CMMC compliance means meeting the Cybersecurity Maturity Model Certification requirements that the Department of Defense (which now also uses “Department of War” as a secondary, non-statutory name) has written into its contracts. If your company handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as a prime or subcontractor, you need to reach the CMMC level named in your contract, either by self-assessment or by a certified third-party assessment, or you’ll be ineligible for the award. The phased rollout began in November 2025 with self-assessments. In July 2026, the DoD suspended the move to Phase 2 — the stage that would have made certified third-party assessments a condition of many awards — while it reviews the program, so self-assessment requirements still apply today and certified assessments are expected to return.
In this guide
- What CMMC is
- The three CMMC levels
- Who needs CMMC compliance
- The rollout timeline
- What NIST 800-171 actually requires
- How the assessment works
- What CMMC compliance costs
- Common reasons contractors fail
- How Sixwatch helps with CMMC
- FAQ
What CMMC is
The Cybersecurity Maturity Model Certification is the DoD’s way of verifying that the roughly 200,000+ companies in the Defense Industrial Base (DIB) actually implement the security controls they’ve been contractually required to have since 2017.
Under DFARS clause 252.204-7012, contractors handling CUI have been required to implement NIST SP 800-171 for years, on an honor system. CMMC ends the honor system. It adds assessment and certification, so a contractor’s claimed security posture is checked before an award, not after a breach.
The current program (CMMC 2.0) took effect through a final rule in 32 CFR Part 170, which took effect December 16, 2024, with the 48 CFR contracting rule (the DFARS clause 252.204-7021) effective November 10, 2025.
The three CMMC levels
| Level | Who it applies to | Requirements | Assessment |
|---|---|---|---|
| Level 1 (Foundational) | Contractors handling FCI only | 15 basic safeguarding practices from FAR 52.204-21 (things like access control, MFA on remote access, antivirus, patching) | Annual self-assessment, affirmed in SPRS by a senior official |
| Level 2 (Advanced) | Contractors handling CUI | All 110 controls in NIST SP 800-171 Rev 2 | Triennial assessment by a CMMC Third-Party Assessment Organization (C3PAO) for most contracts; a small subset allows self-assessment |
| Level 3 (Expert) | Contractors on the most sensitive programs | Level 2 plus 24 additional controls from NIST SP 800-172 | Government-led assessment by the Defense Contract Management Agency’s DIBCAC |
Most defense contractors and subcontractors need Level 2. If a contract involves CUI (technical drawings, specifications, export-controlled data), assume Level 2 with a C3PAO assessment.
Who needs CMMC compliance
- Prime contractors with DoD contracts that include the CMMC clause
- Subcontractors at any tier that receive FCI or CUI from a prime, including machine shops, engineering firms, software developers, logistics providers, and staffing firms
- Managed service providers and cloud providers that handle CUI on behalf of a contractor (they must meet the same level or be FedRAMP Moderate equivalent)
You need CMMC even if DoD work is 5% of your revenue. Primes are now asking subcontractors for their CMMC status before issuing purchase orders, because the prime’s own certification depends on its supply chain.
Commercial off-the-shelf (COTS) suppliers are the main exemption. If you only sell unmodified commercial products with no FCI or CUI involved, CMMC doesn’t apply.
The CMMC rollout timeline
The DoD originally planned to phase CMMC into contracts over three years, but suspended that schedule mid-rollout in July 2026; here is where it stands as of September 2026.
| Phase | Start | What’s required |
|---|---|---|
| Phase 1 | November 2025 | Level 1 and Level 2 self-assessments as a condition of award |
| Phase 2 | November 2026 | Level 2 C3PAO certification required for applicable contracts |
| Phase 3 | November 2027 | Level 3 requirements begin; Level 2 certification required at option periods on existing contracts |
| Phase 4 | November 2028 | Full implementation across all applicable solicitations |
The practical deadline for most contractors is Phase 2. C3PAO capacity is limited and assessments are booking months out. A contractor starting from scratch typically needs 9 to 18 months to reach Level 2 readiness, so anyone who hasn’t started is already behind.
What NIST SP 800-171 actually requires
Level 2 is NIST SP 800-171, which contains 110 controls across 14 families:
- Access Control (22 controls): who can access what, least privilege, session controls
- Awareness and Training (3): security training for all users
- Audit and Accountability (9): logging, log review, log protection
- Configuration Management (9): baselines, change control, restricting software
- Identification and Authentication (11): MFA, password rules, device identification
- Incident Response (3): a tested plan and a reporting process
- Maintenance (6): controlled maintenance, sanitizing equipment
- Media Protection (9): protecting, marking, and destroying CUI on media
- Personnel Security (2): screening and offboarding
- Physical Protection (6): facility access, visitor control
- Risk Assessment (3): periodic risk assessments and vulnerability scanning
- Security Assessment (4): assessing controls, plans of action, system security plan
- System and Communications Protection (16): encryption, network segmentation, boundary protection
- System and Information Integrity (7): patching, malware protection, monitoring
Two documents matter as much as the controls: the System Security Plan (SSP), which describes how each control is implemented, and the Plan of Action and Milestones (POA&M) for any control not yet met. Under CMMC, a conditional certification is possible with a limited POA&M, but the highest-weighted controls (MFA, encryption, incident response, and others) cannot be on the POA&M at all.
Your SPRS score (from -203 to 110) reflects your self-assessment against these controls. Primes can see it. A negative score tells them you haven’t started.
How the CMMC assessment works
Level 1: Complete the self-assessment annually, have a senior company official affirm it, and submit to the Supplier Performance Risk System (SPRS).
Level 2 (certification):
- Scope. Define exactly which systems, people, and locations touch CUI. Many contractors build a separate “CUI enclave” so only a small part of the company falls in scope.
- Gap assessment. Compare current controls to all 110 requirements.
- Remediate. Implement missing controls, write policies, collect evidence.
- Write the SSP and any POA&M.
- Select a C3PAO from the Cyber AB marketplace and schedule.
- Assessment. The C3PAO reviews evidence, interviews staff, and tests controls. Every control needs proof: screenshots, logs, policies, configurations.
- Certification is valid for three years, with an annual affirmation in between.
Contractors that use a managed service provider must show the MSP’s own compliance if it handles CUI or manages in-scope systems.
What CMMC compliance costs
| Item | Typical cost |
|---|---|
| Gap assessment | $5,000 – $20,000 |
| Remediation (tools, configuration, policies) | $20,000 – $150,000+, depending on starting point and scope |
| Ongoing managed compliance and security | $150 – $300 / user / month for in-scope users |
| C3PAO Level 2 assessment | $30,000 – $100,000+ |
| Enclave approach (Microsoft GCC High or similar) | $50 – $80 / user / month for licensing alone |
The DoD’s own estimate for a small business Level 2 certification was around $100,000 in the first year, per the DoD’s own rulemaking estimates. Reducing scope with an enclave is the most effective way to bring that down.
Common reasons contractors fail CMMC assessments
- Scope is too broad. CUI sits on every laptop, so every laptop is in scope.
- The SSP describes controls that aren’t actually implemented. Assessors test.
- MFA isn’t everywhere. One local admin account without it is a finding.
- No evidence. The control works, but nobody can produce the log or screenshot proving it.
- Cloud services aren’t FedRAMP Moderate (commercial Microsoft 365 rather than GCC or GCC High for CUI).
- The MSP isn’t compliant, so its access to your systems becomes your finding.
- Incident response was never tested. A plan on paper isn’t enough.
How Sixwatch helps with CMMC compliance
Sixwatch provides managed IT and managed cybersecurity to defense subcontractors in Tampa Bay and Cincinnati, both regions with significant defense and manufacturing bases. We handle CMMC readiness end to end: scoping, gap assessment against NIST 800-171, enclave design, control implementation, SSP and POA&M documentation, evidence collection, and C3PAO coordination.
Founder John Owens has 25+ years in IT and security, and our team implements the controls, then runs them, so your evidence is generated continuously rather than assembled in a panic before the assessor arrives. Every plan includes a 30-minute emergency remote response and same-day onsite support, with a 5.0 Google rating from clients who trust us with the systems their contracts depend on.
Great, fast, efficient support!
Martin
Book a 15-minute call to find out where you stand, or request a CMMC readiness proposal.
Frequently asked questions
What is CMMC compliance? Meeting the Cybersecurity Maturity Model Certification requirements written into Department of Defense contracts, proven by self-assessment (Level 1) or third-party certification (Level 2 and 3), before a contract is awarded.
Who needs to be CMMC compliant? Any contractor or subcontractor that handles Federal Contract Information or Controlled Unclassified Information for the DoD, plus service providers that manage their in-scope systems.
What is the difference between CMMC Level 1 and Level 2? Level 1 covers 15 basic practices for FCI and is self-assessed annually. Level 2 covers all 110 NIST SP 800-171 controls for CUI and generally requires a certified third-party assessment every three years.
How long does it take to get CMMC certified? Nine to 18 months for most small and mid-size contractors starting from a partial NIST 800-171 implementation, plus C3PAO scheduling lead time.
What is a C3PAO? A CMMC Third-Party Assessment Organization, accredited by the Cyber AB, that conducts Level 2 certification assessments.
Can I use a POA&M under CMMC? Yes, but only for a limited set of lower-weighted controls, and it must be closed within 180 days for a conditional certification to become final. Critical controls such as MFA and encryption cannot be deferred.
Do I need GCC High for CMMC? If you store or process CUI in Microsoft 365, you generally need a FedRAMP Moderate-equivalent environment such as GCC High. Commercial Microsoft 365 is not sufficient for CUI.
Need to know your CMMC gap before the next contract cycle? Book a 15-minute call · Request a proposal
