check it before each option, renewal or new CUI release.

This is follow-up work across many suppliers. Your team can open a task in Cartograph for each supplier and hand it to a buyer or Scout Agent, who emails and calls the supplier for the status, within the permissions your team sets. It also belongs in your C-SCRM review.

What should a small supplier do now?

A small supplier should confirm which customer information it holds, run the matching self-assessment, post the result and an affirmation in SPRS, and send customers its status and UID. That lets a prime clear the supplier for award now, while program offices may not require Level 2 (C3PAO) and the reform review is pending.

List the systems that process, store or transmit FCI or CUI. At Level 2 the scope also includes assets that provide security functions to those systems, and they are assessed on the requirements relevant to what they do. 32 CFR 170.19(b)(1), (c)(1). For Level 1, all 15 requirements must be met. For Level 2, work through the 110 requirements in the NIST SP 800-171 lesson and finish the system security plan first, because it can never sit on a POA&M.

Keep evidence behind every score, because a DoD assessment takes precedence over a self-assessed status. 32 CFR 170.16(a)(1)(iv). Whether to keep a booked C3PAO assessment is a business decision made with your customers and counsel.

Questions teams ask

Is CMMC Level 2 certification required in 2026?

Program offices may no longer require it. Since July 13, 2026, they may designate only Level 2 (Self) for CUI. USW(A&S) implementing memorandum, Attachment 1. A Level 2 (C3PAO) requirement already in a solicitation or contract stays until an amendment or modification removes it, and it flows to CUI subcontracts under that contract, so check the contract with counsel. 32 CFR 170.23(a)(3).

Is CMMC 2.0 different from CMMC?

CMMC 2.0 is the same program. The name refers to the revised three-level program announced in November 2021, which took effect through 32 CFR Part 170 on December 16, 2024.

Can a supplier with open POA&M items receive CUI?

Yes, if it holds a Conditional Level 2 status that meets the limits in 32 CFR 170.21 and the status is under 180 days old. It expires if the POA&M is not closed in time.

Can a prime look up a supplier's CMMC status in SPRS?

DoD said in the September 10, 2025 DFARS rule that contractors can see only their own records in SPRS, so each supplier must share its status, score and UID directly.

Does CMMC apply to suppliers of COTS items?

It does not apply to a contract or subcontract solely for COTS items. 32 CFR 170.3(c) excludes off-the-shelf contracts, and DFARS 252.204-7021(f)(1) leaves COTS subcontracts out of the flowdown.

If your team needs to collect CMMC status from many suppliers before the next award, talk to our team.

This article is general information, not legal or tax advice. Check how the rules apply to your business with your legal or tax advisor.

Sources (12)