• • 2010: Executive Order 13556 established the CUI Program to standardize how sensitive government information is handled.
  • 2015–2016: The DoD implemented and revised DFARS clauses to require contractor compliance with NIST SP 800-171 by December 2017.
  • 2019: The DoD Inspector General reported widespread non-compliance within the Defense Industrial Base (DIB).
  • 2020: The National Defense Authorization Act (NDAA) directed the DoD to develop a formal cybersecurity assessment framework—laying the groundwork for CMMC.
  • 2025: The DoD will begin full implementation of CMMC requirements in contracts to ensure cybersecurity compliance is verified and enforced.

What level of CMMC is right for me and my business?

The CMMC will review and combine various cybersecurity standards and best practices and map these controls and processes across several maturity levels that range from basic cyber hygiene to advanced. Here’s what we know about the CMMC levels and their respective requirements:

What level of the CMMC will I need to get certified?

The level of CMMC certification your organization needs depends on the type of DoD information you handle — either Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) — and what your contract requires.

CMMC 2.0 is simplified into three levels, designed to protect sensitive information while reducing unnecessary burden on small and mid-sized defense contractors.

Level 1 — Basic Safeguarding of FCI

Designed for contractors who only handle FCI.

Requirements:

• 15 security requirements from FAR 52.204-21

• Annual self-assessment performed by the contractor

• Annual affirmation in SPRS

• Results must be entered in SPRS

• POA&Ms are not permitted

Validity: 1 year from assessment date

Level 2 — Protection of CUI

Designed for contractors handling CUI.

Requirements:

• 110 security requirements from NIST SP 800-171 Rev. 2

• Assessment is either:

  • Self-assessment every 3 years OR

  • C3PAO third-party assessment every 3 years
    → Determined by the type and sensitivity of CUI in the contract

• Annual affirmation in SPRS

• Results entered into SPRS or eMASS depending on assessment type

• POA&Ms permitted, must be closed within 180 days

• Conditional CMMC Status allowed while POA&Ms are open

Validity: 3 years from assessment date

Level 3 — Advanced Protection of CUI

Applies to the highest-risk DoD programs impacted by advanced cyber threats.

Requirements:

• All Level 2 requirements plus

• 24 additional security requirements from NIST SP 800-172

• Assessed by DIBCAC every 3 years

• Annual affirmation in SPRS

• POA&Ms permitted, must be closed within 180 days

• Requires Level 2 C3PAO Certification as a prerequisite

• Conditional CMMC Status allowed while POA&Ms are open

Validity: 3 years from assessment date

Most small and medium-sized contractors will only need Level 1 or Level 2, while Level 3 will be limited to large prime contractors working on the most sensitive DoD programs.

When will CMMC contract requirements begin?

The final program rule (32 CFR) for CMMC 2.0 became effective on December 16, 2024. However, the contractual requirement for new Department of Defense (DoD) solicitations and contracts begins November 10, 2025, when the 48 CFR/DFARS acquisition rule becomes enforceable.

How the rollout works
CMMC 2.0 will be implemented in a four-phase rollout for DoD contracts:

• Phase 1 (Nov 10 2025): New solicitations may require CMMC Level 1 (self-assessment) or Level 2 (self-assessment) — and in some cases Level 2 third-party assessment.

• Phase 2 (Nov 10 2026): Applicable solicitations/contracts begin requiring Level 2 third-party certification.

• Phase 3 (Nov 10 2027): Broader Level 3 requirements apply and option periods/renewals incorporate CMMC clauses.

• Phase 4 (Nov 10 2028): Full implementation — all applicable solicitations and contracts will include CMMC requirements as a condition of award.

What you should do now
If you handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), start your readiness now: conduct a gap-assessment, identify your appropriate CMMC level, document your controls and self-assessment (or prepare for third-party when required), and ensure your SPRS (Supplier Performance Risk System) status is current. Missing readiness may mean ineligibility for future DoD contract awards.

How do I achieve CMMC compliance?

Defense contractors are not compliant with CMMC until they coordinate with an accredited and independent third-party certification organization to perform a CMMC audit.  It is in contractors best interest to partner with an agency like Simpatico Systems to help them prepare for a CMMC audit.