CMMC. SMALL DEFENSE SUPPLIERS. PLAIN READING.
Your contract has a DFARS clause. What will you do to keep it?
CMMC has been a condition of Department of War contracts since November 10, 2025. If your shop cuts, welds, coats, tests, assembles or designs anything that ends up in a defense program, the clause reaches you through your prime. Below: what the rule asks, what changed in July 2026, the five things to do in order, where in-kind grants exist, and who can do the work with you.
NIST SP 800-171 REV 2 · 32 CFR PART 170 · DFARS 252.204-7021
Ask the panel. It answers from this site only, in plain words. Nothing you type leaves your browser.
- 110requirements at Level 2NIST SP 800-171 Rev 2, 14 families
- 320assessment objectivesNIST SP 800-171A, each one checked
- November 10, 2025the clause entered contractsDFARS 252.204-7021, Phase 1
- 15requirements at Level 1FAR 52.204-21, FCI only
01 / WHAT IT IS
Three levels. Your information decides which one is yours.
The Cybersecurity Maturity Model Certification is the Department of War's way of checking that its suppliers protect the information it gives them. The rule is 32 CFR Part 170. You do not pick a level. The contract names it, and it names it from the kind of information you handle.
LEVEL 1
Federal Contract Information
15 basic safeguards from FAR 52.204-21. You assess yourself once a year, post the result in SPRS, and a senior official affirms it.
Self-assessment, yearly
LEVEL 2
Controlled Unclassified Information
The 110 requirements of NIST SP 800-171 Rev 2, in 14 families. Drawings, specifications and technical data put most small suppliers here.
Self-assessment, or a certified assessor when the contract says so
LEVEL 3
The most sensitive programs
All of Level 2 plus 24 enhanced requirements from NIST SP 800-172, assessed by the government itself. A small group of contractors.
Government assessment
02 / WHY IT IS HERE
A proposal for years. A contract clause since November 10, 2025.
The program rule, 32 CFR Part 170, took effect on December 16, 2024. The contracting rule followed, and on November 10, 2025 the clause DFARS 252.204-7021 began appearing in new solicitations and contracts. That was Phase 1 of four. On July 13, 2026 the Department suspended the Phase 2 transition pending a review. The self-assessment, the SPRS score and the affirmation were not suspended.
- PHASE 1November 10, 2025Level 1 and Level 2 self-assessments as a condition of award. In force.
- PHASE 2Planned November 10, 2026Third-party Level 2 certification. Suspended July 13, 2026, pending the Department's review.
- PHASE 3Planned November 10, 2027Third-party Level 2 on applicable awards and option periods. Level 3 begins.
- PHASE 4Planned November 10, 2028Every applicable solicitation and contract.
03 / THE RULE
What Level 2 asks, read off the instrument.
Level 2 is 110 security requirements in 14 families. An assessment checks them against 320 objectives, one at a time, and the result is a score from 110 down to minus 203. The score goes into SPRS. A senior official affirms it at each assessment and every year after.
Most of the work is not buying tools. It is writing down how each requirement is met, collecting evidence that builds up over weeks, and keeping it true after the assessment. Two families, Access Control and System and Communications Protection, hold more than a third of the requirements between them.
The rule, drawn: the 110 requirements, the 14 families, the 320 objectives. The film's text is listed below it.
Read the film's text
- CMMC Level 2 for the Defense Industrial Base
- Keep the contract that requires CMMC.
- 110 security requirements. NIST SP 800-171 Rev 2.
- 14 families: AC 22, AT 3, AU 9, CM 9, IA 11, IR 3, MA 6, MP 9, PS 2, PE 6, RA 3, CA 4, SC 16, SI 7.
- 320 assessment objectives. NIST SP 800-171A. Each one is assessed.
- Where you stand today. What is missing. Who does the work to close it.
- Capital Cyber Compliance. CMMC Level 2 for the Defense Industrial Base. Self-assessment · 110 controls · NIST SP 800-171.
04 / WHAT TO DO
Five steps. This order, no other.
Every small supplier that has got through this did the same five things in the same order. None of them starts with a purchase.
STEP 1
Find your CUI
Which machines, accounts, people and services hold controlled information. That is your scope. Everything else stays out.
STEP 2
Get a gap assessment
All 110 requirements checked against your real scope. Where you stand, in writing, before anyone signs.
STEP 3
Write the SSP and the POA&M
The System Security Plan says how each requirement is met. The plan of action says who closes each gap and by when.
STEP 4
Post your SPRS score
The score from the assessment goes into the Supplier Performance Risk System, and a senior official affirms it.
STEP 5
Self or certified
Which assessment your contract asks for, and what the July 2026 suspension means for it.
05 / IN-KIND GRANTS
Small shop, no budget line for this? Start with the grant.
Cyber Grants Alliance is a nonprofit that awards in-kind cybersecurity grants to small suppliers and organizations. A grant is the work itself, done for you, including a CMMC Level 1 or Level 2 gap assessment. No cost to you, and no obligation to buy anything afterward, from anyone.
06 / WORK WITH US
Who does the work.
This site is published by Capital Cyber, a Leesburg, Virginia firm that takes small and mid-sized defense contractors through CMMC Level 2: the scope, the gap assessment, the System Security Plan and policies, and the evidence an assessor asks for. The practice is at Capital Cyber Compliance. The ways to reach us are on Work with us.
BOOK A CALL
Thirty minutes. Bring the clause.
Pick a time. If you have the contract or the purchase order, have it open. We will read the clause with you and tell you which level it names and what to do first.
Find out where you actually stand.
A gap assessment checks all 110 requirements against your real scope and gives you the SPRS score you would post today. That number starts everything else.
Grant application at Cyber Grants Alliance. Compliance practice at Capital Cyber Compliance.