CMMC Compliance in 2026: What Level 2 Requires While Phase 2 Is Paused
CMMC compliance at Level 2 still means all 110 NIST SP 800-171 requirements. What the Phase 2 pause actually changed, what it did not, and how to scope and budget the work.
By Trustalis Published Last updated
The short answer
CMMC compliance at Level 2 means implementing, and being able to demonstrate, all 110 security requirements in NIST SP 800-171 Revision 2 for the systems that handle Controlled Unclassified Information (CUI). That obligation has not changed. What changed is who checks it. On 13 July 2026 the Department of Defense, now styled the Department of War, suspended Phase 2 of the CMMC program, the phase that would have introduced third-party C3PAO assessments on 10 November 2026. Self-assessment is once again the mechanism most contractors are measured against, while the security controls themselves are enforced exactly as they were before.
For a small or midsize defense contractor, the work is unchanged: define the CUI boundary, assess the controls inside it, close the gaps, and document how each safeguard actually operates. A tool purchase or a high SPRS score is not a substitute for that.
Compliance, certification, and the pause
Three things get used interchangeably in this market, and they are not the same.
CMMC compliance is operational: you implement the required controls, maintain evidence, and keep your documentation accurate.
CMMC certification is a third-party assessment outcome, performed by a CMMC Third-Party Assessment Organization (C3PAO) and recorded as a CMMC status.
The CMMC program is the rule that decides which assessment applies to which contract. That is the part currently in motion.
Phase 1 has been in force since 10 November 2025 and requires Level 1 and Level 2 self-assessments, along with affirmations tied to FAR 52.204-21 and NIST SP 800-171. Phase 2 was the third-party assessment phase. It was suspended before taking effect, with subsequent milestones held in abeyance pending a reform review at the DoD CIO. The 60-day review window lapsed in mid-September 2026 without published replacement guidance. DoD directed contracting officers to remove Level 2 C3PAO and Level 3 DIBCAC requirements from active solicitations as soon as practicable, and to modify existing contracts containing them no later than the next option exercise or administrative modification.
The practical read: nobody can tell you today when third-party assessments return, and nobody credible should try.
| Program milestone | Current status |
|---|---|
| Phase 1: Level 1 and Level 2 self-assessments, SPRS reporting, annual affirmations | In effect since 10 November 2025 |
| Phase 2: Level 2 third-party C3PAO assessments | Suspended 13 July 2026, no reinstatement date |
| Phase 3: Level 3 DIBCAC certification | Held in abeyance |
The levels themselves are unchanged. Level 1 protects Federal Contract Information, described as 17 practices, with an annual self-assessment. Level 2 protects CUI, with 110 NIST SP 800-171 requirements and an annual self-assessment or, when a contract specifies it, a C3PAO assessment. Level 3 applies to select programs, adds a subset of NIST SP 800-172 requirements, and is assessed by the government.
What the pause does and does not change
It does not change your controls. NIST SP 800-171 Revision 2 remains the incorporated baseline for Level 2, even though NIST has published Revision 3. Do not assume the newer publication replaces the version written into the CMMC rule.
It does not change DFARS 252.204-7012. Safeguarding requirements and the 72-hour incident reporting obligation are untouched.
It does not change SPRS. Scores still get entered, and annual affirmations still get signed.
It does not remove False Claims Act exposure. If anything, self-assessment as the primary enforcement mechanism makes the accuracy of your score and your affirmations more consequential, not less. The Department of Justice has pursued cyber-fraud cases on the strength of inaccurate self-attestations.
It does not bind your primes. A large prime contractor can still require a third-party assessment as a condition of subcontracting, with or without a Pentagon requirement. Read your flow-down clauses.
What Level 2 actually requires: the 14 control families
The 110 requirements group into 14 families. At a practical level they ask whether you can control access, see what happened, protect the information, and prove the safeguards are working.
| Control family | The practical question |
|---|---|
| Access Control | Can only approved people and devices reach systems and CUI? |
| Awareness and Training | Do staff understand their responsibilities and recognize risk? |
| Audit and Accountability | Is system activity recorded, reviewed, and traceable to a person? |
| Configuration Management | Are configurations approved, documented, and controlled? |
| Identification and Authentication | Are users and devices authenticated, with MFA where required? |
| Incident Response | Can you detect, report, and respond, including under your contract? |
| Maintenance | Is maintenance authorized, controlled, and logged? |
| Media Protection | Is CUI on removable media handled, stored, transported, and sanitized? |
| Personnel Security | Is access addressed at hire, on role change, and at termination? |
| Physical Protection | Are facilities and physical access controlled? |
| Risk Assessment | Do you identify and act on threats and vulnerabilities? |
| Security Assessment | Do you assess controls, track weaknesses, and keep the SSP current? |
| System and Communications Protection | Are CUI communications protected, including encryption? |
| System and Information Integrity | Are systems monitored, patched, and protected from malicious code? |
You can read the requirement text in NIST SP 800-171 Rev. 2 and the assessment procedures in NIST SP 800-171A. The requirement is not owning security products. It is being able to show that each applicable requirement is met inside a defined scope.
Compliance starts with the CUI boundary
Scoping is where contractors discover their real problem. CUI turns up in email, in SharePoint, on shared drives, on an engineering workstation, in backups, and in systems run by an outside IT provider. Any asset that processes, stores, or transmits CUI, or that protects systems that do, is likely to be in scope.
Build an accurate inventory, a network diagram, and a data-flow view. Then decide, deliberately, which assets are in scope, which provide security protection to in-scope systems, and which can be excluded through genuine separation with documented controls. A policy that says "no CUI here" is not separation if a user can still download a customer drawing to that laptop.
Cloud providers count too. Under DFARS 252.204-7012, a cloud service handling covered defense information must meet FedRAMP Moderate-equivalent requirements, and the provider's responsibilities and connections belong in your documentation.
What an assessment looks like now
For a self-assessment, you are the assessor. The honest version of that job looks like an external audit: pick evidence, test it, and write down what you found rather than what you hoped. The structure in NIST SP 800-171A is what a C3PAO would use, so using it now means your evidence set and your SSP are already shaped the way a third-party assessor will want them if Phase 2 returns.
Expect to produce approved policies, access reviews, training records, configuration baselines, vulnerability and patch records, sample logs, incident response material, and the System Security Plan. Expect staff to be asked how a control works in practice, and expect the answer to be checked against the environment rather than accepted at face value.
The System Security Plan describes the system, its boundary, its connections, and how each control is implemented. A Plan of Action and Milestones records eligible gaps and the corrective work planned. A POA&M does not convert an unimplemented requirement into a met one, and at Level 2 only a limited set of requirements can be carried this way, with specific closeout conditions. Read 32 CFR 170.21 before you rely on one.
A realistic timeline: six to twelve months
Schedule depends on your starting point, scope, and staffing. For planning purposes, most small and midsize contractors should budget six to twelve months. Treat that as a planning range, not a promise.
| Phase | Typical range | The work |
|---|---|---|
| Scope and gap assessment | 1–2 months | Confirm the CUI boundary, inventory assets, test all 110 requirements, rank the gaps |
| Remediation | 3–6 months | Implement technical and operational controls, close the high-impact deficiencies first |
| Evidence and documentation | 1–2 months, usually overlapping | Finish the SSP and policies, assemble the evidence set, write the POA&M |
| Assessment | 1–3 months | Self-assessment now; a C3PAO engagement only if a contract requires one |
The schedule rarely slips because of interviews. It slips because a contractor learns in month four that CUI spread across the whole business, or that a control everybody assumed was running has never been configured.
What drives the budget
There is no standard price. The ranges below are typical market planning figures, not quotes, and they move with scope, site count, system complexity, and how much is already in place.
- Remediation, often $25,000 to $150,000 or more, and usually the largest and least predictable line. Multi-factor authentication, centralized logging, FIPS-validated encryption, and network segmentation or an isolated CUI enclave all live here.
- Advisory and readiness support, often $10,000 to $40,000, depending on how much of the gap assessment, SSP, POA&M, and evidence work you want help with.
- Third-party assessment, often $30,000 to $80,000 for small and midsize organizations, with multi-site or complex environments costing more. This line is currently on hold for most contractors but worth keeping in the plan, because a backlog of assessment demand is the predictable outcome when requirements resume.
Before comparing quotes, confirm every provider is pricing the same scope and the same deliverables. A tightly scoped enclave can shrink what sits in the assessment boundary, but only if the separation is real and durable.
SPRS score: a claim you have to defend
Your SPRS score is a self-reported assessment entered in the Supplier Performance Risk System. It reflects implementation of the applicable NIST SP 800-171 controls for a defined scope. It is not a certification, and with third-party validation paused, it is very often the only compliance signal the government has about your company.
Treat it as a formal claim. Keep the assessment record, the scope statement, the SSP, and the evidence behind it. Inflating a score to look contract-ready is a bad risk decision now that self-attestation is the primary mechanism: it can cost you an award, trigger a false claims problem, and follow the company for years. The score should describe your current state, not your target state.
Five first moves you can make without hiring anyone
- Define the CUI boundary. Ask contracts and program staff what CUI you receive or create, and trace where it goes.
- Build an asset inventory. Endpoints, servers, network gear, cloud services, users, and the security tools that protect the boundary.
- Enforce MFA everywhere. All users, all administrators, all remote access. Document coverage and every exception.
- Turn on logging and keep it. Confirm the important systems produce usable logs and that someone reviews them on a defined schedule.
- Write the SSP before buying tools. Describe the boundary you actually have and how each control is implemented, then buy only what the identified gaps require.
Mistakes that blow up timelines
Buying a tool before scoping. Treating the SSP as paperwork to be finished later. Having no single accountable owner. Letting CUI sprawl through Microsoft 365 and SharePoint because nobody checked the sharing settings. Waiting until a contract is awarded to start. And in the current environment, the newest one: assuming the pause means the controls are paused too.
Who owns CMMC inside the business
CMMC is an operating discipline, not an IT project. Name the roles.
- Executive sponsor. Approves budget, settles priorities, signs the affirmation.
- CUI owner or security lead. Owns scope, requirements, risk, and the evidence set.
- IT. Implements and maintains the technical safeguards and the system records.
- HR. Onboarding, training, role changes, and access removal.
- Contracts. Confirms contract requirements, CUI handling, and subcontractor flow-down.
The requirements that apply to you depend on your systems and your contracts. Read the clause, ask your contracting officer which status and assessment type the contract now requires, and verify against current program guidance before you commit to a date or a budget.
Trustalis supports CMMC readiness, gap assessments, SSP and POA&M development, and audit preparation. Formal CMMC certification assessments are performed by authorized C3PAOs; Trustalis is not a C3PAO.