CMMC 2.0 Guide (October 2026): Levels, Phase Status, POA&Ms and Readiness

Who it applies to

CMMC applies to defense contractors and subcontractors whose contractor information systems process, store or transmit FCI or CUI on DoD contracts that include the CMMC clause (32 CFR 170).

• FCI is defined in FAR 4.1901.
• CUI is defined in 32 CFR 2002.4(h).

The required level appears in the solicitation. Primes must flow the requirement down to subcontractors that handle FCI or CUI. Each organization has its own Affirming Official, who must affirm continuing compliance after every assessment, including POA&M closeout, and every year after that.

The three levels

Source: 32 CFR Part 170.

Phased implementation and its current status

Under 32 CFR 170, the rollout has four phases:

• Phase 1 begins on the DFARS effective date (10 November 2025) and requires self-assessments.
• Phase 2 starts a year later and adds Level 2 (C3PAO) requirements.
• Phase 3 follows a year after that.
• Phase 4 is full implementation.

In July 2026 the Department changed course. The DoD CIO CMMC page says that "on July 13, 2026, the Department of War announced the immediate suspension of the CMMC Phase II requirements" and that "all Phase I self-assessment requirements remain firmly in place". The About CMMC page adds that the program "is paused in Phase 1 and may only require self-assessments at two levels". It also says the reform review is aligned with the Acquisition Transformation System directives. Separately, DoD "may, at its discretion" still require Level 2 (C3PAO) instead of Level 2 (Self) in specific solicitations (32 CFR 170).

POA&M rules

32 CFR 170.21 allows limited Plans of Action and Milestones:

• Level 1: no POA&Ms.
• Level 2: you can get a Conditional status if your assessment score is at least 80% of the maximum. No POA&M item can be worth more than 1 point. The one exception is SC.L2-3.13.11, encryption that isn't FIPS-validated. Some requirements can never be on a POA&M, including AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4 (the System Security Plan) and PE.L2-3.10.3–3.10.5.
• Level 3: also requires at least 80% of the requirements, with certain requirements excluded.
• Closeout must happen within 180 days. A POA&M closeout assessment then converts Conditional status to Final.

Penalties and contract consequences

CMMC itself is a contract eligibility condition. Under the DFARS rule, the required CMMC status is a condition of award, and can be a condition of exercising an option period (FR 2025-17359). If you don't have the status, you can't be awarded the contract. Affirmations are formal attestations by a senior official, so inaccurate ones carry legal risk. Ask counsel how this applies to you.

Mapping to related frameworks

• NIST SP 800-171 Rev. 2: this is the Level 2 requirement set. NIST published Rev. 3 in May 2024, but CMMC Level 2 still references Rev. 2.
• NIST SP 800-172: the source of Level 3's enhanced requirements.
• FedRAMP: cloud service offerings that handle CUI must be FedRAMP Authorized at Moderate (or higher), or meet equivalent requirements (32 CFR 170).
• ISO/IEC 27001 and NIST CSF: useful for structuring your program, but they don't replace a CMMC assessment.

Readiness checklist

1. Find out which contracts involve FCI or CUI, and what CMMC level each solicitation specifies.
2. Map where FCI and CUI flow, and define your assessment scope, including enclaves and external service providers.
3. Name an Affirming Official.
4. Write or update your System Security Plan. You can't put it on a POA&M.
5. Assess yourself against all 110 NIST SP 800-171 Rev. 2 requirements, using the CMMC scoring method.
6. Fix the requirements that can't go on a POA&M first, then any items worth more than 1 point.
7. Post your results and affirmation in SPRS.
8. Track POA&M items to closeout within 180 days.
9. Flow requirements down to subcontractors and check their status.
10. Watch the DoD CIO site for task-force outcomes before you schedule a C3PAO.

Common pitfalls

• Assuming Phase II dates still apply. As of October 2026 they're suspended.
• Scope creep. CUI spreads into email, file shares and laptops.
• Treating the SSP as paperwork. CA.L2-3.12.4 can't go on a POA&M.
• Annual affirmations nobody owns, often after the Affirming Official leaves.
• Mixing up Rev. 2 and Rev. 3 of SP 800-171.

How AssureCore helps

AssureCore gives you a Controls Register for the 800-171 requirements, Evidence Management with expiry alerts for proof that needs regular refreshing, and action plans for POA&M tracking. You can also export Audit Reports (PDF/CSV) to prepare for SPRS submissions and assessor reviews.

Frequently asked questions

Official references

• DoD CIO – About CMMC
• DoD CIO – CMMC program page
• eCFR – 32 CFR Part 170, CMMC Program
• Federal Register 2025-17359 – DFARS: Assessing Contractor Implementation of Cybersecurity Requirements
• NIST SP 800-171 Rev. 3 (CSRC)

Related frameworks

• NIST 800-171 guide
• FedRAMP guide
• NIST CSF guide
• ISO 27001 guide