This is educational content, not compliance or legal advice. Confirm your required CMMC level and obligations against your specific contract and with qualified assessors or counsel.
Key takeaways
- CMMC is the DoD's framework for assessing a contractor's compliance with the security requirements that protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Where a contract includes a CMMC requirement, award eligibility can depend on your CMMC status.
- As of October 2026, Phase 2 is suspended: only Level 1 (Self) and Level 2 (Self) may be designated, while Level 2 (C3PAO) and Level 3 (DIBCAC) are on hold. Confirm the operative requirement in your own contract.
- CMMC, NIST SP 800-171, and DFARS 252.204-7012 are related but distinct: NIST is the control set, DFARS is a separate contract clause with its own reporting duty, and CMMC is the assessment-and-affirmation framework.
- Insurance is separate. CMMC does not mandate cyber insurance, and cyber insurance does not make you compliant. Depending on the policy, cyber and management-liability coverage may address some of the resulting costs.
CMMC status as of October 2026: Phase 2 is suspended
What happened. CMMC Phase 1 began on November 10, 2025, the effective date of the CMMC acquisition rule. Phase 2 was scheduled to begin one year later, on November 10, 2026. On July 13, 2026, the Department suspended that transition before it took effect and held pending CMMC implementation milestones in abeyance pending a program review. On September 3, 2026, a DFARS class deviation (2026-O0025, Revision 3) directed contracting officers to remove or revise the suspended CMMC requirements in affected solicitations and contracts.
What it means in practice. Under the suspension, requiring activities may designate only CMMC Level 1 (Self) or Level 2 (Self). The planned expansion to CMMC Level 2 (C3PAO) certification and CMMC Level 3 (DIBCAC) designations is suspended. This does not suspend everything: separate government-led assessments under the DFARS NIST SP 800-171 DoD Assessment Methodology (DFARS 252.204-7019 and 7020) continue independently of CMMC. Phase 1 self-assessment requirements also remain in force, as does compliance with NIST SP 800-171 Revision 2 and annual affirmation in SPRS.
What did not change. DFARS 252.204-7012 and its incident-reporting duty are unaffected. Nothing was rolled back, because Phase 2 had not started when it was suspended, and the codified three-level framework in 32 CFR Part 170 remains on the books unchanged. The framework described below is still accurate; its enforcement timetable is not.
Check your own contract. As of October 2026, Phase II remains suspended and no replacement implementation schedule has been published. Requirements may change again, and the implementation policy can move independently of the codified framework, so confirm the CMMC terms in each solicitation or contract rather than relying on any general statement of status, including this one.
1. What Is CMMC?
Per DFARS 252.204-7021, the Cybersecurity Maturity Model Certification (CMMC) is the DoD's framework for assessing a contractor's compliance with the applicable information-security requirements for the systems that process, store, or transmit sensitive government data. Where a solicitation or contract includes a CMMC requirement, eligibility for award can depend on having the required CMMC status.
Whether CMMC applies to you, and at what level, is set by the applicable solicitation or contract rather than by the data alone. Where it does apply, it reaches the contractor information systems used in performance that process, store, or transmit either of two kinds of information:
- Federal Contract Information (FCI): information provided by or generated for the government under a contract, not intended for public release.
- Controlled Unclassified Information (CUI): information that requires safeguarding under law, regulation, or government-wide policy.
2. CMMC 2.0 and the Three Levels
The current program, commonly called CMMC 2.0 and codified in 32 CFR Part 170 (effective December 16, 2024), streamlined the original five-tier model into three levels:
| Level | What it requires | How it is assessed |
|---|---|---|
| Level 1 | The 15 basic safeguarding requirements of FAR 52.204-21 (for FCI). | Annual self-assessment. |
| Level 2 | The 110 security requirements of NIST SP 800-171 Revision 2 (for CUI). | Under the codified rule, self-assessment for some programs and third-party (C3PAO) certification for others. During the current suspension, only Level 2 (Self) may be designated. |
| Level 3 | Level 2 plus a subset of NIST SP 800-172 controls. | Under the codified rule, government assessment by DCMA DIBCAC. Not available for designation during the current suspension. |
The table describes the framework as codified in 32 CFR Part 170, which is unchanged. How much of it is currently being enforced is a separate question, answered in the status box above: as of October 2026 only the self-assessment paths are in play.
The level you need is specified in your contract and depends on whether you touch FCI (Level 1) or CUI (Level 2, and sometimes Level 3). The CMMC rule pins Level 2 to Revision 2 of NIST SP 800-171; NIST has since published Revision 3 (reorganized into 17 families), but the CMMC program still references Revision 2's 110 requirements, and the Department confirmed Revision 2 as the standard it is enforcing during the suspension.
3. How CMMC Relates to NIST 800-171 and DFARS 7012
These three are easy to confuse. The clean way to hold them:
NIST SP 800-171 Revision 2 is the control set: the 110 requirements across 14 families that define how to protect CUI.
DFARS 252.204-7012 is a separate contract clause: for covered contractor information systems it requires the applicable NIST SP 800-171 requirements under the clause and separately establishes cyber-incident reporting obligations, including, where the clause applies, rapid reporting within 72 hours of discovering a cyber incident that affects covered defense information or operationally critical support. The 72-hour duty is scoped by the clause, so it is not a blanket obligation to report every security event.
CMMC is the assessment-and-affirmation framework: it establishes the CMMC status a solicitation or contract requires, at the level that contract sets. CMMC Level 2 currently assesses against Revision 2.
Two points worth keeping straight. First, DFARS 252.204-7012 is a separate contractual requirement from CMMC, with its own reporting obligations that stand whatever happens to the CMMC rollout. Second, a self-assessment establishes your CMMC status through assessment and affirmation, so it is a representation to the government rather than conclusive proof of implementation.
4. Why Accurate CMMC Self-Assessments and Affirmations Matter
For Level 1, and for Level 2 where a self-assessment is designated, compliance rests on two distinct steps. First, the self-assessment: you assess your status against the required controls and record the result in the DoD's Supplier Performance Risk System (SPRS). Second, the annual affirmation: a senior official affirms your continuing compliance each year. The suspension makes this more important, not less, because self-assessment is currently the only designation path being used.
Here is the risk founders underestimate: the self-assessment result and annual affirmation are representations to the government, not conclusive proof that every control is implemented exactly as represented. A breach on its own does not create False Claims Act liability. What creates that exposure is a cybersecurity representation that was knowingly false or materially misleading, where the statutory elements of the False Claims Act are otherwise met. Under the False Claims Act, knowingly includes actual knowledge, deliberate ignorance, and reckless disregard. So the danger is not the incident itself but the gap between what you affirmed and what you had actually implemented, which an incident can expose. The U.S. Department of Justice's Civil Cyber-Fraud Initiative uses the False Claims Act against contractors that knowingly misrepresent their cybersecurity compliance.
The requirement can also flow down: where the applicable clause requires flowdown, the prime contractor identifies the correct CMMC level for each subcontractor based on the subcontract, the systems used in performance, and the FCI or CUI involved, rather than passing an identical requirement to everyone. You also maintain your own status for the life of the contract.
5. Certification: C3PAO vs DIBCAC, and SPRS
These are the assessment paths the codified rule provides. During the current suspension, CMMC Level 2 (C3PAO) and Level 3 (DIBCAC) designations are on hold, so treat this section as what to expect if and when the program resumes. Separate government-led assessments under the DFARS NIST SP 800-171 DoD Assessment Methodology continue independently of CMMC.
C3PAO. A Certified Third-Party Assessment Organization performs the CMMC Level 2 certification assessment where one is designated. No new CMMC Level 2 (C3PAO) designations may be made during the suspension.
DIBCAC. The Defense Industrial Base Cybersecurity Assessment Center (part of the Defense Contract Management Agency, a government body) performs CMMC Level 3 assessments. New CMMC Level 3 designations are unavailable during the suspension, though DIBCAC continues to conduct its separate assessments under the DFARS NIST SP 800-171 DoD Assessment Methodology (DFARS 252.204-7019 and 7020).
SPRS. The DoD system where your assessment score and annual affirmation are recorded. Contracting officers check SPRS to confirm the required CMMC status where a solicitation or contract calls for it, and it remains fully operative, since annual affirmation of the self-assessment continues.
6. Where Cyber Insurance Fits
Start with the distinction, because conflating these two is the most common mistake founders make here. CMMC is a cybersecurity and contracting requirement. Insurance is separate. Meeting CMMC does not eliminate cyber risk, and buying cyber insurance does not make a company CMMC compliant. With that clear, there are three points where the two subjects touch:
Incident response.
Depending on the policy, cyber insurance may cover costs such as breach counsel, forensic investigation, notification, data restoration, business interruption, and other covered incident-response expenses. Insurance does not replace your DFARS reporting obligations, which exist independently of whether any policy responds.
Investigations and regulatory matters.
Some cyber and management-liability policies may cover certain investigations or proceedings. Whether a CMMC- or DFARS-related matter qualifies depends on the policy's definitions, its exclusions, and the facts. A contract-compliance review is not automatically a covered regulatory proceeding, so settle this against the actual wording rather than assume.
False Claims Act allegations.
Cybersecurity representations to the government can create FCA exposure where they are knowingly false or materially misleading and the statutory requirements are otherwise met. D&O or management-liability insurance may respond to certain defense costs or claims, but coverage is policy-specific, and conduct exclusions and insurability rules matter. Reviewing cyber and D&O together can help identify exclusions, overlaps, or gaps between the policies.
A practical sequencing note many founders miss: some contracts effectively require cyber controls, and evidence of them, before a Level 2 self-assessment is credible, so getting the controls in place early is part of being contract-ready, not an afterthought. Insurance is a parallel workstream, not a substitute for the controls.
Frequently Asked Questions
What is CMMC 2.0?
CMMC 2.0 is the current version of the program, codified in 32 CFR Part 170 (effective December 16, 2024). It streamlined the original five maturity levels into three: Level 1 self-assessment, Level 2 aligned to NIST SP 800-171 Revision 2, and Level 3 aligned to NIST SP 800-172. That codified framework is unchanged, but its rollout is not proceeding on the original schedule: the Phase 2 transition due on November 10, 2026 was suspended in July 2026, so only self-assessments are being designated as of October 2026.
What CMMC level does my startup need?
It depends on the data your contract involves: Level 1 (annual self-assessment) for Federal Contract Information, and Level 2 or 3 for Controlled Unclassified Information. The required level is specified in the contract, which is the only place to confirm it. While the codified framework attaches third-party or government assessment to the higher levels, only self-assessments may be designated during the current suspension.
What is the difference between CMMC compliance and CMMC certification?
Compliance means actually meeting the required controls, such as the 110 requirements of NIST SP 800-171 Revision 2 for Level 2. Certification is the assessment-and-affirmation step that establishes your CMMC status, rather than conclusive proof of implementation. Under the codified rule a third-party assessor (C3PAO) performs the Level 2 certification assessment where one is designated, Level 1 is self-assessed, and Level 3 is assessed by the government (DIBCAC). As of October 2026, new Level 2 (C3PAO) and Level 3 (DIBCAC) designations are suspended, so status is being established through self-assessment and annual affirmation in SPRS.
Does CMMC require cyber insurance?
No. CMMC is a cybersecurity and contracting requirement and does not mandate an insurance policy. Insurance is a separate risk-transfer tool: buying cyber coverage does not make you CMMC compliant, and being CMMC compliant does not eliminate cyber risk. That said, the exposures CMMC is concerned with, such as a breach, a regulatory inquiry, or an allegation that an affirmation was knowingly false, are exposures that cyber and management-liability policies may address, depending on the policy's definitions, exclusions, and the facts.
How does CMMC relate to NIST SP 800-171?
NIST SP 800-171 Revision 2 is the underlying set of 110 security requirements. CMMC Level 2 assesses your implementation of them. DFARS 252.204-7012 is a separate contract clause that requires the applicable NIST SP 800-171 requirements under the clause and separately establishes cyber-incident reporting obligations, including, where the clause applies, reporting within 72 hours of discovering a covered cyber incident.
Building Defense Tech? Pair CMMC With the Right Cyber Coverage
Meeting CMMC is a security-and-compliance project. The residual risk that remains after the controls are in place, a breach, a regulatory inquiry, an affirmation dispute, is a separate insurance question. RiskCube helps defense contractors compare cyber and D&O policies and understand how policy terms may respond. Coverage varies by carrier, form, exclusions, endorsements, and underwriting.
Apply for a quoteSources and Further Reading
This guide draws on primary U.S. government sources. Regulations and program requirements change, and the rollout status above is the most volatile fact on this page, so confirm the current text and your required CMMC level against your contract and with qualified assessors or counsel.
- 32 CFR Part 170, the CMMC Program rule (effective December 16, 2024). ecfr.gov
- DFARS 252.204-7021, Contractor Compliance with the CMMC Level Requirements. acquisition.gov
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. acquisition.gov
- NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems (the 110 requirements CMMC Level 2 references). csrc.nist.gov
- DoD CIO CMMC program site (program status and resources). dodcio.defense.gov
- Supplier Performance Risk System (SPRS), the DoD system of record for assessment scores and affirmations. sprs.csd.disa.mil
- U.S. Department of Justice, Civil Cyber-Fraud Initiative. justice.gov
- False Claims Act, 31 U.S.C. 3729. govinfo.gov
- DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026), the Part 240 deviation whose paragraph (b) implements the July 2026 CMMC suspension; listed on the DPCAP class-deviations page at acq.osd.mil.
Keep reading
Subcontractor Insurance Requirements: The Complete Guide
Subcontractor insurance requirements explained: the core coverages, endorsements, and AM Best carrier rating you need to sell to a large contractor.
Federal Contract Insurance Checklist (2026)
Government contractor insurance: required coverages, FAR limits, endorsements, Defense Base Act, AM Best ratings, and mistakes that delay starts.
About the author
Andrei Craciunescu
Founder & CEO, RiskCube · CA License #4467994
LinkedIn ProfileAndrei previously worked in the Risk & Analytics division of WTW (Willis Towers Watson), one of the world's largest insurance brokers and a recognized leader in AI, space, and defense risk. He holds an M.Sc. in Mathematics from LMU Munich and conducted PhD-level research in financial mathematics, including directors and officers (D&O) insurance, at the Technical University of Munich (TUM). His work applies AI and risk analytics to translate complex exposures into actionable insurance coverage decisions for VC-backed startups and small-to-medium businesses across the U.S.