A prime just told your subcontractor business it needs to meet CMMC 2.0 requirements, and the notice didn’t come with an explanation. Now you’re trying to figure out what it requires before it holds up your next contract.
CMMC 2.0 verifies that companies handling defense-related information protect it properly. The Department of War built it to cover the entire supply chain, not just prime contractors. If a prime flowed a CMMC requirement down to you, your work touches information the government wants protected. The government wants proof now, not just an assurance.
Three levels make up the framework. Which one applies depends on what kind of information you handle, not your company’s size or how long you’ve held the contract.
What CMMC 2.0 Is and What It Requires
CMMC 2.0 started rolling out in phases on November 10, 2025, replacing a more complicated original version. Each level pairs a category of information with its own security requirements. Most of those requirements come from federal standards your business already meets, even without knowing them by name.
The framework formalizes practices most working IT environments already use, like access controls, system monitoring, and incident response. Where CMMC adds weight is the paperwork. You document those practices, and at some levels, prove them to an outside assessor.
The Three CMMC 2.0 Levels and What Each One Covers
According to DoD’s own program structure, each level maps to a distinct category of information, running from the most common at Level 1 to the most sensitive at Level 3.
Level 1 — Basic Safeguarding of FCI
Level 1 covers Federal Contract Information (FCI), the baseline category for most government-related information that isn’t meant for public release. It carries 15 requirements from FAR 52.204-21, and you verify them yourself through an annual self-assessment. No outside assessor gets involved anywhere in the process. Your company confirms its own compliance and attests to it directly.
Level 2 — Broad Protection of CUI
Controlled Unclassified Information (CUI) triggers Level 2, a more sensitive category that demands stronger protection. This level carries 110 requirements based on NIST SP 800-171 Revision 2. Depending on your contract, you either self-assess or bring in a third-party assessor called a C3PAO for certification.
Either path checks against the same 110 requirements. Only the assessor changes.
Level 3 — Enhanced Protection Against Advanced Threats
Level 3 covers the most sensitive CUI, usually tied to programs facing the highest-priority threats. It carries 134 requirements, and the Defense Industrial Base Cybersecurity Assessment Center handles the assessment directly, not a third-party firm. Few subcontractors land here. If your work touches a high-priority program, confirm it rather than assume you don’t.
What the 2026 CMMC Phase 2 Pause Changes and What It Doesn’t
The Department of War suspended the move to Phase 2 on July 13, 2026, before it could make third-party C3PAO certification mandatory. That requirement was set to kick in on November 10, 2026. Now it’s on hold while a 60-day Reform Task Force reviews the program.
| What paused | What didn’t |
|---|---|
| Mandatory third-party (C3PAO) certification for Level 2 | Phase 1 self-assessment for Levels 1 and 2 |
| DFARS clause 252.204-7012 obligations |
This isn’t the first time federal cybersecurity policy has shifted under contractors’ feet either. Similar timing uncertainty played out when the CISA furlough put businesses at risk earlier this year, and the lesson held then too — a paused federal process doesn’t pause your actual exposure.
Don’t read the pause as room to wait. A prime telling you CMMC applies to your contract was true on July 12, and it’s still true now. The underlying standard never moved.
Primes know that, and they’re still flowing requirements down to subcontractors on their own timeline. The federal calendar doesn’t set their pace.
How to Tell Which CMMC Level Applies to Your Business
CCIO can’t tell you which level applies to your business without knowing your specific contract. No legitimate assessment works that way. What we can walk you through is the set of questions that narrows it down, so you’re not guessing when a prime asks.
Work through these against your actual contract:
- Does your contract involve information the government generated or provided, unclassified but not meant for public release? That points to FCI, and likely Level 1.
- Does your contract require handling Controlled Unclassified Information, something your contracting officer or prime should confirm directly? That points to Level 2.
- Is your work tied to a program flagged as high-priority or high-threat, beyond standard CUI handling? Have that conversation directly before assuming Level 3 doesn’t apply.
- Has your prime specified a level explicitly in a data requirements sheet or contract clause? That documentation beats any guess based on the questions above.
Landing on Level 2 doesn’t automatically mean a third-party assessment either. Self-assessment and C3PAO certification check the same set of requirements, just through a different assessor.
Still unsure after working through that list? That’s common, and a direct conversation resolves it faster than more research will.
Matching Your Next Step to What Your Business Needs
CMMC compliance is one item on a long list of small business tech problems in 2026, and matching your next step to your actual level keeps this from turning into a bigger project than it needs to be. Match your next step to the level that applies to you, not the most cautious option available or the cheapest one.
If You’re Likely a Level 1 Business
Confirm your current practices meet the 15 FAR-based requirements, document them, and complete the annual self-assessment. Most businesses manage this without a large compliance investment, especially if existing IT support already handles access controls and basic monitoring. Documentation and a few targeted fixes cover most of the work here, not a system overhaul.
If You’re Likely Level 2 or Higher
Level 2 and Level 3 businesses face a heavier lift. NIST SP 800-171 covers 110 requirements, and even the self-assessment path demands real evidence, not a checklist filled out from memory. Building and documenting 110 controls without prior compliance experience eats far more time than most subcontractors have to spare on their own. Outside compliance alignment tends to earn its cost back fast here.
Getting the Right Kind of Help for Where You Stand
You don’t need to solve this today. You don’t need to guess your way through a self-assessment a prime is going to scrutinize. Get a clear read on where your business sits, based on your actual contract, not a generic guide written for every level at once.
Our team handles that compliance alignment work directly, walking through your specific exposure and building toward whatever level your contracts require. If you’re still sorting out where you land, talk it through with us before you guess wrong on something a prime is counting on.
