CMMC levels, scoping, and costs — and what the July 2026 Phase 2 suspension means for DoD contractors handling FCI and CUI.
Last reviewed on September 28, 2026.
The Cybersecurity Maturity Model Certification (CMMC) is a unified standard for implementing cybersecurity across the Defense Industrial Base (DIB). It's designed to protect sensitive unclassified information that resides on defense contractors' information systems from cyber threats.
17 Practices | Self-Assessment
110 Practices | Third-Party or Self-Assessment
110+ Practices | Government Assessment
| Phase | Timeline | Activities | Deliverables |
|---|---|---|---|
| Assessment | Weeks 1-4 | Gap analysis, current state assessment | Gap analysis report, remediation plan |
| Planning | Weeks 5-8 | Develop SSP, create implementation timeline | System Security Plan, POA&M |
| Implementation | Weeks 9-24 | Deploy controls, configure systems | Technical implementations, policies |
| Documentation | Weeks 25-28 | Create required documentation | Procedures, evidence artifacts |
| Assessment Prep | Weeks 29-32 | Internal audit, mock assessment | Assessment readiness report |
| Certification | Weeks 33-36 | C3PAO assessment (voluntary while Phase 2 is suspended) | CMMC certificate |
Yes. On July 13, 2026 the DoD suspended CMMC Phase 2, which was scheduled to begin November 10, 2026 and would have required C3PAO third-party Level 2 certification for applicable contracts involving CUI, and launched a 60-day CMMC Reform Task Force review. A September 3, 2026 class deviation made the suspension binding by directing contracting officers to remove Phase 2 third-party assessment requirements from active solicitations and existing contracts. As of late September 2026 the task force's recommendations had not been made public.
Phase 1 began November 10, 2025: CMMC Level 1 and Level 2 self-assessment requirements can appear in DoD solicitations now. Phase 2 (third-party Level 2 certification) was suspended in July 2026, and the timing of later phases depends on the outcome of the DoD's reform review. Check each solicitation for its requirements.
Yes, for now. With Phase 2 suspended, DoD is not requiring C3PAO certification as a condition of award, so Level 2 requirements are met by self-assessment, an SPRS score, and annual affirmation. A C3PAO assessment is voluntary, and some firms still pursue one for competitive positioning.
DFARS 252.204-7012 (safeguarding CUI and 72-hour incident reporting), implementation of NIST SP 800-171 Rev. 2, NIST SP 800-171 self-assessment scores in SPRS under DFARS 252.204-7019/7020, CMMC Level 1 and Level 2 self-assessments where a contract requires them, and annual affirmations of compliance. Inaccurate self-assessments still carry False Claims Act risk.
A Level 2 or Level 3 certification is valid for three years, with annual affirmations required to maintain status. Level 1 and Level 2 self-assessments are affirmed annually.
Yes, if subcontractors handle CUI or FCI, CMMC requirements flow down to them at the level appropriate to the information they handle.
CMMC 2.0 simplified the model from 5 levels to 3, removed unique practices, and aligned directly with NIST standards.