The Department of Defense's Cybersecurity Maturity Model Certification (CMMC) Program is set out in 32 CFR part 170, which says DoD is utilizing a phased approach for the inclusion of CMMC Program requirements in solicitations and contracts 1.
Phase 1 begins on the effective date of the complementary 48 CFR part 204 CMMC Acquisition final rule, and in it DoD intends to include the requirement for CMMC Statuses of Level 1 (Self) or Level 2 (Self) for all applicable DoD solicitations and contracts as a condition of contract award 2.
Phase 2 begins one calendar year following the start date of Phase 1; in addition to Phase 1 requirements, DoD intends to include the requirement for CMMC Status of Level 2 (C3PAO) for applicable DoD solicitations and contracts as a condition of contract award 3.
That complementary acquisition rule is the DFARS final rule DoD published to incorporate contractual requirements related to the final CMMC program rule 4, and it is effective November 10, 2025 5. Phase 1 therefore began on that date.
A Level 2 certification assessment is done by an outside assessor: the organization seeking certification (OSC) must obtain a Level 2 certification assessment from an authorized or accredited C3PAO 6.
Which level applies
The level is a contract term, not a choice you make. The DFARS CMMC clause requires a CMMC status at the CMMC level required in the clause's paragraph (d)(1), or higher 7. For subcontractors, it looks to the CMMC level that is appropriate for the information that is being flowed down to the subcontractor 8.
Part 170 spells out the flow-down. Prime contractors shall comply and shall require subcontractors to comply with and to flow down CMMC requirements, with the applicable CMMC level and assessment type for each subcontract 9. A subcontractor that will only process, store or transmit FCI, and not CUI, needs a CMMC Status of Level 1 (Self) 10. One that will process, store or transmit CUI needs at least Level 2 (Self) 11, and at least Level 2 (C3PAO) when the associated prime contract requires Level 2 (C3PAO) 12.
What you may already be doing
It helps to know the safeguarding clauses you may already have. FAR 52.204-21's first basic safeguarding requirement is to limit information system access to authorized users, processes acting on behalf of authorized users, or devices 13. The DFARS covered defense information clause applies NIST SP 800-171, "Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations" 14.
Planning the assessment
Worked example. Contractor Q sees that an upcoming solicitation names a Level 2 certification assessment. Q has done only its own review against NIST SP 800-171. It reads 32 CFR 170.17, arranges the assessment that section describes, closes the gaps its own review found, and gathers its system security plan and evidence before the assessors arrive.
Indented paragraphs are invented worked examples. Tool links open Bids2Bank and need a free account.