CMMC for startup founders: do you need a level to win DoD work?

CMMC applies when your company will process, store or transmit federal contract information or controlled unclassified information on a DoD contract or subcontract. The level depends on that data. Founders should ask early which level a deal needs, who assesses it, and which phase of the rollout it falls in.

Who has to comply?

The rule in 32 CFR Part 170 applies to DoD contract and subcontract awardees that will handle federal contract information (FCI) or controlled unclassified information (CUI) on contractor systems. It covers commercial item contracts above the micro purchase threshold, with an exception for contracts exclusively for commercial off the shelf items. It does not cover federal systems that contractors operate on the government's behalf.

If you are a subcontractor, the requirement flows down. Ask your prime which status the work needs.

What are the levels?

Level 1 (Self): protects FCI. You must meet every requirement, no plan of action is allowed, you self assess every year and post the result in the Supplier Performance Risk System with an affirmation. The requirements are the 15 basic safeguarding items in FAR 52.204-21.

Level 2 (Self) or Level 2 (C3PAO): protects CUI against the 110 requirements of NIST SP 800-171 Revision 2. Depending on the contract, you self assess or a certified third party assessor organization does. The self assessment is repeated every three years. A limited plan of action is allowed under conditions, and it must be closed out within 180 days or the conditional status expires.

Level 3 (DIBCAC): selected requirements of NIST SP 800-172, assessed by the government.

Which one applies is set by the DoD program for each contract based on the type of information.

When does this start to bite?

The rule describes four phases, each beginning one calendar year after the previous one. Phase 1 starts on the effective date of the companion 48 CFR acquisition rule and brings Level 1 or Level 2 self assessment as a condition of award where DoD includes it. Phase 2 adds Level 2 by a C3PAO, Phase 3 adds more, and Phase 4 is full implementation. DoD can include requirements earlier and can use discretion on timing, so read each solicitation.

What does this mean for a seed stage company?

Constructed example: a five person company writes analysis software and wins a subcontract that will involve receiving CUI from a prime. Three decisions follow.

Scope. Where will the CUI live? A small enclave, such as a managed workspace with its own accounts, is far easier to assess than the whole company. The rule ties the assessment to the scope you define, so a smaller scope means fewer systems to prove.

Build or buy. Some founders host the enclave on a service that already meets the requirements and inherit controls. Others build. Compare the cost of an enclave with the cost of assessing your whole environment.

Timing. A C3PAO assessment needs lead time. Ask the prime when they need your status and plan backwards.

Where does software supply chain fit?

NIST SP 800-171 covers areas such as configuration management, risk assessment and system integrity, which include knowing what software you run and fixing flaws. A dependency inventory with vulnerability scanning supplies evidence for those areas. Safeguard can generate SBOMs and scan dependencies, with reachability analysis to help you prioritize. Safeguard does not certify you for CMMC. Assessors do.

What to do

1. Ask the prime or contracting officer which CMMC status the work requires.
2. Define where FCI or CUI will live and draw the boundary.
3. Run a gap check against NIST SP 800-171 for that boundary and score it.
4. Decide whether to build an enclave or use a hosted one.
5. Schedule the assessment, with lead time for a C3PAO if needed.
6. Calendar the affirmation and renewal dates.

Quick check

Sources

• 32 CFR 170.3 Applicability, eCFR
• 32 CFR 170.15 Level 1, eCFR
• 32 CFR 170.16 Level 2 self, eCFR
• 32 CFR 170.14 Model, eCFR

Last reviewed: 18 October 2026.