As of October 2026, CMMC Level 2 means a self-assessment against the 110 requirements of NIST SP 800-171 Revision 2, posted in SPRS. The Department of War suspended CMMC Phase 2 on 13 July 2026, so new DoW solicitations may require only self-assessments, not a third-party (C3PAO) assessment.
This guide is for compliance and IT managers at defence suppliers, including subcontractors outside the United States.
What did the July 2026 suspension change, and what stays?
Phase 1 began on 10 November 2025, when the DFARS acquisition rule took effect. Phase 2 was due one year later, on 10 November 2026, and would have added C3PAO assessments as a condition of award. On 13 July 2026 the Department of War (DoW, the Department of Defense's current name on its own sites) suspended Phase 2. It also held all pending and future CMMC milestones in abeyance until further notice.
Two memos issued that day set the interim rules:
- New requirements may designate only Level 1 (Self) or Level 2 (Self). Level 2 (C3PAO) and Level 3 (DIBCAC) may not be designated.
- Active solicitations that named C3PAO or DIBCAC assessments must be amended to remove them.
- Existing contracts drop those requirements by modification before the next option is exercised or at the next scheduled administrative modification.
- No waivers will be granted during the review.
- DFARS 252.204-7012 and the other contract cybersecurity clauses stay in force. DoW enforces NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments.
The regulation has not changed. 32 CFR Part 170, in force since 16 December 2024, still shows its four-phase schedule on eCFR. No amending rule had been published by early October 2026.
The Task Force had 60 days to report to the CIO. Its request for information on SAM.gov closed on 14 August 2026. In September, secondary sources reported that no report had been released. The CIO memo says further guidance will follow in the coming months.
The position is changing, so check the DoD CIO's CMMC page before you rely on any date in this guide.
How does CMMC Level 2 relate to NIST SP 800-171?
Directly. Under 32 CFR 170.14(c)(3), the Level 2 security requirements are identical to those in NIST SP 800-171 Rev 2. There are 110 of them in 14 families. CMMC keeps NIST's numbering inside its own IDs, so requirement 3.1.1 becomes AC.L2-3.1.1.
The levels build on each other. Level 1 covers the 15 safeguarding requirements in FAR 52.204-21 and applies to Federal Contract Information (FCI). Level 2 is the baseline where Controlled Unclassified Information (CUI) is involved.
CMMC did not create the obligation. DFARS 252.204-7012 already required NIST SP 800-171 and cyber incident reporting. DFARS 252.204-7019 and 7020 already required a self-scored Basic Assessment in SPRS, no more than three years old. CMMC adds a CMMC status in SPRS, strict POA&M limits and an annual affirmation by a senior Affirming Official.
Why does CMMC still use Rev 2 when NIST has moved to Rev 3?
NIST withdrew Rev 2 on 14 May 2024, when it published Rev 3. CMMC still uses Rev 2 because 32 CFR 170.2 incorporates it by name and date: February 2020, with updates to 28 January 2021. The July 2026 memos also name Rev 2 as the interim baseline.
Rev 3 is organised into 17 families. By AGS's count of the NIST document, it has 130 requirement identifiers, of which 33 are withdrawn or folded into others, leaving 97.
A CMMC move to Rev 3 is planned, not in force. The Unified Agenda lists an interim final rule (RIN 0790-AM01) to set a transition period from Rev 2 to Rev 3. Its target was July 2026, and it had not been published by early October 2026.
How is a Level 2 self-assessment scored, and when is a POA&M allowed?
You start at 110. Each requirement that is NOT MET deducts 5, 3 or 1 point, and the total can go negative. DOJ gives the possible range as -203 to 110. Multifactor authentication (IA.L2-3.5.3) shows the weighting: it costs 3 points if used only for remote and privileged users, and 5 if absent.
MET has a strict meaning. Evidence must be in final form, so drafts, working papers and unapproved policies do not count. An enduring exception counts as MET only if the SSP describes it. A requirement that does not apply also counts as MET.
| Item | Level 2 (Self) rule | Source |
|---|---|---|
| Requirements | 110 NIST SP 800-171 Rev 2 requirements in 14 families, assessed under NIST SP 800-171A | 32 CFR 170.14(c)(3), 170.16(a) |
| Frequency | Self-assessment every 3 years, affirmation every year | 32 CFR 170.16(a), 170.22 |
| Scoring | Maximum 110. Each NOT MET item deducts 5, 3 or 1 point | 32 CFR 170.24(c)(2) |
| Conditional status with a POA&M | Score of at least 88 out of 110 | 32 CFR 170.21(a)(1) |
| Items allowed on a POA&M | 1-point items only, plus SC.L2-3.13.11 where encryption is used but not FIPS-validated | 32 CFR 170.21(a)(2) |
| Never on a POA&M | AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4 (the SSP), PE.L2-3.10.3, PE.L2-3.10.4, PE.L2-3.10.5 | 32 CFR 170.21(a)(2)(iii) |
| POA&M closeout | Within 180 days, or the Conditional status expires | 32 CFR 170.16(a)(1)(ii), 170.21(b) |
| Current at award | Conditional status up to 180 days old. Final status up to 3 years old, with an affirmation up to 1 year old | DFARS 252.204-7021(a) |
An expired Conditional status makes the contractor ineligible for new awards at that level, and standard contractual remedies apply to current contracts.
What do government assessors and DOJ look at first?
- A System Security Plan that exists and is current. CA.L2-3.12.4 can never sit on a POA&M. MORSECORP, which agreed to pay $4.6 million in March 2025 to settle False Claims Act allegations, admitted it had no consolidated SSP from January 2018 to January 2021.
- An honest SPRS score. MORSECORP posted 104 in January 2021. A consultant later found -142, and the score was not updated until June 2023, after a subpoena.
- A score that survives a government check. DCMA's DIBCAC can assess a self-assessed contractor under DFARS 252.204-7020, and its result overrides the self-declared status. LOGZONE agreed to pay $507,144 in June 2026 after a DCMA assessment scored it at -170.
- A defined scope. Assets must be categorised before the assessment starts (32 CFR 170.19).
- Flow-down. Subcontractors handling CUI need at least Level 2 (Self), and those handling only FCI need Level 1 (Self). They affirm in SPRS before award and every year.
- A diary for affirmations. The DoD CIO says a status lapses if the annual affirmation is missed.
Enforcement did not pause with Phase 2. In September 2026 Honeywell Aerospace agreed to pay $2,042,518 over alleged NIST SP 800-171 non-compliance on one network. DOJ stated these were allegations only, with no determination of liability.
Does CMMC apply to suppliers outside the United States?
Yes, when the clause is in your contract or subcontract and your systems handle FCI or CUI. The rule's preamble says the requirements apply to international and domestic companies and flow down through the supply chain. It allows no partial exemption for foreign contractors. Any exemption would need a government-to-government arrangement, outside the rule.
For a GCC supplier, three practical points follow. A cloud service holding covered defense information under DFARS 252.204-7012 must meet FedRAMP authorisation or equivalency, and equivalency is available to international organisations. Commenters told DoD that SPRS and PIEE were not designed for foreign address formats, so test your access well before you need to affirm. Export-controlled goods and ITAR obligations sit outside the CMMC rule.
We found no source naming a GCC government arrangement with DoW on CMMC. Gulf frameworks such as Saudi Arabia's NCA ECC-2:2024 or Abu Dhabi's ADHICS are separate obligations, and no government source maps them to CMMC. If your work sits outside the US defence supply chain, our ISO/IEC 27001:2022 guide covers the international standard instead. Related kits are in our information security collection.
How AGS can help
The CMMC Level 2 Compliance Management System (NIST SP 800-171 Revision 2) contains 39 editable Microsoft Word and Excel documents. They include an SSP template with a 110-row implementation status appendix, a POA&M template and register, a policy compendium covering each Rev 2 family, incident response and contingency plans, CUI registers and a readiness assessment. Mapping and evidence matrices cross-reference all 110 requirements. It is documentation to support a Level 2 self-assessment, not an assessment itself.
Frequently asked questions
Is a CMMC Level 2 self-assessment annual?
No. The self-assessment repeats every three years, and the affirmation in SPRS is annual.
Does an existing C3PAO assessment still count?
Yes, if it is current and covers the same assessment scope. Under 32 CFR 170.17, a Level 2 (C3PAO) status also satisfies Level 1 (Self) and Level 2 (Self), the only levels new contracts may designate.
Does CMMC apply to commercial off-the-shelf purchases?
No. 32 CFR 170.3 excludes solicitations for commercially available off-the-shelf (COTS) items only. Other commercial items above the micro-purchase threshold can be covered when the contractor will hold FCI or CUI and the contract sets a CMMC level.
Do I still need an SPRS score while Phase 2 is suspended?
Yes. All Phase 1 self-assessment requirements remain. Where your contract carries DFARS 252.204-7019 or 7020, you need a Basic Assessment in SPRS no more than three years old.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by the US Department of War (Department of Defense), NIST or the US Department of Justice. It is general information, not legal or contracting advice.
Reviewed October 2026. Facts checked against the sources current at publication.
