CMMC 101: What you need to know from framework to final rule

The Short Answer

The Cybersecurity Maturity Model Certification, or CMMC, is the defense contracting framework used to verify that contractors and subcontractors have implemented required cybersecurity protections for certain federal information.

The CMMC framework has three levels. Level 1 focuses on basic safeguarding of Federal Contract Information. Level 2 focuses on protecting Controlled Unclassified Information using the 110 security requirements in NIST SP 800-171 Revision 2. Level 3 adds additional protections for higher-risk environments.

As of October 2026, CMMC implementation remains in Phase I. Phase II and subsequent implementation milestones were suspended in July 2026 while the Department reviews the program. Phase I self-assessment requirements remain in place, and contractors remain responsible for protecting federal information under applicable contract requirements.

Current CMMC Status: October 2026

CMMC implementation began November 10, 2025 with Phase I. Phase I focuses primarily on Level 1 and Level 2 self-assessment requirements.

On July 13, 2026, the Department suspended the planned transition to Phase II, which had been scheduled to begin November 10, 2026. Pending and future implementation milestones were also suspended while the Department conducts a broader review of the CMMC program.

That does not mean cybersecurity requirements disappeared. Phase I self-assessment requirements remain in effect, and contractors remain responsible for safeguarding covered federal information under applicable contract requirements.

Because CMMC continues to evolve, contractors should always verify the requirements contained in the specific solicitation or contract they are pursuing rather than relying solely on an older CMMC implementation timeline.

CMMC 101 at a Glance

• CMMC is tied to defense contracting. The required CMMC status is identified through applicable solicitation and contract requirements.
• Level 1 protects FCI. It currently requires an annual self-assessment and annual affirmation against 15 basic safeguarding requirements.
• Level 2 protects CUI. It is based on the 110 security requirements in NIST SP 800-171 Revision 2.
• The current Phase I implementation focuses on self-assessments. Phase II certification requirements were suspended in July 2026 pending review.
• Scope matters. Organizations need to know where FCI and CUI are processed, stored, transmitted, and protected.
• Documentation alone is not compliance. Security practices need to be implemented and supported by evidence.
• SPR​​S matters. Applicable assessment results and affirmations are recorded in the Supplier Performance Risk System.
• CMMC is not a one-time project. Security controls and the supporting processes need to continue operating after the assessment is complete.

What Is CMMC?

CMMC stands for Cybersecurity Maturity Model Certification.

The program was established to provide greater assurance that organizations within the defense industrial base have implemented the cybersecurity protections required for sensitive federal information they handle on contractor information systems.

CMMC does not create an entirely separate universe of cybersecurity controls. Instead, its requirements build on existing federal cybersecurity requirements, including safeguards for Federal Contract Information and the requirements in NIST SP 800-171 for protecting Controlled Unclassified Information.

The important difference is assurance: organizations may be required to assess and affirm that those cybersecurity practices are actually implemented.

What Are the CMMC Rules?

CMMC is supported by two major regulatory pieces that perform different jobs.

32 CFR Part 170: The CMMC Program Rule

The CMMC Program itself is codified at 32 CFR Part 170.

This rule establishes the CMMC program, including the levels, assessment types, scoring, affirmations, Plans of Action and Milestones where permitted, assessment organizations, and other program requirements.

The final program rule was published in October 2024 and became effective December 16, 2024.

The DFARS Acquisition Rule

A separate acquisition rule amended the Defense Federal Acquisition Regulation Supplement, or DFARS, to bring CMMC requirements into defense solicitations and contracts.

That final rule became effective November 10, 2025 and includes the contractual CMMC requirements used during acquisition.

Who Needs to Meet CMMC Requirements?

CMMC requirements are tied to applicable defense solicitations and contracts.

A contractor should not determine its required level simply by company size or by assuming that every organization doing defense work has the same requirement.

Instead, organizations need to understand:

• What the solicitation or contract requires
• Whether contractor systems will process, store, or transmit FCI
• Whether contractor systems will process, store, or transmit CUI
• Which information systems support that work
• Which subcontractors and external providers participate in the environment
• What CMMC status is required before contract award

Small contractors and subcontractors should not assume CMMC is only a concern for large defense primes. Cybersecurity requirements can flow through the supply chain based on the work performed and information involved.

What Is Federal Contract Information?

Federal Contract Information, commonly called FCI, is nonpublic information provided by or generated for the government under a contract to develop or deliver a product or service to the government.

CMMC Level 1 focuses on safeguarding FCI using the basic security requirements associated with FAR 52.204-21.

What Is Controlled Unclassified Information?

Controlled Unclassified Information, or CUI, is information the government creates or possesses — or that another entity creates or possesses for or on behalf of the government — that requires safeguarding or dissemination controls under applicable law, regulation, or government-wide policy.

CUI is not classified information, but it requires more protection than ordinary public or business information.

CMMC Level 2 is focused on protecting CUI and incorporates the security requirements in NIST SP 800-171 Revision 2.

What Are the Three CMMC Levels?

The underlying CMMC framework defines three levels based on the information being protected and the cybersecurity requirements involved.

CMMC Level 1: Basic Safeguarding of FCI

Level 1 applies basic safeguards to Federal Contract Information.

It includes 15 security requirements drawn from FAR 52.204-21.

Under the current program, Level 1 requires:

• An annual self-assessment
• Submission of the assessment result in SPRS
• An annual affirmation of continuing compliance

Plans of Action and Milestones are not permitted for Level 1. The required Level 1 safeguards need to be met.

CMMC Level 2: Broad Protection of CUI

Level 2 focuses on protecting Controlled Unclassified Information.

It incorporates the 110 security requirements in NIST SP 800-171 Revision 2.

The standing CMMC framework provides for two Level 2 assessment types:

• Level 2 Self-Assessment
• Level 2 C3PAO Certification Assessment

Under the current Phase I pause, the active implementation focuses on Level 2 self-assessments. A Level 2 self-assessment is performed every three years, with annual affirmation afterward.

Limited Plans of Action and Milestones may be permitted under the program rules, but organizations should understand the eligibility and closeout requirements before assuming a gap can simply be deferred.

CMMC Level 3: Higher-Level Protection of CUI

Level 3 is designed for environments requiring additional protection against more advanced threats.

The standing framework builds on the Level 2 requirements and adds additional requirements derived from NIST SP 800-172. Level 3 assessments are government-led.

However, the broader phased implementation beyond Phase I is currently suspended while the CMMC program is under review. Organizations should not pursue Level 3 simply because it sounds more mature; the appropriate requirement should be driven by the applicable contracting environment.

What Does the CMMC Phase II Suspension Mean?

The July 2026 suspension changed the implementation timeline, but it did not eliminate CMMC or the underlying cybersecurity obligations for defense contractors.

The most important points for contractors are:

• Phase I remains in effect.
• Phase I self-assessment requirements remain active.
• The planned Phase II transition was suspended.
• Future implementation milestones were also suspended pending review.
• The Department continues to enforce applicable NIST SP 800-171 cybersecurity requirements.
• Defense contractors remain responsible for protecting covered federal information under their contracts.

Organizations should therefore avoid two opposite mistakes: acting as though nothing changed, or acting as though CMMC and federal cybersecurity obligations disappeared entirely.

What Is a CMMC Self-Assessment?

A self-assessment requires the organization to evaluate its own implementation of the applicable cybersecurity requirements.

That does not mean the organization should treat the assessment casually.

A meaningful self-assessment should evaluate whether required safeguards are:

• Implemented
• Operating as intended
• Applied across the appropriate scope
• Supported by sufficient evidence

Organizations can perform self-assessments internally or obtain outside assistance, but using a consultant does not transform a self-assessment into an independent certification assessment.

What Is SPRS and Why Does It Matter?

SPRS is the Supplier Performance Risk System.

CMMC self-assessment results and required affirmations are recorded in SPRS so the government can verify that the contractor has the required current status.

Organizations should treat SPRS submissions and affirmations seriously. They should reflect the security posture the organization can actually support with evidence.

Why Is CMMC Scoping So Important?

CMMC scope determines which parts of the organization's environment are subject to the applicable assessment requirements.

For Level 1, organizations need to understand which systems process, store, or transmit FCI.

For Level 2, understanding the CUI environment becomes critical.

Organizations should be able to answer questions such as:

• What CUI do we receive or create?
• Who needs access to it?
• Where is it stored?
• Which systems process it?
• How is it transmitted?
• What systems protect the CUI environment?
• Which facilities are involved?
• Which external service providers interact with the environment?

Accurate scoping can materially affect cost, complexity, remediation, assessment effort, and the number of systems and people that need to satisfy applicable security requirements.

Does Your Entire Company Have to Be in CMMC Scope?

Not automatically.

Good cybersecurity practices should often extend more broadly across the organization, but formal CMMC scope follows the systems, assets, people, facilities, and supporting services involved in handling or protecting the applicable federal information.

Scoping should therefore be an intentional exercise — not an automatic decision that “everything is in scope.”

How Do Subcontractors Affect CMMC?

Defense cybersecurity requirements can flow through prime contractors to subcontractors.

That means a subcontractor should not assume CMMC is irrelevant simply because it does not hold a direct prime contract with the government.

Organizations need to understand what information will be shared, what contractual requirements are being flowed down, and what CMMC status or cybersecurity obligations apply to the subcontract relationship.

What About MSPs, Cloud Providers and Other External Service Providers?

External providers can materially affect the CMMC environment.

Managed service providers, managed security providers, cloud providers, and other technology partners may operate systems, perform security functions, or interact with FCI or CUI.

Organizations therefore need to understand:

• What the provider does
• What information the provider can access
• Which controls the provider operates
• Which responsibilities remain with the contractor
• What evidence the provider can supply
• How that relationship affects CMMC scope

Outsourcing the technology does not automatically outsource accountability.

Is CMMC Just a Documentation Exercise?

No.

Documentation is important because organizations need to describe how cybersecurity requirements are implemented and support those descriptions with evidence.

But writing a policy that says a security process exists is not the same as operating that process.

CMMC readiness should evaluate what the organization actually does and whether those practices are operating consistently — not simply whether the right words appear in a policy template.

What Evidence Should Contractors Expect to Maintain?

Evidence varies depending on the security requirement, but organizations should expect to demonstrate how their security practices actually operate.

Evidence may include:

• Policies
• Procedures
• System configurations
• Access records
• Logs and reports
• Training records
• Asset inventories
• Risk assessments
• Incident-response records
• Screenshots or system-generated evidence
• Demonstrations or interviews where appropriate

A mature program connects each requirement to the policy, procedure, owner, technology, evidence, monitoring, and remediation process supporting it.

Do SOC 2 or ISO 27001 Automatically Satisfy CMMC?

No.

Organizations with established cybersecurity frameworks may already have many useful controls, processes, and evidence in place, but CMMC has its own requirements, scope, evidence expectations, and contractual context.

The efficient approach is not to build a separate security program for every framework.

Instead, organizations should identify reusable controls and evidence, address CMMC-specific gaps, and operate one broader Cyber GRC operating model capable of supporting multiple requirements.

Can a GRC Tool Make You CMMC Compliant?

No tool can make an organization compliant by itself.

GRC technology can be extremely useful for:

• Mapping requirements to controls
• Assigning ownership
• Centralizing evidence
• Tracking remediation
• Managing recurring activities
• Monitoring control performance
• Supporting multiple frameworks
• Creating a system of record

But organizations still need people, processes, implementation, governance, and evidence. That is why the right GRC platform should support the operating model instead of being treated as a compliance easy button.

Does the CMMC Pause Mean Contractors Should Stop Preparing?

For organizations that handle FCI or CUI, stopping cybersecurity work simply because the implementation timeline changed would miss the larger issue.

The requirements to protect sensitive defense information continue to exist independently of whether a future C3PAO assessment milestone has been postponed.

Organizations can use the current period to strengthen the fundamentals:

• Know what federal information you handle
• Define your scope
• Assess the applicable controls
• Close real security gaps
• Improve documentation
• Collect defensible evidence
• Clarify ownership
• Operate the cybersecurity program continuously

The goal should be to build security practices that can withstand future scrutiny because they are already part of how the organization operates.

What Should Defense Contractors Do Now?

1. Read the solicitation and contract. Understand the actual cybersecurity and CMMC requirements that apply to the work.
2. Identify FCI and CUI. Know what federal information the organization receives, creates, stores, processes, and transmits.
3. Define the scope. Identify the people, systems, assets, facilities, providers, and security resources involved.
4. Determine the applicable assessment requirement. Understand whether the current work requires Level 1 or Level 2 self-assessment under Phase I.
5. Assess the current environment. Evaluate the applicable safeguards against what the organization actually does today.
6. Remediate meaningful gaps. Fix the technical and process weaknesses rather than simply documenting around them.
7. Make documentation match reality. Policies, procedures, diagrams, inventories, and security plans should describe actual operations.
8. Build the evidence. Know how the organization will demonstrate that each applicable practice operates.
9. Complete and maintain required SPRS submissions and affirmations.
10. Integrate CMMC with the broader cybersecurity program. Avoid creating an isolated compliance silo that becomes difficult to maintain.
11. Monitor the program for changes. CMMC is under active review, so organizations should watch official guidance and reassess their plans as implementation requirements evolve.

Frequently Asked Questions

What Does CMMC Stand For?

CMMC stands for Cybersecurity Maturity Model Certification. It is the defense contracting framework used to provide assurance that contractors implement required cybersecurity safeguards for certain federal information.

Is CMMC Currently Required?

CMMC Phase I began November 10, 2025 and remains in effect. Phase I focuses on Level 1 and Level 2 self-assessment requirements where applicable. The transition to Phase II and subsequent implementation milestones was suspended in July 2026 while the program undergoes review.

Was CMMC Cancelled in 2026?

No. The Department suspended the transition to Phase II and future implementation milestones while reviewing the program. Phase I self-assessment requirements remain in place, and contractors remain responsible for applicable cybersecurity requirements protecting federal information.

How Many CMMC Levels Are There?

The CMMC framework defines three levels. Level 1 addresses basic safeguarding of FCI, Level 2 addresses broader protection of CUI using NIST SP 800-171 Revision 2, and Level 3 adds higher-level requirements for certain advanced-threat environments.

How Many Requirements Are in CMMC Level 1?

CMMC Level 1 uses 15 basic safeguarding requirements from FAR 52.204-21 and currently requires annual self-assessment and annual affirmation.

How Many Requirements Are in CMMC Level 2?

CMMC Level 2 incorporates the 110 security requirements in NIST SP 800-171 Revision 2 and focuses on protecting Controlled Unclassified Information.

Is CMMC Level 2 Currently a C3PAO Certification Requirement?

The standing CMMC framework includes both Level 2 self-assessments and Level 2 C3PAO certification assessments. However, current implementation remains paused in Phase I, which focuses on self-assessment requirements. The planned transition to Phase II certification requirements was suspended in July 2026.

What Is the Difference Between FCI and CUI?

FCI is nonpublic information provided by or generated for the government under a federal contract. CUI is government-related information that requires safeguarding or dissemination controls under applicable law, regulation, or government-wide policy. CUI generally requires stronger protection.

Is CMMC the Same as NIST SP 800-171?

No. CMMC Level 2 incorporates the 110 security requirements from NIST SP 800-171 Revision 2, but CMMC adds an assessment and affirmation structure used to provide assurance that the requirements are implemented.

Does SOC 2 or ISO 27001 Satisfy CMMC?

Not automatically. Existing frameworks can provide reusable controls, processes, and evidence, but organizations still need to evaluate the specific CMMC requirements, scope, and assessment expectations that apply to their defense work.

Does My Entire Company Have to Be in CMMC Scope?

Not necessarily. The formal assessment scope should reflect the systems, people, assets, facilities, and supporting services involved in processing, storing, transmitting, or protecting the applicable federal information.

Should Contractors Still Prepare for CMMC During the Pause?

Organizations handling FCI or CUI should continue strengthening the security practices their contracts require. The implementation timeline may change, but the underlying obligation to appropriately protect federal information remains.

About This Article

This CMMC 101 guide was originally written by Paula Biggs, CMMC-CCP and published by Hotman Group in December 2024.

Hotman Group substantially updated the article in October 2026 to reflect subsequent CMMC rulemaking, the start of Phase I implementation, the July 2026 suspension of Phase II and later implementation milestones, and current CMMC self-assessment requirements.

CMMC requirements continue to evolve. Organizations should verify the current requirements applicable to their specific solicitations, contracts, information systems, and federal information before making compliance decisions.

When to Bring in Hotman Group

Organizations often bring in Hotman Group when defense cybersecurity requirements are becoming real but the path from the current environment to a sustainable CMMC-ready program is unclear. HG can help when:

• You need to understand what your current CMMC or NIST SP 800-171 obligations require.
• FCI or CUI scope has not been clearly defined.
• You need an evidence-based assessment of how the current environment compares with applicable requirements.
• Policies and documentation exist but may not match how controls actually operate.
• The organization needs help prioritizing technical and process remediation.
• The team needs to organize evidence and clarify control ownership.
• CMMC is being managed separately from other cybersecurity frameworks and the organization wants a more efficient operating model.
• A managed service provider, cloud provider, or other third party is creating uncertainty around scope and shared responsibility.
• Leadership needs a practical understanding of the cost, staffing, risk, and business implications of defense cybersecurity requirements.
• The organization wants experienced Cyber GRC support without building a large specialized internal team.

Hotman Group helps organizations scope, assess, design, remediate, document, implement, operate and mature cybersecurity and Cyber GRC programs while connecting compliance requirements to actual security practices and business objectives.

Talk With Hotman Group About CMMC

About Hotman Group

Hotman Group is a cybersecurity and Cyber GRC professional-services firm that helps organizations diagnose, design, build, remediate, implement, operate and mature cybersecurity programs. HG provides hands-on vCISO and vGRC leadership, supports multi-framework environments, and helps organizations select and implement GRC technology while connecting cybersecurity decisions to business risk and strategy.

Hotman Group helps defense contractors connect CMMC and NIST SP 800-171 requirements to scope, controls, evidence, documentation, ownership, risk management, monitoring, remediation, and the broader cybersecurity operating model.

The goal is not simply to complete an assessment. It is to build security practices capable of demonstrating compliance because those practices are already part of how the organization operates.

Talk With Hotman Group