Cybersecurity · Defense contractors
Which CMMC level applies to you, where the paused Phase 2 rollout stands, and what to do first if a prime is asking.
FCI means Level 1
CUI usually means Level 2
Start with scope and SPRS
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense program that checks whether contractors protect government information. As of 2026, a small subcontractor that only handles Federal Contract Information (FCI) needs Level 1: 15 basic safeguards, an annual self-assessment and an annual affirmation in the government’s SPRS system. A subcontractor that handles Controlled Unclassified Information (CUI), such as technical drawings or specifications marked CUI, needs Level 2: the 110 requirements of NIST SP 800-171, assessed either by yourself or by an authorized third party (C3PAO), depending on the contract.
CMMC clauses began appearing in contracts on November 10, 2025. Phase 2, which would have made Level 2 third-party certification a condition of award from November 10, 2026, was suspended on July 13, 2026 while the department reviews the program. Self-assessments, SPRS affirmations and the NIST SP 800-171 obligations in existing DFARS clauses still apply, so if you touch CUI, the work does not change. This is general information; confirm your contract requirements with your prime and counsel.
For FCI only. 15 requirements from FAR 52.204-21, such as limiting system access, using passwords, updating software and protecting against malware. Annual self-assessment, scored met or not met, with no open action items allowed. Annual affirmation in SPRS.
For CUI. 110 requirements from NIST SP 800-171 Rev. 2. Self-assessment or C3PAO assessment every three years, depending on the contract, with annual affirmations. A limited plan of action (POA&M) is allowed if you score at least 88 of 110, closed within 180 days.
For the most sensitive CUI programs. Level 2 certification plus 24 requirements from NIST SP 800-172, assessed by the government’s DIBCAC. Few small subcontractors will need it.
The level is set by the contract, and primes flow the requirement down to subcontractors that receive FCI or CUI. If a prime sends you drawings marked CUI, you inherit the Level 2 requirement for the systems that handle them.
As of early October 2026, no outcome of the review had been announced. Level 1 and Level 2 self-assessments, SPRS scores and annual affirmations, and DFARS 252.204-7012 with its NIST SP 800-171 requirements remain in effect.
Assessor capacity was limited before the pause, with industry reports describing lead times of several months for C3PAO assessments, and remediation for a business starting from scratch often takes many months before an assessor is booked. Plan backwards from the contracts you want to bid on, and assume some form of third-party assessment may return. Many primes also ask suppliers for their SPRS status well before a bid, so a missing or weak entry can cost you work before any assessment is formally due.
Not sure how far your current setup is from Level 1 or Level 2? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, backups and business continuity as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
This question decides almost everything, and many small shops get it wrong in both directions.
Keep the prime’s answer on file. It defines your scope and is the first thing an assessor or a future prime will ask about.
For a 20-person machine shop or engineering firm handling only FCI, Level 1 is achievable with good basic IT hygiene:
These overlap closely with what our cybersecurity services already cover. Level 2 adds much more: audit logging, incident response, configuration baselines, security awareness training, encryption validated to federal standards and thorough documentation.
JLB USA provides managed IT and security for businesses with roughly 25 to 100 employees and can work alongside an existing IT person. We are not a C3PAO and do not perform certification assessments, but we can help you understand where you stand and do the technical work that gets you ready.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Yes, if you receive Federal Contract Information or Controlled Unclassified Information under a DoD contract. Primes flow the requirement down, and the contract sets the level.
Level 1 if you only handle Federal Contract Information. Level 2 if you handle Controlled Unclassified Information. Level 3 is reserved for a small number of high-priority programs.
No. The Department of War suspended the Phase 2 requirements on July 13, 2026 and opened a review. As of early October 2026 no outcome had been announced. Level 1 and Level 2 self-assessments, SPRS affirmations and DFARS 252.204-7012 still apply.
Level 1 is always a self-assessment with annual affirmation. Level 2 may be a self-assessment or a C3PAO assessment, depending on the contract, although third-party (C3PAO) requirements are on hold while Phase 2 is suspended. Self-assessment scores are posted in SPRS.
It depends on your starting point and scope. Businesses starting from scratch often need many months of remediation and documentation before an assessment, and assessor availability adds lead time.
