CMMC 2.0 for a startup: what to do in the first 90 days

For CMMC, spend your first 90 days finding where you handle federal contract information (FCI) or controlled unclassified information (CUI), fixing scope, writing a system security plan, scoring yourself, and lining up an assessor if your level needs one. Dates and status below come from law firm summaries; verify them with the DoD.

This explains the framework. Compliance with CMMC is assessed per the program rules, and no software vendor certifies you.

What are the levels?

According to a Cooley summary of the final DFARS rule:

• Level 1 covers FCI, with 15 requirements from FAR 52.204-21. It is an annual self-assessment, with scores posted in SPRS.
• Level 2 covers CUI, with NIST SP 800-171 Rev. 2 practices plus DFARS 7012. It is either a self-assessment or third-party (C3PAO) certification.
• Level 3 covers high-value CUI, with 24 enhanced requirements from NIST SP 800-172 plus Level 2. It is performed by DoD.

DoD sets the level in the solicitation. NIST describes SP 800-171 Rev. 2 as recommended requirements for protecting the confidentiality of CUI in nonfederal systems, in 11 control families, and notes that Rev. 2 was withdrawn on 14 May 2024 and superseded by Rev. 3. The CMMC rule as summarized still points to Rev. 2, so check which revision your solicitation names.

What are the dates, and what changed?

The rule was published on 10 September 2025 and took effect on 10 November 2025. As originally planned, per Cooley: Phase 1 (10 November 2025) required a Level 1 or Level 2 self-assessment at award, and Phase 2 (10 November 2026) was to require Level 2 C3PAO certification as a condition of award, with Phase 3 in 2027 and full implementation in 2028.

That schedule has since moved. Clark Hill reports that on 13 July 2026 the DoW CIO and the Under Secretary for Acquisition and Sustainment announced a suspension of Phase 2, citing cost and assessor capacity. A CMMC Reform Task Force was to review the program and report within 60 days, and the article says cancelling CMMC entirely has not been ruled out. In the meantime, compliance is enforced through NIST SP 800-171 Rev. 2 self-assessments and select government-led assessments, DFARS 7012 still applies, and Phase 1 self-assessment obligations are not reported as suspended.

We did not find the task force's conclusions. Check the DoD CIO site for the current position before you commit money to a certification date.

Days 1 to 30: find the data and set scope

1. Read your contracts and solicitations. Look for FAR 52.204-21 (suggests FCI) and DFARS 7012 (suggests CUI), as Cooley advises.
2. Map where FCI and CUI enter, live and leave: email, file shares, laptops, SaaS tools, subcontractors.
3. Define the smallest system boundary that holds CUI. A separate enclave is often easier than the whole company.
4. Name an affirming official, the executive who will sign annual affirmations.

Days 31 to 60: plan and score

1. Write the system security plan, describing how each requirement is met.
2. Score yourself against the practices for your level and record gaps.
3. Create a plan of action and milestones (POA&M) for gaps. Cooley notes closing POA&Ms is how you move from conditional to final status.
4. Fix the cheap items first: MFA, access lists, logging, media protection, training.

Days 61 to 90: evidence and assessors

1. Collect evidence for each practice, with dates and owners.
2. If you expect to need Level 2 certification, talk to assessors about timing, but avoid fixed commitments until the program status is clear. Clark Hill advises reassessing any assessment contracts made for the old November 2026 date.
3. Update subcontract flow-downs and confirm your subcontractors can meet the required level. Cooley notes DoD will not share subcontractor assessment data with primes, so you must verify directly.
4. Enter your self-assessment in SPRS if your level allows it.

What do startups get wrong?

They scope the whole company when a small enclave would do. They treat the self-assessment score as a formality, though an affirming official is attesting to it. And they forget that incident reporting under DFARS 7012 still applies.

What to do

1. Identify every contract clause that implies FCI or CUI.
2. Draw the CUI boundary.
3. Write the system security plan.
4. Score yourself and build the POA&M.
5. Collect dated evidence.
6. Talk to assessors, but hold off on fixed contracts until Phase 2 status is clear.
7. Update flow-downs and check subcontractors.

Quick check

Sources

• Cooley: DoD releases final rule implementing the CMMC contract clause
• Clark Hill: DoW pauses CMMC Phase 2
• NIST SP 800-171 Rev. 2

Last reviewed: 18 October 2026.