CMMC 2.0: What It Is and How It Works

CMMC is the Department of Defense’s mechanism for verifying that contractors protect the information the government shares with them. Version 2.0 is the model established in 32 CFR Part 170, published 15 October 2024 and effective that December.

Its defining feature is what it stopped doing. Version 1.0 had five levels, a set of CMMC-unique practices, and maturity processes layered on top of the existing standard. 2.0 removed all three, cut to three levels, and aligned the requirements directly with NIST SP 800-171 — a standard defense contractors already owed under DFARS 252.204-7012 since 2017.

The three levels

Level 1 applies where you handle Federal Contract Information. It carries 17 practices drawn from FAR 52.204-21 and an annual self-assessment with an affirmation. No System Security Plan, no score.

Level 2 applies where you handle Controlled Unclassified Information. It carries all 110 requirements of NIST SP 800-171 Revision 2 across fourteen families, assessed against the 320 objectives in NIST SP 800-171A, with a score posted to SPRS. This is where most serious defense suppliers sit. See Level 2 in detail.

Level 3 applies to a small population handling CUI on the most critical programmes. It adds selected enhanced requirements from NIST SP 800-172 on top of the 110, and is assessed by the government through DIBCAC rather than by a C3PAO. Most readers of this page are not Level 3.

If you are not sure which applies, the test is contractual — see Level 1 vs Level 2.

Why 2.0 simplified rather than tightened

The stated reason was cost and clarity for small businesses. Version 1.0 asked contractors to meet a bespoke DoD model that overlapped imperfectly with a NIST standard they already owed, and to demonstrate process maturity separately from technical control.

By aligning to NIST SP 800-171 directly, 2.0 made the target one thing rather than two. It also meant a contractor who had genuinely complied with 252.204-7012 since 2017 was, in principle, already most of the way there. The uncomfortable discovery for many was how few had.

How the rules fit together

Four instruments, and they do different jobs:

• DFARS 252.204-7012 — the safeguarding obligation. Requires NIST SP 800-171 and 72-hour incident reporting. In force since 2017.
• DFARS 252.204-7019 and 7020 — self-assessment and posting a score to SPRS.
• 32 CFR Part 170 — the CMMC program rule. Defines the levels, assessment types and POA&M eligibility.
• DFARS 252.204-7021 — the contract clause that makes CMMC a condition of award. This is the one currently being removed.

The distinction matters right now: the suspension reached the fourth instrument and left the first three intact.

What 2.0 kept from 1.0

Three things survived the redesign, and they are the parts people most often assume were simplified away. The first is the third-party assessment ecosystem: the Accreditation Body, the C3PAOs it authorises, and the certified assessor and professional roles beneath them all carried over. The second is the tiered trigger — the level you owe is still determined by the sensitivity of what the government gives you, not by your size or revenue. The third is flow-down: a prime that passes covered information to a subcontractor passes the obligation with it, and 2.0 made that more explicit rather than less. See flow-down requirements.

What 2.0 also introduced, and 1.0 did not permit at all, is the conditional status. Under 32 CFR 170.21 an organisation can reach conditional Level 2 with a score of at least 88 of the 110, provided the outstanding items are eligible for deferral and are closed within 180 days. That single provision changed the economics of the programme more than any other change in the rule, because it turned a pass/fail gate into a deadline — but it applies only to gaps the rule allows to be deferred, and several of the most commonly failed requirements are not among them.

Where the program stands

On 13 July 2026 the Department of War suspended CMMC Phase 2, including the third-party assessment requirements due to begin on 10 November. On 3 September, Class Deviation 2026-O0025 Revision 3 turned that into a binding instruction to contracting officers.

32 CFR Part 170 was not repealed and a CMMC Reform Task Force is reviewing the program. What remains fully in force is the part with teeth: safeguarding under 7012, self-assessment and SPRS reporting under 7019 and 7020, and NIST SP 800-171 Revision 2 itself.

The practical reading is that CMMC as a certification regime is paused, and CMMC as a set of security requirements is not. See program status for the current position, and SPRS scoring for the number that now carries the weight.