If you machine parts, make components or provide services for a defense prime, you’ve probably seen CMMC in a purchase order, a supplier survey or a solicitation. The program has changed several times, most recently in July 2026. This guide explains where it stands as of October 13, 2026, and what a small manufacturer can do now.
This post is general education, not legal, customs, tax, financial or compliance advice. Confirm details with a licensed professional and the official sources linked below.
What CMMC is and who it affects
The Cybersecurity Maturity Model Certification (CMMC) program is set out in 32 CFR Part 170. It verifies that defense contractors and subcontractors protect two kinds of information on their systems:
- Federal Contract Information (FCI): information provided by or generated for the government under a contract that is not intended for public release.
- Controlled Unclassified Information (CUI): a narrower category that requires safeguarding, which can include controlled technical drawings and specifications.
The requirement flows down. If your customer’s contract includes CMMC, they may require it of you when you handle FCI or CUI for that work.
The three CMMC levels
| Level | Protects | Requirements | Assessment type |
|---|---|---|---|
| Level 1 | FCI | The 15 basic safeguarding requirements in FAR 52.204-21 | Annual self-assessment |
| Level 2 | CUI | The 110 requirements in NIST SP 800-171 Rev. 2 | Self-assessment or third-party (C3PAO) assessment, as the contract specifies |
| Level 3 | CUI in the highest-priority programs | Level 2 plus selected NIST SP 800-172 requirements | Government-led (DIBCAC) assessment |
Results and affirmations are posted in the Supplier Performance Risk System (SPRS). Under the DFARS rule, contracting officers check SPRS and won’t award a covered contract to an offeror without a current CMMC status at the required level.
The CMMC timeline: what has happened
- November 10, 2025: The DFARS acquisition rule took effect (Federal Register, September 10, 2025), starting Phase 1. Applicable solicitations could require Level 1 or Level 2 self-assessments.
- July 13, 2026: The Department announced the immediate suspension of Phase II, which had been scheduled for November 10, 2026. It said all Phase I self-assessment requirements remain in place and created a CMMC Reform Task Force for a 60-day review.
- During the suspension: The DoD CIO CMMC page says solicitations may only require Level 1 (Self) or Level 2 (Self). It also says the suspension does not remove the obligation to protect information under DFARS 252.204-7012.
- Next: As of this writing, the task force’s recommendations have not been published, and no new date for third-party requirements has been announced. Check the official CMMC page for updates.
A CMMC readiness checklist for small manufacturers
You don’t need to wait for the final policy to do the work that every version of CMMC requires.
- Find out what you handle. Review your contracts and purchase orders for FAR 52.204-21, DFARS 252.204-7012 and DFARS 252.204-7021. Ask your customers whether the drawings and data they send are marked as CUI.
- Draw your boundary. List every computer, server, cloud service and machine controller that stores, processes or sends FCI or CUI. A smaller boundary is cheaper to protect.
- Start with the 15 Level 1 requirements. These cover basics such as limiting access to authorized users, identifying and authenticating users, sanitizing media, controlling physical access, protecting system boundaries, patching flaws and running malware protection.
- If you handle CUI, assess against NIST SP 800-171 Rev. 2. Write a System Security Plan and a plan of action for any gaps.
- Score and post honestly. Self-assessment results and affirmations go into SPRS. A senior official affirms them, and false statements create legal risk.
- Know the incident clock. DFARS 252.204-7012 requires rapid reporting of cyber incidents, within 72 hours of discovery, through the DoD reporting portal.
- Check your own suppliers. If you send CUI to a heat treater, plater or machine shop, the requirement flows to them too.
- Put it on a calendar. Self-assessments must be kept current, and affirmations repeat at least annually.
Common CMMC mistakes to avoid
- Treating CMMC as only an IT project. Drawings move through engineering, purchasing, quality and the shop floor.
- Emailing CUI drawings to suppliers from a personal or unmanaged account.
- Assuming a cloud provider covers everything. You remain responsible for how you configure and use the service.
- Posting a perfect self-assessment score without the documentation to support it.
Where CMMC fits in supply chain planning
From my years in aerospace supply chain work, including Pratt & Whitney’s F100 engine program, I learned that a supplier who can’t meet a contract requirement can stop a delivery as surely as a supplier with no capacity. Cybersecurity status is now part of supplier qualification. Add it to your supplier scorecards and approved-supplier lists alongside quality and delivery.
For broader context on defense and industrial policy, see Restoring U.S. Manufacturing and my tracker of companies investing in the U.S.. If you want help mapping which suppliers handle controlled data, or building CMMC status into purchasing workflows, see my manufacturing procurement and supply chain services. For tools that track supplier compliance data, see my AI integration services. I’m not a CMMC assessor; for formal assessments, use an authorized organization listed by the Cyber AB.
Free help for small defense suppliers
- APEX Accelerators, funded by DoD, help businesses pursue government contracts.
- Project Spectrum offers free cybersecurity resources for the defense industrial base.
- NIST SP 800-171 Rev. 2 is the Level 2 requirement set.
Frequently asked questions
What is CMMC?
The Cybersecurity Maturity Model Certification program is the Department of Defense framework, set out in 32 CFR Part 170, for verifying that contractors protect Federal Contract Information and Controlled Unclassified Information on their information systems.
Is CMMC required right now?
Phase 1 began on November 10, 2025, so applicable DoD solicitations can require a CMMC Level 1 or Level 2 self-assessment. On July 13, 2026, DoD suspended the Phase 2 transition that would have added Level 2 third-party certification requirements. Check each solicitation for its stated requirement.
What is the difference between FCI and CUI?
Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release. Controlled Unclassified Information is a narrower category that requires safeguarding under law, regulation or government-wide policy, such as certain technical drawings. Level 1 covers FCI; Level 2 covers CUI.
Does the Phase 2 suspension mean I can skip cybersecurity?
No. DoD has said the suspension does not eliminate the requirement to protect information under DFARS clause 252.204-7012, and it continues to enforce NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments.
Where can a small business get free help?
APEX Accelerators, funded by DoD, help businesses pursue government contracts. DoD’s Project Spectrum offers free cybersecurity resources and training for small defense suppliers.
Additional sources
- eCFR: 32 CFR Part 170, CMMC Program
- Federal Register: DFARS CMMC final rule, effective November 10, 2025
- Department of War release: suspension of CMMC Phase II requirements (July 13, 2026)
- DoD CIO: About CMMC
- Federal News Network: Pentagon suspends CMMC phase two requirements (July 2026)
- NIST SP 800-171 Rev. 2
Peter Klausz is an MBA (University of Rochester, Simon Business School) and the founder of Statadventure, LLC, which has built supply chain software in Python and SQL since 2018. He previously managed F100 engine supply chain work at Pratt & Whitney. Based in Burlington, Massachusetts, he is open to contracting and new roles. Book a free 30-minute call.