CMMC applies to defense contractors and subcontractors that process, store or transmit federal contract information or controlled unclassified information on their own systems. The CTO's first decisions are which systems hold that data, which level the contracts require, and whether a separate enclave is cheaper than securing everything.
Who must comply?
The Program rule at 32 CFR 170.3 says the requirements apply to DoD contract and subcontract awardees that handle federal contract information (FCI) or controlled unclassified information (CUI) on contractor information systems. They do not apply to federal systems operated on the government's behalf. The contracting officer picks the level for each procurement, based on the type of information involved, and subcontractor levels follow the flow down rules.
What are the levels?
The rule names several statuses: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO, an assessment by a third party organisation) and Level 3 (DIBCAC, a government assessment). Level 2 is built on the NIST SP 800-171 requirements for protecting CUI in nonfederal systems. You do not choose the level; the contract does. Your job is to know which contracts you pursue and what they will probably ask.
How does the phase-in work?
The rule describes four phases, each starting one calendar year after the previous one. Phase 1 introduces Level 1 and Level 2 self assessments as a condition of award. Phase 2 adds Level 2 by a third party assessor and may add Level 3. Phase 3 and Phase 4 extend these across applicable solicitations and option periods. DoD keeps discretion on timing, and dates depend on rulemaking steps. Check the current DoD CIO guidance before you plan around a calendar date.
What is the enclave decision?
Scope follows data. If CUI sits on every laptop, in shared chat and in the main file store, the whole company is in scope. If CUI lives in one segregated environment with its own identity, devices and logging, only that enclave is assessed, plus the assets that support it.
A constructed example: a 60 person engineering firm gets one contract with CUI drawings. Option A secures all 60 laptops and the corporate tenant to the NIST 800-171 level. Option B stands up a managed enclave for the 8 people on the contract and trains them to keep CUI inside it. Option B has an ongoing cost for the enclave and friction for users, but a far smaller assessment surface. Compare the costs honestly, including the people time.
Which engineering areas matter most?
Expect questions on access control and MFA, device management and encryption, audit logging, configuration baselines, vulnerability management, incident response, media protection, and boundary protection. Supply chain also shows up: you need to know what software runs in the boundary and whether your suppliers handle CUI.
How does software supply chain fit in?
Dependencies are part of the system you assess. Keep an inventory of components in anything inside the boundary, and a route to find out quickly when one is disclosed as vulnerable. Safeguard's SBOM and dependency scanning can build that inventory and show which findings are reachable, which helps vulnerability management evidence. It does not certify you for CMMC.
What to do
- List contracts and proposals and note which involve FCI or CUI.
- Map where CUI is created, stored and sent today.
- Decide between whole-company scope and an enclave, with cost for each.
- Gap assess against the NIST SP 800-171 requirements and write a plan with owners.
- Check the flow down terms you pass to subcontractors.
- Track DoD guidance on phase dates and update the plan each quarter.
- Do not describe the company as CMMC certified until a valid status exists.
Quick check
Does CMMC apply if we only handle FCI?
Yes, in the form of Level 1 requirements, which cover FCI. CUI brings Level 2 or higher depending on the contract.
Can we pick our own CMMC level?
No. The level is set per procurement by the requiring DoD activity. You can prepare for a higher level than your current contracts need.
Sources
Last reviewed: 18 October 2026.
