CMMC Certification and Compliance: What's Required in 2026, Levels and Cost

What’s required today (status checked October 24, 2026 on dodcio.defense.gov):

CMMC status in 2026: what changed

As of October 24, 2026, CMMC is paused in Phase 1: DoD suspended Phase II, the step that would have added third-party Level 2 (C3PAO) assessments to contracts from November 10, 2026, on July 13, 2026.

• Phase 1 started November 10, 2025, when the DFARS acquisition rule (90 FR 43560) took effect. The program rule, 32 CFR Part 170, had taken effect on December 16, 2024.
• The July 13, 2026 suspension came from the DoD Chief Information Officer. Its implementing memo tells program managers they “may not” designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments, and must amend active solicitations and existing contracts that already carry them.
• A CMMC Reform Task Force was given 60 days to report to the CIO. As of October 24, 2026, DoD CIO’s CMMC pages had not posted its findings.
• What still applies: DFARS clause 252.204-7012 and NIST SP 800-171 Rev 2. DoD says it will enforce them “through self-assessments and select government-led assessments” during the pause.

Morgan Lewis, a law firm, notes that inaccurate self-assessments or unsupported affirmations can still create False Claims Act exposure during the suspension.

What is CMMC? (CMMC 2.0 explained)

CMMC (Cybersecurity Maturity Model Certification) is DoD’s program for checking that contractors actually protect two kinds of government data before they win a contract.

• Federal Contract Information (FCI) is non-public information provided by or generated for the government under a contract (FAR 4.1901).
• Controlled Unclassified Information (CUI) is information a law, regulation or government-wide policy requires the government to safeguard (32 CFR 2002.4(h)).

“CMMC 2.0” is the revised program DoD announced in November 2021. It cut the original five levels to three and let all Level 1 and some Level 2 companies self-assess. The final rule was published on October 15, 2024 (89 FR 83092).

CMMC levels: Level 1, 2 and 3 compared

CMMC has three levels: Level 1 for FCI, Level 2 for CUI, and Level 3 for the small share of contractors DoD expects to handle its most sensitive CUI (about 1% of defense contractors, per the final rule).

Level 2 is where most of the work sits: 110 requirements in 14 families.

How to get CMMC certified: step by step

Getting CMMC certified today means passing a self-assessment at the level your contract names, entering the score in SPRS and affirming it; no contract can require an outside certificate while Phase II is suspended.

1. Find your data. FCI only points to Level 1; any CUI points to Level 2. The contract or the prime’s flow-down clause names the level.
2. Scope your systems. List every system, person and cloud service that stores, processes or sends that data, including any managed security providers with access.
3. Run a gap assessment against FAR 52.204-21 (Level 1) or NIST SP 800-171 Rev 2 (Level 2), using DoD’s free Assessment Guides.
4. Fix the gaps and write the system security plan; compliance platforms that support CMMC can track both.
5. Score yourself and enter the result in SPRS (the Supplier Performance Risk System).
6. Affirm. A senior official, the “Affirming Official”, affirms compliance after the assessment and every year after.

Level 2 allows a short plan of action and milestones (POA&M) if your score reaches 80% of the maximum and the open items are on the allowed list; you then have 180 days to close them. Level 1 allows no POA&M at all.

How much CMMC certification costs (DoD estimates)

DoD estimates a CMMC Level 2 self-assessment costs a small business $34,277 per assessment and $37,196 over three years, against $101,752 per C3PAO assessment. These figures come from the regulatory impact analysis in the 32 CFR Part 170 final rule. They cover the assessment and affirmations only, and DoD says they exclude the cost of implementing the requirements.

Level 3 is the only level where DoD priced the security work itself, because its 24 added requirements are new. For Levels 1 and 2, DoD assumes contractors already meet requirements that have been in contracts since 2017, so remediation is extra. Our CMMC Level 2 guide splits the C3PAO estimate into the assessor’s fee and your own staff time, and covers the controls and scoring.

How long it takes to get CMMC certified

DoD publishes no timeline for CMMC certification; the time depends on how far your systems are from the requirements when you start. A company that already meets NIST SP 800-171 can self-assess in the time it takes to gather evidence. One with gaps needs to fix them first, or use the 180-day POA&M window for the few items allowed on it.

Can you self-certify CMMC?

Yes: as of October 24, 2026, Level 1 and Level 2 can only be met by self-assessment, because contracts can’t require third-party or government assessments while Phase II is suspended. Self-assessment carries a legal weight people miss. The Affirming Official’s annual affirmation is a statement to the government, and Morgan Lewis warns that unsupported affirmations can bring False Claims Act risk.

CMMC is unusual in having a formal certificate at all. HIPAA, by contrast, has none: HHS says it does not recognize private “certifications”, which is why buyers of HIPAA compliance software get evidence tools, not a certificate.