CMMC Level 2 for small defense contractors.

Estimate your SPRS score

Print the 110-requirement CMMC Level 2 checklist

See CMMC assessors and consultants

Phase 2 is suspended

• On July 13, 2026 the Department of War Chief Information Officer suspended CMMC Phase 2 in the memo "Removing Barriers to Defense Industrial Base Expansion" and created a CMMC Reform Task Force. CIO memo. Department of War release.
• A same-day memo from the Under Secretary for Acquisition and Sustainment tells contracting officers to amend solicitations that require Level 2 (C3PAO) or Level 3 and to modify existing contracts. Implementation memo.
• The suspension did not repeal the CMMC rule. No replacement date for Phase 2 had been published when we checked on October 23, 2026.
• Still required: Phase 1 self-assessments, SPRS score submissions, annual affirmations, DFARS 252.204-7012 (including 72-hour incident reporting), FAR 52.204-21, and the 110 requirements of NIST SP 800-171 Rev 2. While the suspension stands, the implementation memo says program managers and requiring activities may not designate Level 2 (C3PAO) or Level 3. Some law-firm summaries read the Department's discretion more broadly; the memo text is what we follow here.

How the phases were written in the rule

• The DFARS rule took effect on November 10, 2025. That date is the start of phase 1. DFARS case 2019-D041. Phase timing is in 32 CFR 170.3.
• In phase 1, DoD intends to use Level 1 (Self) or Level 2 (Self) as a condition of award. It may, at its discretion, require Level 2 (C3PAO) instead of Level 2 (Self).
• Phase 2 starts one calendar year after phase 1. Counting from November 10, 2025, that date is November 10, 2026.
• In phase 2, the rule says DoD intends to require Level 2 (C3PAO) as a condition of award on applicable contracts. This phase is suspended.
• DoD may delay the Level 2 (C3PAO) requirement to an option period.
• DoD may also include Level 3 (DIBCAC) at its discretion in phase 2.

Level 2 Self vs Level 2 C3PAO

Steps to get ready

1. Scope the systems that handle CUI. 32 CFR 170.19 covers CMMC scoping.
2. Check the 110 security requirements in NIST SP 800-171 Revision 2. 32 CFR 170.14 says the CMMC Level 2 requirements are identical to that publication. NIST has since published Revision 3. The rule still names Revision 2.
3. Write a system security plan that describes how those requirements are met.
4. Close the gaps you can close now. Where the rule allows a gap to stay open for a limited time, put it on a plan of action and milestones (POA&M). Not every requirement can sit on that plan. 32 CFR 170.21.
5. Post your NIST SP 800-171 score in the Supplier Performance Risk System (SPRS).
6. A C3PAO assessment is voluntary while Phase 2 is suspended. Some contractors still book one so they are ready when the Reform Task Force sets a new schedule; the self-assessment and SPRS score are what contracts require now.

What is free vs what costs money

• The rule text on the eCFR and the Federal Register is free to read.
• The NIST SP 800-171 Revision 2 text is free to read. NIST SP 800-171 Rev. 2.
• DoD program guidance published on defense.gov and the eCFR is free to read.
• A C3PAO assessment costs money. This directory does not estimate assessment prices.
• Most of the tools below cost money. A dollar price is shown only when the vendor publishes one.

Guides

• Where Phase 2 stands
• When a plan of action and milestones is allowed
• How to scope CUI
• Two scores that land in SPRS
• What a system security plan has to do
• What to check before you hire a C3PAO
• Glossary

Tools in this directory

CMMC tools category

Sources

• CIO memo
• Implementation memo
• Department of War release
• 32 CFR 170.3, Applicability, including the phase dates.
• 32 CFR 170.14, CMMC model. Level 2 requirements are identical to NIST SP 800-171 Revision 2.
• 32 CFR 170.16, Level 2 self-assessment.
• 32 CFR 170.17, Level 2 certification assessment by a C3PAO.
• 32 CFR 170.19, scoping.
• 32 CFR 170.21, plans of action and milestones.
• DFARS final rule, effective November 10, 2025 (90 FR 43560, published September 10, 2025).
• NIST SP 800-171 Revision 2.

Not legal advice.