CMMC, the Cybersecurity Maturity Model Certification, is the US Department of Defense program that verifies defense contractors protect federal contract information and controlled unclassified information. If you handle either under a DoD contract, you will likely need a level, and the contract tells you which. Subcontractors are in scope too.
Safeguard does not hold a CMMC certification and cannot give you one. This explains the program. For binding detail, read 32 CFR Part 170 and the contract clause.
What are the levels?
According to a law firm summary of the final rule:
- Level 1 covers federal contract information and the 15 controls in FAR 52.204-21. It uses a self-assessment current for one year, with full implementation.
- Level 2 covers controlled unclassified information, adds NIST SP 800-171 Revision 2, and depending on the contract the Department decides whether a self-assessment or a third-party assessment applies. A Level 2 assessment is current for three years, provided compliance has not changed and an affirmation was made within the past year.
- Level 3 adds 24 requirements from NIST SP 800-172 and is assessed by the DCMA's DIBCAC, aimed at advanced threats.
NIST SP 800-171 is described by NIST as recommended security requirements for protecting the confidentiality of controlled unclassified information in nonfederal systems. Revision 3 supersedes Revision 2 as a publication, but the summary ties CMMC Level 2 to Revision 2, so check which one your contract names.
When does it start?
Phases from the same summary and a second legal source: Phase 1 began 10 November 2025, with Level 1 and Level 2 self-assessments able to be required, and the Department able to require a Level 2 third-party assessment. Phase 2 starts 10 November 2026, when Level 2 third-party assessments may be required. Phase 3 starts 10 November 2027, and Phase 4 on 10 November 2028 brings full implementation across applicable contracts. Sources differ slightly on what each phase mandates, so check the rule text and your solicitation.
Who needs it?
If a DoD contract includes the CMMC clause, the contractor needs the stated level at award. Prime contractors must flow requirements down to subcontractors that handle federal contract information or controlled unclassified information. Cloud and other service providers that store or process controlled information must meet DFARS 252.204-7012 requirements, including the FedRAMP Moderate baseline, per the summary.
Scope is the first job. Identify the systems that handle controlled information, the ones that could, and the nature of each.
How does software supply chain work relate?
Software inventory, configuration management and vulnerability handling are parts of the 800-171 families. Safeguard's compliance automation can help organize evidence for them. It does not certify anyone.
What do assessments look at?
Assessors check each requirement against evidence: policies, configurations, logs and interviews. For a self-assessment you score yourself with the same method and an affirming official attests to the result. For a third-party assessment, a certified assessor organization does the work. The summary we read says conditional status needs a score of at least 80 percent with all critical requirements met, and open items must close within 180 days. Plan your effort around that rule from the start, not at the end.
What are common planning mistakes?
Teams often wait for the contract clause before scoping. Others assume a cloud provider's marketing claim covers them, when the rule cares about the provider's authorization status. A third mistake is treating the affirmation as paperwork, when it is a statement a named person makes every year. Fix these early and the rest gets simpler.
What to do
- Read your contracts to find which CMMC level each requires and from when.
- Define the boundary of systems handling controlled information.
- Score yourself against the 800-171 requirements and list gaps.
- Plan fixes with owners and dates.
- Check which cloud services touch controlled data and their authorization status.
- Ask your prime or subs what they expect to be flowed down.
Quick check
Do all defense suppliers need Level 2?
No. The level depends on the information handled and the contract. Level 1 covers federal contract information only.
Is CMMC the same as FedRAMP?
No. They are different programs, though CMMC refers to FedRAMP Moderate for cloud services that handle controlled information.
Sources
Last reviewed: 18 October 2026.
