Key Facts
- Regulator
- US Department of War (Office of the DoD CIO)
- Effective
- 15 October 2024
- Official text
- dodcio.defense.gov ↗
What is CMMC?
CMMC, the Cybersecurity Maturity Model Certification, is the US Department of War's programme for checking that defence contractors protect sensitive government information. It sets cybersecurity levels that suppliers must meet, by self-assessment or third-party assessment, as a condition of defence contracts. It applies to companies in the US defence supply chain, including some UK firms.
The programme is run from the Department of War CIO's CMMC pages and set out in the federal rule 32 CFR Part 170. The current model has three levels, replacing the older five-level model. Phase 1 implementation began on 10 November 2025.
The programme is in flux. On 13 July 2026 the Department announced the immediate suspension of Phase 2, which was due to start on 10 November 2026 and would have introduced Level 2 certification by a third-party assessor (a C3PAO). A CMMC Reform Task Force is reviewing the programme, and no outcome had been published by mid-October 2026. Phase 1 self-assessment requirements remain in place.
Why it matters
A contract names a CMMC level. The programme that defines how you prove it has been paused.
That is the position many suppliers are in. CMMC certification was heading towards being a gate on winning and keeping defence work, and the third-party stage is now on hold. What has not gone away is the underlying duty. The DFARS 252.204-7012 obligation to protect information remains, and self-assessments at Levels 1 and 2 still apply.
Planning around a pause is a bet. The review may change the model, the timetable or both, so the safe reading is that the controls stay and the route to proving them may move.
Who it applies to
CMMC applies to organisations that hold defence contracts with the US government, and to the suppliers beneath them. The level depends on the information the contract involves: Federal Contract Information (FCI) calls for Level 1, and Controlled Unclassified Information (CUI) for Level 2 or above. Level 1 and Level 2 (Self) are assessed by the supplier; the third-party and government assessments are the stages now suspended.
The obligation is contractual. Nobody is required by statute to hold a CMMC level in the abstract. It arrives through the terms of a defence contract and any contract clauses passed down the supply chain. A firm with no US defence contract does not need it.
The relationship to ISO 27001 is one of scope, not equivalence. A CMMC Level 2 assessment is against the 110 security requirements in NIST SP 800-171 Revision 2, so an ISO 27001 certificate does not replace it. The ISMS work behind ISO 27001 gives a useful base, but the assessment still has to be made against the NIST requirements.
A certificate from another scheme is not a CMMC level.
The UK position
A UK firm meets CMMC commercially, not through UK law. It happens when you hold, or subcontract under, a US Department of War contract that carries CMMC requirements. A UK firm with no US defence work will not meet it.
Two UK regimes sit nearby and are easily confused with it:
| UK regime | What it is | Relationship to CMMC |
|---|---|---|
| Cyber Essentials and Cyber Essentials Plus (NCSC) | The NCSC's baseline certification for five technical controls, the government-recommended minimum | A different scheme that does not satisfy CMMC. The nearest UK analogue to CMMC Level 1 basic hygiene |
| Defence Standard 05-138 (UK MOD) | The MOD standard setting the cyber controls suppliers must meet at each contract risk level (Issue 4, May 2024) | The UK counterpart for MOD contracts, applying to MOD suppliers and their subcontractors. A firm with both UK MOD and US DoD work may face both |
The usual first encounter is a US prime asking which CMMC level applies to the work and whether you have recorded a self-assessment.
Key requirements
CMMC is built around levels, each tied to a set of security requirements and an assessment type. While Phase 2 is suspended, contracts may only carry the two self-assessment levels.
- Level 1 (Self). The 15 basic safeguarding requirements in FAR 52.204-21, with an annual self-assessment and an annual affirmation of compliance.
- Level 2 (Self). A self-assessment every three years, with annual affirmation of compliance with the 110 security requirements in NIST SP 800-171 Revision 2. Results go into SPRS, the Department's Supplier Performance Risk System.
- Level 2 (C3PAO). The same 110 requirements, assessed every three years by an accredited third-party assessor. This was due in Phase 2 and is suspended.
- Level 3 (DIBCAC). 24 enhanced requirements selected from NIST SP 800-172, assessed by the Defense Contract Management Agency's DIBCAC, with Level 2 (C3PAO) as a prerequisite. This was due in later phases and is on hold.
The affirmation matters. Someone senior in the company is stating that the requirements are met, which is why the self-assessment has to rest on evidence rather than optimism.
Alongside the levels, DFARS 252.204-7012 still requires contractors to safeguard covered defence information during the suspension.
A self-assessment you cannot evidence is a liability, not a score.
Because the review is under way, check the Department's CMMC page for the current position before relying on any of this in a bid or a contract.
Frequently asked questions
CMMC requires a defence supplier to meet the security requirements for its contract's level and to prove it by assessment, with results recorded in SPRS. Each assessment also needs an affirmation from a senior official that the requirements are met and stay met. A CMMC level covers only the systems inside the assessment scope, so setting that scope is part of the work.
NIST SP 800-171 is the set of security requirements. CMMC is the programme that assesses whether a contractor meets them. At Level 2, CMMC checks compliance with the 110 requirements in NIST SP 800-171 Revision 2, either by self-assessment or, when it returns, by a third-party assessor.
Not at Level 2 or Level 3. The Department of War suspended CMMC Phase 2 on 13 July 2026, and solicitations that called for Level 2 (C3PAO) or Level 3 (DIBCAC) are to have those requirements removed. CMMC Level 1 and Level 2 self-assessments still apply. Third-party CMMC certification may return once the review reports, so check the current position.
Only if it holds or subcontracts under a US Department of War contract that carries CMMC requirements. CMMC is not UK law. A UK supplier with no US defence work will not meet it, though one with both UK MOD and US DoD contracts may face CMMC and Defence Standard 05-138, which set different controls and are assessed separately.
No. A CMMC Level 2 assessment is made against NIST SP 800-171 Revision 2, not ISO 27001. Cyber Essentials is a separate UK scheme that does not satisfy CMMC either. Both can support the underlying security work, but neither replaces a CMMC self-assessment or affirmation.