Any organization in the Department of Defense supply chain that processes, stores, or transmits Federal Contract Information or Controlled Unclassified Information on its own systems needs to comply with CMMC. That includes prime contractors, subcontractors at every tier, and vendors who never speak to a government customer.

The data decides, not your size, your tier, or your distance from the contracting officer. A twelve-person machine shop holding drawings on its own file server is in scope. A large firm that only views data inside a prime's environment may not be.

One qualifier belongs up front because a scoping answer without it would mislead. As of early October 2026, CMMC is operating in Phase 1: Level 1 and Level 2 self-assessment requirements are live, and the Phase 2 transition that would have added third-party certification has been suspended since July 13, 2026. Below we cover who is in scope, who is exempt, how your level gets assigned, what is required right now, which clause puts it in your contract, how ITAR fits alongside it, and how anyone verifies any of it.

Who Needs to Comply With CMMC?

CMMC applies to all Department of Defense contract and subcontract awardees that will process, store, or transmit Federal Contract Information or Controlled Unclassified Information on contractor information systems in performance of a DoD contract. The program rule at 32 CFR Part 170 states it in those terms, and the phrase that matters most is "on contractor information systems."

Your own systems are the trigger. A subcontractor who logs into a prime's portal, works inside that environment, and never downloads anything holds a different position than one who receives an email attachment and saves it locally. The second one has put federal information on its own equipment, which is where the obligation attaches. We see that distinction decide scope for government contractors more often than any other factor.

What Companies Need CMMC Compliance?

The companies that need CMMC compliance span far more of the defense supply chain than most people expect. Machine shops, metal fabricators, electronics assemblers, logistics and freight firms, staffing agencies, engineering and design firms, software vendors, construction contractors, research organizations, and professional services providers all land in scope when they handle the right information.

Industry is irrelevant to the question. A company that has never described itself as a defense contractor still falls in scope if it holds a DoD subcontract and receives covered information. The usual discovery moment is a questionnaire from a prime rather than a solicitation of your own, which arrives later in the relationship than anyone would like.

What Is the Difference Between FCI and CUI?

The difference between FCI and CUI is sensitivity and consequence. Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release and is not simple transactional data. Controlled Unclassified Information is information that law, regulation, or government-wide policy requires an agency to safeguard or control the dissemination of.

FCI is more ordinary than its name suggests, and that is the point most companies miss. Contract performance reports, organizational charts tied to a contract, delivery schedules, and proposal responses are all FCI. A small supplier whose entire DoD exposure is a mailbox and a shared drive is almost certainly holding FCI, which puts it at Level 1 rather than outside the program.

Does CMMC Apply to Subcontractors?

Yes, CMMC applies to subcontractors, and the requirement flows down throughout the supply chain at all tiers. A second-tier or third-tier supplier is no more exempt than a prime; the level simply tracks what that supplier actually handles.

Minimums follow the information. A subcontractor handling only FCI needs Level 1 (Self). A subcontractor handling CUI needs at least Level 2 (Self). Where a prime contract carries a Level 2 (C3PAO) or Level 3 requirement, a subcontractor handling CUI needs at least Level 2 (C3PAO). The prime also carries a verification duty, which means confirming a subcontractor's status before award rather than trusting an assurance in a teaming agreement.

Who Is Exempt From CMMC?

Exemptions exist and they are narrow. The following fall outside the program:

• Contracts solely for commercially available off-the-shelf items. COTS means the item is used by the general public, sold in substantial quantities commercially, and offered to the government without modification. Notably, there is no broader exception for commercial products or services under FAR Part 12.
• Contracts at or below the micro-purchase threshold.
• Federal information systems that contractors operate on the government's behalf. Those run under separate rules rather than CMMC.
• Subcontractors who never touch covered information. A supplier whose services never provide access to FCI or CUI, with systems kept segregated, does not inherit the higher-tier requirement of the prime it serves.
• Non-DoD federal work. CMMC is a Department of Defense program. Other agencies set their own cybersecurity requirements.

The fourth exemption deserves care because companies claim it loosely. Never touching covered information means never, including in email threads, shared folders, and project tools. Segregation has to be real and documented, not assumed because nobody remembers sending anything sensitive.

How Is Your CMMC Level Decided?

Your CMMC level is decided by the type and sensitivity of the information you will handle under the contract, as determined by the DoD program office or requiring activity rather than by you. A January 2025 DoD guidance memorandum sets out the assignment logic, and it is more specific than most summaries suggest.

The table below reflects 32 CFR Part 170 and that guidance memorandum, with a final column showing what may be designated while the Phase 2 suspension holds.

LevelInformation HandledRequirementsAssessmentDuring the SuspensionLevel 1 (Self)FCI only15 requirements in FAR 52.204-21(b)(1)Annual self-assessment, no POA&M permittedMay be requiredLevel 2 (Self)CUI outside the CUI Registry Defense Organizational Index Grouping110 requirements in NIST SP 800-171 Rev. 2Self-assessment every three years, affirmed annuallyMay be requiredLevel 2 (C3PAO)CUI within the Defense Organizational Index Grouping110 requirements in NIST SP 800-171 Rev. 2Third-party assessment every three years, affirmed annuallyMay not be designatedLevel 3 (DIBCAC)The most sensitive CUI24 selected NIST SP 800-172 requirements, plus Level 2Government assessment by DIBCAC every three yearsMay not be designated

Level 3 has its own triggers rather than a volume threshold. It applies where the CUI is associated with breakthrough, unique, or advanced technology, where a single system or environment holds a significant aggregation of CUI, or where ubiquity means an attack on one environment would create widespread vulnerability across the Department. The structure behind all three CMMC levels is covered in more depth separately.

Which CMMC Level Do I Need?

You need the level your solicitation or contract names, and you can predict it accurately by identifying the information involved. Handle only FCI and the answer is Level 1. Handle CUI and the answer is at least Level 2, with the variant depending on which category the CUI falls into.

The split inside Level 2 is the detail almost nobody explains. Under the DoD guidance, CUI that falls completely outside the National Archives CUI Registry Defense Organizational Index Grouping points to a Level 2 self-assessment, while CUI that falls within that grouping points to certification by a third-party assessment organization. Two companies can both hold CUI and face different assessment paths because of which category their information occupies. Scoping that question early is what a CMMC readiness effort should settle before anything technical begins.

What Is the Difference Between Level 2 Self-Assessment and C3PAO Certification?

The difference between Level 2 self-assessment and C3PAO certification is who performs the assessment, not what gets assessed. Both measure the same 110 requirements from NIST SP 800-171 Revision 2. In one your own team scores the environment and posts the result; in the other an authorized third-party assessment organization does it.

Preparation is identical either way, which is the practical takeaway during the current pause. The same control implementation, the same documentation, and the same evidence support both paths, so work done for a self-assessment is not wasted if a certification requirement returns later.

Do Small Businesses Need CMMC?

Yes, small businesses need CMMC when they handle FCI or CUI. The program contains no small-business exemption and no revenue threshold. A sole proprietor subcontracting on a DoD program carries the same Level 1 obligation as a large firm handling the same information.

Scope usually works in a small company's favor, though. A business with one shared drive and a single mailbox holding FCI has a far smaller environment to assess than a company with dozens of interconnected systems. A focused gap analysis against the applicable requirements typically takes less time than owners expect, and it produces the scoping answer and the remediation list at once.

What Are the CMMC Compliance Requirements for 2026?

For 2026, the CMMC compliance requirements are a current self-assessment at the level your contract names, a score posted in the Supplier Performance Risk System, a current annual affirmation by a senior official, a system security plan covering the systems in scope, and a plan of action worked to closure within the permitted window. Third-party certification is not among them while the suspension holds.

What changed in July 2026 was the gate, not the standard. The Department of War suspended the Phase 2 transition that would have made third-party assessment a condition of award on November 10, 2026, and a class deviation signed September 3, 2026 directed contracting officers to remove those requirements from solicitations and contracts. During the suspension, requiring activities may designate only Level 1 (Self) or Level 2 (Self).

Everything underneath stayed exactly where it was. DFARS 252.204-7012 still applies, the 110 requirements still apply, SPRS scoring still applies, and the Department said it would continue enforcing NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments. Treating the pause as a reprieve is the expensive reading, since a compliance program built now will meet whatever the Reform Task Force review produces, and one deferred will not.

Is the CMMC Law Now?

CMMC is established in regulation rather than statute, and it is in effect. The program rule at 32 CFR Part 170 took effect December 16, 2024, and the acquisition rule that places the clause in contracts took effect November 10, 2025. Neither was repealed by the suspension; the Department paused a transition inside the phased rollout.

Obligation still arrives through your contract rather than through the regulation itself. A solicitation without the CMMC clause imposes no CMMC requirement, and one with it imposes the level the contracting officer specifies. Your System Security Plan should reflect whichever level that turns out to be.

When Does CMMC Apply to My Contract?

CMMC applies to your contract at the moment of a contract action that carries the clause: a new award, an option exercise, a recompete, or a renewal. Existing relationships provide no continuity at those moments, so a supplier three years into performance faces the same check at the next option as a first-time bidder.

Primes often move faster than the Department does. Many continue to require evidence from subcontractors regardless of the suspension, because their own flow-down duty never paused, and a teaming agreement can impose requirements the contract has not yet named.

Which DFARS Clause Requires CMMC?

DFARS 252.204-7021 is the clause that requires CMMC. When that clause appears in your contract, you must have and maintain a current CMMC status at the level the contracting officer specifies, for the duration of the contract, covering every information system that processes, stores, or transmits FCI or CUI in performance.

The same clause carries the flow-down duty, obligating the contractor to pass the correct level down to subcontracts, including subcontracts for commercial products and services, and to confirm a subcontractor holds a current status before award. Knowing which clauses sit in your contracts is the first step for any supplier working out how cybersecurity rules reach their business.

What Does DFARS 7012 Require?

DFARS 252.204-7012 requires three things that predate CMMC and continue independently of it. Covered contractor information systems must implement NIST SP 800-171. External cloud service providers holding covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline, now designated Class C. And cyber incidents must be reported within 72 hours of discovery.

That 72-hour window catches companies without a plan. Discovery starts the clock, and a team working out who calls whom after an incident has already begun will not meet it, which is why a tested incident response plan belongs in place before anything happens rather than after.

Who Needs to Comply With DFARS?

Any contractor or subcontractor whose contract contains a DFARS cybersecurity clause needs to comply with it. DFARS 252.204-7012 applies where covered defense information is involved, and it has been appearing in defense contracts for years, well before CMMC existed.

Two related clauses travel with it. DFARS 252.204-7019 requires a current NIST SP 800-171 assessment, not more than three years old unless the solicitation says otherwise, with summary scores posted in SPRS. The companion assessment clause was renumbered to DFARS 252.240-7997, with the information security rules moved into a new DFARS Part 240, so a contract search for the old number will miss clauses that are still fully in force.

What Is the Difference Between DFARS and CMMC?

The difference between DFARS and CMMC is that DFARS states the obligation and CMMC verifies it. DFARS 252.204-7012 has required NIST SP 800-171 implementation for years on a self-attestation basis. CMMC adds a verification mechanism, with an assessment type and a status recorded in SPRS.

Both derive from the same technical foundation, which is why NIST compliance work serves both at once. The practical consequence of the suspension is that the verification layer paused while the obligation layer did not, leaving DFARS 252.204-7012 as the clearest live cybersecurity requirement in most defense contracts today.

Does CMMC Apply to ITAR?

CMMC and ITAR are separate regimes that frequently apply to the same company. CMMC governs the cybersecurity of systems holding FCI and CUI, while the International Traffic in Arms Regulations govern who may access export-controlled technical data. Meeting one does not satisfy the other.

The distinction is system-based versus person-based. CMMC asks whether your controls are implemented and verified. ITAR asks whether a foreign national has access to controlled technical data, which can happen through an employee, a contractor, or a cloud provider's support staff located outside the United States. A company can implement every CMMC requirement correctly and still have an export control problem.

Export-controlled technical data is also typically CUI, so the obligations stack rather than substitute. For suppliers holding both, cloud selection becomes the pressure point, since a platform meeting the FedRAMP baseline does not automatically restrict backend administration to US persons.

How to Know If a Company Is CMMC Compliant

You confirm whether a company is CMMC compliant by checking its status and score in the Supplier Performance Risk System and verifying that a current affirmation sits behind it, rather than by accepting a statement in an email. Work through these steps:

1. Establish which level the contract actually requires, since a company compliant at Level 1 is not compliant for a Level 2 requirement.
2. Ask for the CMMC status and SPRS score, along with the date the assessment was performed and the date it was entered.
3. Confirm the affirmation is current, because an assessment without a current annual affirmation does not count under the clause.
4. Check which systems the assessment covered, since a status covering one environment says nothing about another the subcontractor also uses for your work.
5. Record what you found and re-check at the next option exercise, because status can lapse and nothing notifies you when it does.

Primes carry this duty formally and subcontractors should expect it. If you are on the receiving end, having the answers ready shortens a conversation that otherwise stalls an award. Keeping that evidence current between contract actions is ordinary compliance support work rather than a project.

Who Signs the CMMC Affirmation?

The CMMC affirmation is signed by an affirming official, a senior representative from within your own company who is responsible for compliance and has the authority to affirm it. That person enters the affirmation in SPRS after each assessment, after any plan of action closeout, and annually.

The signature carries weight well beyond the database. In June 2026 the Department of Justice announced that LOGZONE Inc., a Huntsville defense contractor, agreed to pay $507,144 to resolve False Claims Act allegations tied to two Navy contracts worth roughly $680,000. The company had posted a self-assessed score of 110 in October 2021; a government assessment in February 2024 scored it at negative 170, near the bottom of a range running from negative 203 to 110.

Two details make the case worth knowing. No breach occurred and no whistleblower filed. The government's own assessment process surfaced the gap, which means a score that does not match reality is discoverable without anything going wrong and without anyone reporting you. An affirming official reviewing documented evidence before signing is the straightforward protection, and it is what a current risk assessment exists to produce.

What Happens If You Are Not CMMC Compliant?

If you are not CMMC compliant when a contract requires it, you lose eligibility for that award, that renewal, or that option exercise. CMMC itself carries no fine. The cost arrives as revenue that does not happen, and for subcontractors it arrives as primes moving work to suppliers who can produce a status.

Prevention is almost entirely front-loaded. Identify where FCI and CUI live in your environment, confirm the level your contracts require, close the gap between your posted score and your actual posture, and keep the documentation current. Companies that start during a quiet period finish calmly, while those that start when a solicitation lands pay more for the same result, which is the case for maintaining managed cybersecurity continuously rather than assembling it under deadline.

Frequently Asked Questions

Does CMMC Apply to Companies Outside the United States?

Yes, CMMC applies to companies outside the United States when they hold a DoD contract or subcontract and handle FCI or CUI on their own systems. Location does not change the obligation. Foreign suppliers in the defense supply chain meet the same requirements as domestic ones, and export control rules may apply on top for technical data.

Does CMMC Apply to Non-DoD Agencies?

No, CMMC is a Department of Defense program and does not apply to contracts with civilian agencies. Other agencies impose their own cybersecurity requirements, and a FAR rule covering Controlled Unclassified Information across the federal government has been moving through rulemaking, so contractors outside defense work should watch their own contract clauses rather than assume nothing applies.

Does CMMC Apply to Cloud Providers?

CMMC applies to cloud providers indirectly, through the contractor using the service. A cloud service provider holding covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline under DFARS 252.204-7012, and an outside provider that handles your CUI or your security protection data on its own assets falls inside your assessment scope.

Who Needs to Comply With FedRAMP?

Cloud service providers holding federal data need FedRAMP certification, and contractors encounter the requirement through their contracts rather than directly. For defense suppliers the connection runs through DFARS 252.204-7012, which means the cloud platforms inside your CUI boundary have to meet the FedRAMP Moderate baseline or a recognized equivalent even though your own company never gets certified.

How Do You Check a Company's SPRS Score?

A company's SPRS score is not public, so you check it by requesting it from the company directly along with the assessment date and the current affirmation. Primes commonly request this during subcontractor onboarding and before award. A supplier unwilling to share a score for a contract that requires one has effectively answered the question.

Can You Lose a Contract Over CMMC?

Yes, you can lose a contract over CMMC, and the most common version is losing eligibility rather than losing an award already held. A contract action requiring a status you cannot produce removes you from consideration. Inaccurate affirmations carry a separate and more serious exposure under the False Claims Act.

The Bottom Line

CMMC reaches any Department of Defense contractor or subcontractor, at any tier and any size, that handles Federal Contract Information or Controlled Unclassified Information on its own systems. The exemptions are narrow: commercially available off-the-shelf contracts, purchases below the micro-purchase threshold, federal systems operated for the government, suppliers whose segregated systems never touch covered information, and work outside the Department of Defense. Your level follows the information you handle, and the Level 2 split between self-assessment and third-party certification turns on which category your CUI occupies.

The suspension of the Phase 2 transition changed who assesses you, not what is required of you. Self-assessments, SPRS scores, annual affirmations, and every obligation under DFARS 252.204-7012 continue. The companies that use this period to scope honestly and close gaps will be ready for whatever the reform review produces, which is the same pattern we see in healthcare, manufacturing, and financial work across Huntsville and North Alabama: the organizations that treat compliance as maintenance spend less than the ones that treat it as a deadline.

If you are working out whether CMMC reaches your business and which level your contracts actually require, the team at Interweave Technologies is glad to walk through it with you. Give us a call at 256.837.2300.

‍