CMMC 2.0 overview: levels, assessments and what primes expect

The Cybersecurity Maturity Model Certification (CMMC) program is how the Department of Defense verifies that contractors actually protect the information it shares with them. The program rule is 32 CFR Part 170. A separate DFARS rule, effective November 10, 2025, puts CMMC requirements into solicitations and contracts through the clause at DFARS 252.204-7021 and the solicitation provision at DFARS 252.204-7025. The level a contract requires is stated in the solicitation, and the requirements are being phased in over four annual phases (see the CMMC phase-in timeline).

CMMC protects two kinds of information. Federal Contract Information (FCI) is information not intended for public release that is provided by or generated for the Government under a contract (FAR 52.204-21). Controlled Unclassified Information (CUI) is information that a law, regulation or Government-wide policy requires to be safeguarded (32 CFR Part 2002). The more sensitive the information, the higher the level.

The three levels at a glance#

Two details trip people up. First, CMMC Level 2 is built on Revision 2 of NIST SP 800-171 (32 CFR 170.14), even though NIST published Revision 3 in 2024. Second, "Level 2" alone is incomplete: a solicitation asks for either Level 2 (Self) or Level 2 (C3PAO), and only the second is a third-party certification.

Who does the assessing#

• The contractor performs Level 1 and Level 2 self-assessments and enters the results in the Supplier Performance Risk System (SPRS).
• A C3PAO (CMMC Third-Party Assessment Organization) performs Level 2 certification assessments. C3PAOs are authorized by the Cyber AB, the accreditation body DoD recognizes under 32 CFR Part 170.
• DIBCAC, the Defense Industrial Base Cybersecurity Assessment Center within the Defense Contract Management Agency, performs Level 3 assessments.

Every assessment is followed by an affirmation from a senior official of the company (the Affirming Official) that the company meets and will keep meeting the requirements (32 CFR 170.22). Affirmations are repeated every year and after any POA&M closeout.

Final and Conditional status#

An assessment can end in Final status (all requirements met) or, at Levels 2 and 3, Conditional status: the score cleared the minimum and the few remaining gaps are allowed on a Plan of Action and Milestones (POA&M) that must be closed within 180 days (32 CFR 170.21). Level 1 never allows a POA&M. The details matter for teaming, so they have their own guide.

How CMMC flows down to subcontractors#

Primes must flow CMMC requirements to subcontractors whose work involves FCI or CUI (32 CFR 170.23). The minimum depends on the information the subcontractor handles and on the prime's own requirement:

That last row surprises many teams: a Level 3 prime does not automatically need Level 3 subcontractors, but every subcontractor that touches CUI needs a third-party Level 2 certification.

What primes expect from partners#

When a prime vets you for a DoD pursuit, expect questions that go beyond "are you CMMC compliant?":

Common pitfalls#

• Scoping by accident. Systems that store, process or transmit CUI, and the systems that protect them, are in scope. Moving CUI into an unassessed system breaks your status for that work.
• Letting affirmations lapse. The annual affirmation is part of keeping a status current. Put it on the same calendar as your SAM.gov renewal.
• Waiting for the solicitation. A C3PAO assessment takes planning and scheduling. If the target contract will require Level 2 (C3PAO), start readiness work well before the RFP.
• Assuming commercial work is exempt. Contracts and orders solely for commercially available off-the-shelf (COTS) items are excluded, but commercial services and modified commercial items are not.

How TeamingIndex helps#

• Filter partners by minimum level and assessment type: CMMC Level 2 (C3PAO) partners, or add verified credentials only.
• Every CMMC badge shows Final or Conditional status, the closeout and expiration dates, and who vouches for it (self-attested or verified by TeamingIndex).
• The Team Builder checks each partner against the CMMC gate you set for a pursuit, using the flowdown rules above: on a Level 3 pursuit, subcontractors are checked for Final Level 2 (C3PAO). It assumes every subcontractor will handle CUI; one that handles FCI only needs just Level 1 (Self), so read a CMMC gate result for that partner with this in mind.
• Record your own status, affirmation dates and CMMC UID on your compliance dashboard. Your UID is shown only to you, platform admins and partners with a recorded mutual NDA.