What Is CMMC?
Definition
CMMC (Cybersecurity Maturity Model Certification) is the U.S. Department of Defense program, now under the Department of War, that checks whether defense contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Contractors must meet a required CMMC level as a condition of contract award.
How It Works
CMMC builds on security rules that already appear in defense contracts. While the program is paused in Phase 1, it uses self-assessments at two levels:
- Level 1 covers FCI. It requires an annual self-assessment and affirmation of the 15 security requirements in FAR clause 52.204-21.
- Level 2 covers CUI. It is built on the 110 requirements in NIST SP 800-171 Revision 2, the same requirements in DFARS clause 252.204-7012. Under the current phase, contractors self-assess every three years and affirm compliance annually.
Results are entered into the Supplier Performance Risk System (SPRS). Limited Plans of Action and Milestones (POA&Ms) are allowed at Level 2 and must be closed within 180 days; none are allowed at Level 1.
Current status (October 2026). The first implementation phase began November 10, 2025. On July 13, 2026, the Department of War announced "the immediate suspension" of Phase II requirements, which had been scheduled for November 10, 2026. It stated that "all Phase I self-assessment requirements remain firmly in place," set up a CMMC Reform Task Force with a 60-day review, and said it will enforce NIST SP 800-171 Rev 2 "through self-assessments and select government-led assessments." DFARS 252.204-7012 obligations still apply. Check the DoW CIO CMMC page for the latest status before relying on any date.
Real-World Example
In October 2024, Penn State agreed to pay $1.25 million to resolve False Claims Act allegations that, between 2018 and 2023, it "failed to implement cybersecurity controls that were contractually required by DoD and NASA" in fifteen contracts and subcontracts. The government alleged that Penn State submitted assessment scores showing controls were not in place, then "misrepresented the dates by which it would implement them." The case began as a whistleblower suit by a former CIO of its Applied Research Laboratory. The Justice Department noted the claims were allegations only, with no determination of liability.
Why It Matters for a Small Business
CMMC flows down to subcontractors that handle FCI or CUI, so small suppliers deep in the supply chain are covered too. Even with Phase II suspended, the self-assessment, the SPRS score, and the annual affirmation are signed statements to the government. The Penn State case shows that inaccurate scores or broken promises in a remediation plan can become False Claims Act exposure. Accurate, honest documentation matters as much as the controls themselves. Getting the scope right also saves money: keeping CUI in a small, well-defined set of systems means fewer systems have to meet all 110 requirements.
How to Spot It / How DTS Handles It
Warning signs: a defense contract with DFARS 252.204-7012 or CMMC clauses and no system security plan, an SPRS score nobody can explain, remediation dates that have passed, and CUI stored in ordinary email or file shares.
DTS can help with working through the DFARS and NIST SP 800-171 checklist, a readiness (pre-certification) assessment, and building the remediation plan: a System Security Plan (SSP) and a Plan of Action and Milestones (POA&M). Official certification assessments are done by an accredited C3PAO, not DTS. Ask counsel about contract and False Claims Act questions. For a free SPRS check, see DefensibleScore, or our vCISO service.
Related Terms
- NIST SP 800-171: the requirements behind CMMC Level 2.
- NIST Cybersecurity Framework (CSF 2.0): a broader framework that maps to 800-171.
- Risk assessment: the starting point for scoping.
- Security policy: documentation assessors expect.
- Data classification: identifying CUI and FCI.
- Incident response: DFARS 7012 includes incident reporting duties.
Sources
- Department of War, Office of Industrial Base Growth, Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements (July 13, 2026): https://business.defense.gov/Engage/News/Article/4542563/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/
- DoW CIO, About CMMC (checked October 14, 2026): https://dodcio.defense.gov/CMMC/About/
- U.S. Department of Justice, The Pennsylvania State University Agrees to Pay $1.25M to Resolve False Claims Act Allegations Relating to Non-Compliance with Contractual Cybersecurity Requirements (October 22, 2024): https://www.justice.gov/opa/pr/pennsylvania-state-university-agrees-pay-125m-resolve-false-claims-act-allegations-relating
Last updated October 14, 2026.