CMMC Compliance: Everything Defense Contractors Need to Know in 2026

CMMC compliance is now a condition of winning Department of Defense contracts, with enforcement rolling out in phases through 2028. Phase 1 is active now, and Phase 2 mandates third-party certification beginning November 10, 2026. Most contractors handling defense technical data need Level 2, which requires 110 security controls and takes 18–24 months to implement from scratch. If you're starting today, you need expert help to compress that timeline and protect your contract eligibility.

Download Guide
Read More

Introduciton

As you open a new solicitation from a prime contractor, the early excitement you feel quickly fades into confusion and panic. Somewhere in the requirements, buried between contract terms and performance expectations, you see it:

“DFARS 252.204-7021. CMMC Level 2 required for award.”

Maybe you've heard the acronym. Maybe you've been meaning to look into it. But now it's in writing, tied to a contract you need, and the clock is running.

You're not alone. The majority of defense contractors are in this exact position and many are looking to make up for lost ground.

This guide is built for you, the new defense contractor who’s late to the game and looking for answers and help along the way. We’ll break down what CMMC is, what each level requires, where you stand in the enforcement timeline, and what it realistically takes to get certified.

What Is CMMC Compliance?

CMMC (Cybersecurity Maturity Model Certification) is a Department of Defense framework that requires defense contractors to meet verified cybersecurity standards based on the type of information they handle. It has three levels tied to data sensitivity, and as of November 10, 2025, it is a contractual condition of award for applicable DoD solicitations.

The program was created because the DoD's sensitive information was consistently being compromised through defense contractor networks. For years, contractors self-reported their cybersecurity compliance. That era is over. CMMC replaces self-attestation with verified, structured assessment, and in many cases, mandatory third-party certification.

Every DoD solicitation that involves the processing, storage, or transmission of Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) will now specify the exact CMMC level required for the contractor's information systems. Your CMMC status must be reflected in your Supplier Performance Risk System (SPRS) profile before you can win an award.

This applies to prime contractors and their entire supply chain. If you're a subcontractor, your prime is now responsible for verifying your compliance before flowing down any CUI to you.

Which Level of CMMC Compliance Do You Need?

If you handle only FCI (contract-related data not intended for public release) you need Level 1. If you handle CUI, which includes defense technical data, engineering specifications, export-controlled information, proprietary designs, or personnel data tied to government contracts, you need Level 2.

CMMC Compliance Levels

Here's the catch: most contractors discover they need Level 2 after already assuming Level 1 would be sufficient. But if your work touches any defense technical data, engineering specs, proprietary designs, or personnel data tied to government contracts, you are almost certainly handling CUI and need Level 2.

The distinction matters enormously. Level 1 is achievable in weeks. Level 2 takes up to two years. Getting this wrong from the start is one of the most expensive mistakes a contractor can make.

If you're unsure which category applies to your work, the answer is almost always Level 2. The types of information that trigger CUI designation are broad, and prime contractors like Lockheed Martin and Boeing are already pushing their entire supply chains toward Level 2 certification regardless of what the contract language technically requires.

What Level 1 Requires

Level 1 applies to contractors handling only FCI. It requires 15 basic cybersecurity controls drawn from FAR 52.204-21, covering:

  • Access control
  • Identification and authentication
  • Media protection
  • Physical protection
  • System and communications protection
  • System integrity

You complete an annual self-assessment, score your compliance, and submit the results to your SPRS profile. A senior official must affirm continuous compliance annually. No third-party assessor is required.

For most organizations starting from a reasonable baseline, Level 1 takes one to three months to achieve and typically costs between $15,000 and $30,000 in the first year, including any technology gaps that need to be addressed.

Level 1 is manageable, but you still need to have a current, accurate SPRS score. Contracting officers are checking, and bids are being rejected when SPRS profiles don't reflect current compliant status.

What Level 2 Requires

Level 2 is a different category of effort. It applies to contractors handling CUI and requires meeting all 110 security controls specified in NIST SP 800-171, organized across 14 security families:

  1. Access Control
  2. Awareness and Training
  3. Audit and Accountability
  4. Configuration Management
  5. Identification and Authentication
  6. Incident Response
  7. Maintenance
  8. Media Protection
  9. Personnel Security
  10. Physical Protection
  11. Risk Assessment
  12. Security Assessment
  13. System and Communications Protection
  14. System and Information Integrity

Level 1 touches six of these families at a basic level. Level 2 goes significantly deeper into all six, and adds eight entirely new families that Level 1 contractors never have to address.

The assessment itself must be conducted by a Certified Third-Party Assessment Organization (C3PAO) as of November 10, 2026. Self-assessment is no longer accepted for most Level 2 contracts after that date. The C3PAO assessment covers document review, staff interviews, and technical testing. Certification is valid for three years, with annual affirmation of continuous compliance required each year in between.

First-year costs for Level 2 typically range from $70,000 to $250,000 or more, depending on your organization's size and starting security posture.

The Enforcement Timeline: Where You Stand Right Now

CMMC enforcement is rolling out in four phases through November 2028. Phase 1 is active now. Phase 2 mandatory C3PAO certification begins November 10, 2026. If you haven't started your preparation, you are already behind the Phase 2 deadline.

Here's what each phase means in practice:

Phase 1 — November 10, 2025 (Active Now)

DFARS 252.204-7025 now appears in applicable DoD solicitations. Bids are rejected if your SPRS profile doesn't reflect current compliance. Level 1 self-assessment is required for FCI contracts. Level 2 self-assessment is required for CUI contracts.

DoD contracting officers may require C3PAO third-party certification immediately at their discretion. Approximately 65% of the Defense Industrial Base is affected during this phase. Prime contractors including Lockheed Martin, Boeing, and Northrop Grumman are already issuing supply chain compliance directives independent of contract language.

Phase 2 — November 10, 2026

Self-certification for Level 2 ends. Mandatory C3PAO third-party assessment is required for all Level 2 contracts. Your SPRS profile must reflect current Level 2 certification before bids are accepted.

Conditional certifications with open Plans of Action and Milestones (POA&Ms) must close within 180 days or certification expires. Any organization handling CUI that hasn't started preparation is already behind this deadline. C3PAO assessment backlogs are currently running 6–12 months. Scheduling now is necessary, not optional.

Phase 3 — November 10, 2027

Level 2 C3PAO certification is now required for option period exercises on existing contracts, not just new awards. Previously awarded contracts come under CMMC scope when options are exercised. This effectively closes the last remaining path for non-certified organizations to maintain existing DoD work.

Phase 4 — November 10, 2028

Full enforcement. Every applicable contract requires certification, with no exceptions and no grandfathered contracts. Prime contractors must verify and document CMMC status of all subcontractors before flowing down CUI. Compliance becomes a permanent operational requirement.

The urgency is real. Only an estimated 200 defense contractors had completed C3PAO assessments as of early 2026, while approximately 80,000 need Level 2 certification. The gap between supply and demand for assessors is significant.

How Long Does Level 2 Certification Take?

Level 2 CMMC certification takes 18–24 months from scratch. For organizations starting today, the Phase 2 deadline of November 10, 2026 is already past the standard implementation window. That doesn't mean certification is impossible, but it does mean you need experienced help to compress timelines and prioritize correctly.

Here's a realistic breakdown of the path:

Gap Assessment (Months 1–2)

Identify all systems that touch CUI or FCI. Score your current posture against NIST SP 800-171. Produce a System Security Plan (SSP) and a Plan of Action and Milestones (POA&M). This phase sets the foundation for everything that follows.

Scope Reduction (Months 2–3)

Isolate CUI to a defined enclave rather than treating your entire network as in-scope. This single step can reduce implementation cost and timeline significantly. Most organizations skip it and pay for it later.

Remediation Planning (Months 3–5)

Build a remediation roadmap. Prioritize the highest-risk gaps and begin procurement and deployment of required tools and configurations.

Control Implementation (Months 5–17)

Implement all 110 controls across 14 families. This is the core of the certification process and accounts for 65–75% of total project time and cost.

Pre-Assessment Validation (Months 17–19)

Internal review and mock assessment to confirm controls are implemented, documented, and provable. Documentation quality can make or break your assessment outcome with a C3PAO.

C3PAO Assessment (Months 19–24)

Formal third-party assessment involving document review, staff interviews, and technical testing. Typically costs $35,000–$75,000. Conditional certifications must close all open POA&Ms within 180 days. Certification is valid for three years with annual affirmation required.

The truth is direct: if you handle CUI and are starting today, you're already behind the Phase 2 deadline and need a partner who can help you move faster than the standard timeline. Our fractional IT department model is built for exactly this: embedded, focused, and accountable to your timeline, not a generalist help desk.

What Happens If You're Not Compliant?

Without a current CMMC status at the required level reflected in your SPRS profile, your bids will be rejected outright. DoD contracting officers are now required to verify CMMC compliance before contract award. There is no workaround and no grace period for contracts that specify a CMMC level.

The downstream effects compound quickly. Prime contractors are auditing their entire supply chains right now. If you can't demonstrate CMMC readiness, primes will remove you from consideration before a solicitation even reaches you.

Phase 3 in November 2027 adds another layer: even existing contracts come into scope when option periods are exercised. That means contractors who have been coasting on existing work without pursuing certification will face a hard stop when their contracts come up for renewal.

For subcontractors, the exposure is double. Your prime is legally accountable for your compliance under DFARS 252.204-7021 flowdown requirements. Primes who can't verify your status will simply stop sending you CUI, which often means stopping work with you entirely.

The math is straightforward. The cost of compliance is significant but bounded. The cost of losing DoD contract eligibility is open-ended. Our team at TMGC has helped manufacturers and defense contractors understand this tradeoff as CMMC preparation is increasingly central to every engagement.

How TMGC Helps Defense Contractors Get Compliant

TMGC has been supporting defense contractors and manufacturers in the Denver Metro area for over 25 years. As a veteran-owned business, we approach this the same way we approach every client relationship: as a real partner, not a vendor who disappears after the paperwork is done.

Our fractional IT department model means we operate as an embedded extension of your team throughout the compliance process, from initial gap assessment through C3PAO preparation and beyond.

What that looks like in practice:

  1. We start with an honest assessment of where you stand against NIST SP 800-171. We help you identify which systems touch CUI, scope your environment correctly, and build a realistic POA&M that prioritizes the controls most likely to affect your assessment outcome.
  2. We then work alongside your team to implement the technical controls, build the documentation your C3PAO will need, and prepare your staff for the assessment process itself.
  3. Our flat-rate pricing model means you know exactly what you're committing to. No surprise invoices when a project runs long, no nickel-and-diming for every support ticket. For a process as long and complex as Level 2 certification, cost predictability matters.

Our compliance management services cover CMMC alongside FINRA, HIPAA, and other industry-specific requirements, which matters for contractors who serve multiple regulated industries or who have compliance obligations beyond CMMC itself.

If you handle CUI and haven't started your CMMC preparation, the time to act is now. The Phase 2 deadline is November 10, 2026, C3PAO backlog wait times are already stretching 6–12 months, and the standard implementation timeline is 18–24 months. Every week of delay narrows your options.

Reach out to our team and let's figure out where you stand and what it takes to get you to your next level of compliance!