CMMC Compliance 101: Answers to Common Questions

_{Originally published August 2024 · Updated November 2026.}

CMMC (Cybersecurity Maturity Model Certification) is the standard for implementing cybersecurity across the Defense Industrial Base (DIB). It gives the Department of Defense added assurance that DIB companies protect sensitive unclassified information and that the same protection flows down to subcontractors in a multi-tier supply chain.

CMMC 2.0 has three levels: Level 1 (Foundational) for Federal Contract Information, Level 2 (Advanced) for Controlled Unclassified Information, aligned to NIST SP 800-171, and Level 3 (Expert) for the most sensitive programs.

CUI is information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government. The CUI Registry lists the official categories.

Yes, if the DoD contract carries a CMMC requirement. Requirements flow down to subcontractors, and the level you need depends on the type and nature of the information your prime contractor passes to you.

Organizations that provide only commercial off-the-shelf (COTS) products are excused from the CMMC requirement. If you provide anything beyond COTS and handle federal contract information or CUI under a covered contract, expect a requirement.

The rollout is under review. As of October 8, 2026:

• December 16, 2024: the CMMC program rule (32 CFR Part 170) took effect.
• November 10, 2025: the DFARS acquisition rule took effect. In Phase 1, Level 1 and Level 2 self-assessment requirements can appear in new solicitations.
• July 13, 2026: the Department of War suspended the move to Phase 2, which would have made third-party (C3PAO) Level 2 certification a condition of award starting November 10, 2026. It also paused later milestones and launched a 60-day review through a CMMC Reform Task Force.
• Still in force: DFARS 252.204-7012, NIST SP 800-171, Phase 1 self-assessment requirements, and SPRS scores and affirmations.
• Open question: public sources report that the task force report was due in mid-September and that formal determinations were expected in mid-October.

For Echelon’s view of what the suspension means in practice, read CMMC Phase II Is Suspended. Your Security Requirements Aren’t.

For a Level 2 assessment, an organization that scores at least 88 of 110 and documents only eligible gaps in a Plan of Action and Milestones (POA&M) can earn conditional status. It then has 180 days to close those gaps and pass a closeout assessment. Some requirements cannot be deferred to a POA&M, and below 88 no POA&M is allowed. If the gaps are not closed within 180 days, conditional status expires. Level 1 allows no POA&M.

Cost depends on the level you need, how large and complex the environment that handles CUI is, and how many gaps you must close before the assessment. A gap assessment gives you a defensible starting point for budgeting.

Start by finding out which level your contracts require, based on the information you handle. Then scope the environment that holds that information and run a gap assessment against NIST SP 800-171. A Registered Practitioner can lead the maturity analysis, and a Registered Practitioner Organization such as Echelon can perform the CMMC gap assessment. The report shows your current state, how effective your existing controls are, and where you are not yet fully compliant. Certification assessments themselves are performed by Certified Third-Party Assessment Organizations (C3PAOs).

Not sure which assessment you need? Read CMMC 2.0: Gap Assessment vs. Pre-Audit Assessment.