CMMC Rule News Today: Secure Your Defense Contract Path

CMMC rule news today shows Phase II paused while Phase I self assessments stay active for all defense contractors

This guide provides a durable reference for defense contractors navigating the current state of the Cybersecurity Maturity Model Certification (CMMC) program. It details the regulatory timeline, the specific requirements for each compliance level, and the practical steps required to secure your path to award. It is written for business owners, compliance officers, and IT leaders at small and mid-sized businesses who need to understand their obligations under 32 CFR Part 170 and the associated DFARS clauses.

Key Takeaways

• The CMMC Program rule took effect on December 16, 2024, and the acquisition rule took effect on November 10, 2025, establishing the legal basis for mandatory certification.
• On July 13, 2026, the DoD CIO suspended the November 10, 2026 Phase II deadline, pausing later milestones while keeping Phase I self-assessments active.
• CMMC Level 2 requires compliance with all 110 practices of NIST SP 800-171 Revision 2 and a third-party assessment by a C3PAO for most programs.
• Only a C3PAO can issue a CMMC Level 2 certificate; Registered Provider Organizations (RPOs) prepare contractors but cannot conduct the final assessment.
• A typical Level 2 readiness engagement runs 12 to 14 weeks, involving discovery, gap analysis, remediation, and a readiness handoff.

Understanding the Current CMMC Rule News Today

Searchers looking for CMMC rule news today often seek clarity on whether deadlines have shifted. The regulatory landscape has stabilized after a period of transition. The CMMC Program rule, codified in 32 CFR Part 170, was published on October 15, 2024, and took effect on December 16, 2024. This rule established the three-level model that simplified the original five-level framework. Level 1 covers Federal Contract Information (FCI), Level 2 covers Controlled Unclassified Information (CUI), and Level 3 adds selected controls from NIST SP 800-172 for the most sensitive information.

The acquisition rule, found in DFARS 252.204-7021, was published in the Federal Register on September 10, 2025, and took effect on November 10, 2025. This rule mandates that contractors hold a valid CMMC certificate at the specified level before contract award. However, the most significant recent development occurred on July 13, 2026. On this date, the DoD CIO announced the suspension of the November 10, 2026 Phase II deadline. This suspension pauses later milestones until further notice. Crucially, Phase I self-assessments remain in force. Contractors must continue to perform annual self-assessments and submit senior official affirmations to DoD. This pause does not eliminate the requirement for security; it adjusts the timeline for third-party certifications.

For businesses, this means the urgency to prepare has not diminished. The DoD estimates that 220,966 entities are in scope for CMMC. As of March 2026, there were 103 authorized C3PAOs. Level 2 certifications grew from 773 in January 2026 to 1,391 in May 2026. These numbers indicate a growing ecosystem of certified assessors, but also a competitive landscape where early preparation provides a strategic advantage. The suspension of the Phase II deadline gives contractors more time to remediate gaps, but it does not stop the flow-down of security requirements in new solicitations.

Breaking Down the Three CMMC Levels

CMMC 2.0 aligns its levels with the sensitivity of the information handled. Understanding which level applies to your contracts is the first step in compliance. The requirements differ significantly in terms of assessment method, frequency, and scope.

Level 1: Protecting Federal Contract Information

Level 1 applies to contractors handling Federal Contract Information (FCI). It requires 15 basic safeguarding requirements derived from FAR 52.204-21. Contractors at this level must perform an annual self-assessment and submit an annual senior official affirmation to DoD. There is no third-party assessment required for Level 1. This level is foundational and applies to nearly all DoD contractors.

Level 2: Protecting Controlled Unclassified Information

Level 2 applies to contractors handling Controlled Unclassified Information (CUI). This is the most common level for mid-sized defense contractors. It requires compliance with all 110 practices of NIST SP 800-171 Revision 2, organized into 14 domains. For most programs, a C3PAO must conduct a third-party assessment. Reassessment is required every three years, and an annual senior official affirmation is still required. The C3PAO submits results to eMASS, and the certificate is stored in the Supplier Performance Risk System (SPRS).

Level 3: Protecting Controlled Unclassified Information

Level 3 applies to the most sensitive CUI. It adds selected controls from NIST SP 800-172 on top of the Level 2 requirements. Unlike Level 2, Level 3 is assessed by the government, specifically by the Defense Contract Management Agency (DCMA) through DIBCAC, not by a C3PAO. This level is reserved for high-risk environments.

Level	Information Type	Controls	Assessment Method	Frequency
Level 1	FCI	15 FAR 52.204-21 requirements	Self-Assessment	Annual
Level 2	CUI	110 NIST SP 800-171 Rev 2	C3PAO Third-Party	Triennial
Level 3	CUI	NIST SP 800-172 + Level 2	Government (DCMA)	As Required

A critical distinction is that only a C3PAO can issue a CMMC Level 2 certificate. An RPO, such as Petronella Technology Group, Inc., can prepare a contractor but cannot conduct the assessment or issue the certificate due to Cyber AB independence rules. The list of authorized C3PAOs is maintained at cyberab.org/marketplace. Contractors must ensure they are working with authorized assessors to avoid invalid certifications.

Regulatory Requirements and DFARS Clauses

Compliance with CMMC is not just about the certification itself; it is embedded in the contract clauses. DFARS 252.204-7012 requires adequate security, defined as the 110 controls of NIST SP 800-171, on every covered contractor information system. This clause must be flowed down to subcontractors when performance involves covered defense information. Subcontractors must report their own incidents to DoD and provide the report number to the next higher tier.

Cyber incident reporting is a strict requirement. A cyber incident affecting covered defense information must be reported to DoD within 72 hours of discovery through the DoD reporting portal at dibnet.dod.mil. This portal requires a DoD-approved medium assurance certificate obtained in advance. After a reported incident, the contractor must preserve images of affected systems and monitoring data for at least 90 days, submit isolated malicious software to the government, and hold cloud providers to a FedRAMP Moderate baseline.

DFARS 252.204-7019 requires a current NIST SP 800-171 assessment summary score in SPRS when an offer is submitted. The SPRS self-assessment score ranges from minus 203 to 110, with controls carrying 1, 3, or 5 point weights. DFARS 252.204-7020 governs how the assessment is conducted under the DoD Assessment Methodology and gives DoD access to verify it. When DFARS 252.204-7021 appears in a contract or solicitation, the contractor must hold a valid CMMC certificate at the specified level before award. These clauses create a legal obligation to maintain security posture continuously, not just at the time of assessment.

POA&Ms are allowed only for "not met" requirements within the limits of 32 CFR 170.21, with a 180-day closeout. This means that gaps cannot be ignored; they must be remediated within a strict timeframe. The DoD CIO FAQ clarifies that encrypted CUI is still CUI, and encrypted CUI in a cloud still needs FedRAMP Moderate or equivalency. VDI endpoints are out of scope only in a KVM-only configuration. These clarifications are essential for accurate scoping.

Strategic Path to Certification

Preparing for CMMC Level 2 is a structured process. A typical CMMC Level 2 readiness engagement runs 12 to 14 weeks for a mid-size contractor. The path from gap assessment to C3PAO-ready typically takes 6 to 18 months depending on starting security posture and CUI environment complexity. The engagement is divided into four phases: Discovery (week 1), Gap Analysis (weeks 2-4), Remediation Sprint (weeks 5-12), and C3PAO Readiness Handoff (weeks 13-14).

One of the biggest drivers of quote variance and timeline length is the scope of the CUI environment. Enclaving CUI into a narrowly scoped boundary, such as a GCC High tenant or a dedicated cloud landing zone, keeps the 110 controls from applying across the entire enterprise network. This strategy reduces audit surface, shortens timelines, and lowers ongoing cost. Contractors should evaluate their current architecture to determine if enclaving is a viable option. This decision should be made early in the discovery phase.

CMMC compliance is continuous. The System Security Plan (SSP) is a living document, and the Plan of Action and Milestones (POA&M) is reviewed at least quarterly. Re-assessment occurs every three years. Most clients continue under a maintenance retainer covering quarterly control reviews, policy refresh, training, and incident response capacity. The SSP must cover all 110 NIST SP 800-171 controls with owners and evidence pointers. Deliverables also include 14 control-family policies, an incident response plan, an acceptable use policy, a media protection policy, a live POA&M, a mock assessment using the Cyber AB CMMC Assessment Process (CAP), a baselined SPRS score, and a C3PAO shortlist with warm introductions.

For contractors seeking to navigate this complex landscape, partnering with an experienced RPO is critical. Petronella Technology Group, Inc. is a Cyber AB Registered Provider Organization, RPO #1449. Every engineer assigned to a defense client holds the CMMC Registered Practitioner (CMMC-RP) credential. The firm does not perform Level 2 assessments for clients it has prepared, ensuring full independence. To begin your assessment, you can review our CMMC consultant services or explore the broader compliance hub for related resources. Understanding the CMMC compliance requirements is the first step toward securing your defense contract path.

Step-by-Step Implementation Plan for CMMC Readiness

Building a compliant environment is a structured process that requires disciplined execution. Based on our experience with mid-size contractors, a typical Level 2 readiness engagement runs 12 to 14 weeks. This timeline assumes a defined scope and active management commitment. The following sequence outlines the critical phases we follow to move a client from discovery to a C3PAO-ready state.

1. Discovery and Scoping (Week 1): We begin with a detailed conversation to map your environment. This phase identifies where Controlled Unclassified Information (CUI) resides and determines the boundary of your system. Enclaving CUI into a narrowly scoped boundary, such as a GCC High tenant or a dedicated cloud landing zone, is a critical decision made here. This step reduces audit surface and prevents the 110 controls of NIST SP 800-171 from applying across your entire enterprise network.
2. Gap Analysis (Weeks 2-4): We assess your current controls against the 110 practices of NIST SP 800-171 Revision 2. The output is a prioritized list of gaps. We rank these by risk and effort to create a realistic remediation roadmap. This analysis also identifies where you may need a Plan of Action and Milestones (POA&M) for requirements that are "not met" but within the limits of 32 CFR 170.21.
3. Remediation Sprint (Weeks 5-12): This is the heavy lifting. We implement technical controls and draft the necessary documentation. Key deliverables include a System Security Plan (SSP) covering all 110 controls with owners and evidence pointers, 14 control-family policies, an incident response plan, and an acceptable use policy. We also ensure your cryptography meets the FIPS-validated requirement for protecting CUI confidentiality.
4. C3PAO Readiness Handoff (Weeks 13-14): Before the formal assessment, we conduct a mock assessment using the Cyber AB CMMC Assessment Process (CAP). This simulates the actual audit environment. We finalize your POA&M, ensuring any open items have a 180-day closeout plan. We then provide a shortlist of authorized C3PAOs with warm introductions, as only a C3PAO can issue a CMMC Level 2 certificate.

Remember that CMMC compliance is continuous. The SSP is a living document, and the POA&M is reviewed at least quarterly. Re-assessment occurs every three years, so the work does not stop at certification.

Common Mistakes in CMMC Assessments and How to Avoid Them

After preparing numerous contractors, we see the same recurring errors that delay certification or lead to failed assessments. Avoiding these pitfalls can save months of work and significant resources.

• Over-scoping the System: Many organizations attempt to bring their entire network into the CMMC boundary. This is inefficient and costly. If you handle CUI, you must protect it, but you do not need to apply all 110 controls to systems that do not touch CUI. Enclaving CUI into a specific boundary is the most effective way to manage scope and cost.
• Ignoring the Incident Reporting Requirement: DFARS 252.204-7012 requires that any cyber incident affecting covered defense information be reported to DoD within 72 hours of discovery. This report must go through the DoD reporting portal at dibnet.dod.mil. Crucially, this portal requires a DoD-approved medium assurance certificate obtained in advance. If you have not secured this certificate before an incident occurs, you cannot report it, which is a critical compliance failure.
• Using Unvalidated Cryptography: NIST SP 800-171 requires FIPS-validated cryptography to protect the confidentiality of CUI. Strong encryption that is not FIPS-validated does not meet the requirement. Ensure all encryption mechanisms in your CUI boundary are FIPS-validated.
• Misunderstanding the Role of the RPO: A Registered Provider Organization (RPO) like Petronella Technology Group, Inc. prepares you for the assessment. We cannot conduct the assessment or issue the certificate. Only a C3PAO can do that. If a provider promises a "guaranteed pass" or offers to perform the assessment themselves, they are violating Cyber AB independence rules. We do not perform Level 2 assessments for clients we have prepared.
• Neglecting Subcontractor Flow-Downs: DFARS 252.204-7012 must be flowed down to subcontractors when performance involves covered defense information. Subcontractors must report their own incidents to DoD and provide the report number to the next higher tier. Ensure your contracts reflect this requirement.

Proactive planning and clear understanding of these rules prevent most assessment failures. For a detailed breakdown of these requirements, see our CMMC Compliance Guide.

How to Choose a CMMC Compliance Provider

Selecting the right partner is critical. The CMMC ecosystem is new, and not all providers have the same depth of experience. When evaluating a provider, ask these specific questions to ensure they can deliver a compliant outcome.

• Do your practitioners hold the CMMC-RP credential? Every engineer assigned to your defense client should hold the CMMC Registered Practitioner (CMMC-RP) credential. This ensures they are trained and certified in the current CMMC standards. At Petronella Technology Group, Inc., every engineer on our compliance team holds this designation, not just the principal.
• Are you an RPO, and do you understand the independence rules? A legitimate RPO will clearly state that they cannot perform the Level 2 assessment for clients they have prepared. This is a strict Cyber AB rule. If a provider blurs this line, they are not following the program rules.
• What is your approach to scoping? A competent provider will prioritize enclaving CUI to reduce audit surface. They should discuss how to define your system boundary to include only the necessary assets. This approach shortens timelines and lowers ongoing costs.
• Do you provide a mock assessment? A mock assessment using the Cyber AB CMMC Assessment Process (CAP) is essential for readiness. It identifies gaps that a simple checklist might miss. Ensure the provider includes this in their engagement scope.
• What is your post-certification support model? CMMC is continuous. Ask about their maintenance offerings, such as quarterly control reviews, policy refresh, and incident response capacity. The SSP is a living document, and the POA&M requires quarterly review. A provider who disappears after certification is not a long-term partner.

For a comprehensive list of questions to ask, refer to our CMMC Compliance Checklist 2026.

How Petronella Technology Group, Inc. Helps

Petronella Technology Group, Inc. is a Cyber AB Registered Provider Organization, RPO #1449. We specialize in helping regulated businesses and defense contractors handle the CMMC program. Our approach is grounded in practitioner experience and strict adherence to program rules.

Our team is led by Craig Petronella, who holds the CMMC-RP credential, CCNA, CWNE, NC Licensed Digital Forensic Examiner license #604180, and an MIT AI certificate. He has over 30 years of experience and founded the company in 2002. Every engineer assigned to a defense client holds the CMMC-RP credential, including Blake Rea, Justin Summers, Jonathan Wood, and Craig Petronella.

We deliver CMMC and HIPAA engagements remote-first across all 50 states. Our first step is a free 30-minute scoping consultation run by a CMMC Registered Practitioner. This conversation typically provides enough information to size a fixed-scope quote within two business days. We do not publish a price sheet; instead, we provide custom quotes based on your specific environment and CUI complexity.

Our readiness engagements include a full SSP, 14 control-family policies, an incident response plan, a live POA&M, a mock assessment, and a baselined SPRS score. We also provide a C3PAO shortlist with warm introductions. Because we are an RPO, we cannot perform the Level 2 assessment for clients we have prepared, ensuring full independence and compliance with Cyber AB rules.

Petronella Technology Group, Inc. is BBB accredited with an A+ rating continuously since 2003. Some clients who started with us in 2003 are still clients today. This longevity reflects our commitment to long-term partnership and continuous compliance.

Primary sources for this guide: 32 CFR Part 170 - CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC) PROGRAM, SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems an.

Related reading

• CMMC Compliance: Gap Assessment, Levels 1 to 3
• CMMC Patient Portal Compliance Checklist for Secure Access
• CMMC Phase II Suspended: What Defense Contractors Should Do Now
• CMMC Level 2 Requirements: The Complete 2026 Guide
• CMMC Guidelines for Defense Contract Compliance [2026]

Frequently Asked Questions

What is the current status of the CMMC Phase II deadline?

On 2026-07-13, the DoD CIO announced the suspension of the 2026-11-10 Phase II deadline. Phase I self-assessments remain in force, and later milestones are paused until further notice.

This suspension provides additional time for contractors to prepare, but it does not eliminate the requirement. You should still proceed with your readiness plan, as the program is active and the acquisition rule is in effect.

Can an RPO perform the CMMC Level 2 assessment?

No, an RPO cannot perform the CMMC Level 2 assessment for a client it has prepared. Only a C3PAO can issue a CMMC Level 2 certificate.

This separation is mandated by Cyber AB independence rules. Petronella Technology Group, Inc. prepares clients for the assessment but does not conduct it, ensuring an unbiased evaluation.

How long does it take to become CMMC Level 2 compliant?

A typical CMMC Level 2 readiness engagement runs 12 to 14 weeks for a mid-size contractor. This timeline includes discovery, gap analysis, remediation, and a mock assessment.

The path from gap assessment to C3PAO-ready can take 6 to 18 months depending on your starting security posture and the complexity of your CUI environment. Enclaving CUI can significantly shorten this timeline.

What is the difference between FCI and CUI in CMMC?

FCI (Federal Contract Information) is covered by CMMC Level 1, which requires 15 basic safeguarding requirements from FAR 52.204-21. CUI (Controlled Unclassified Information) is covered by CMMC Level 2, which requires all 110 practices of NIST SP 800-171 Revision 2.

Contractors handling FCI must meet the FAR 52.204-21 baseline. Only contractors that receive or generate CUI take on the full NIST SP 800-171 obligation.

Do I need a POA&M if I am not fully compliant?

Yes, POA&Ms are allowed for "not met" requirements within the limits of 32 CFR 170.21. Each POA&M must have a 180-day closeout plan.

The POA&M is a living document that is reviewed at least quarterly. It demonstrates your commitment to closing gaps and is a critical part of your compliance package.

How do I report a cyber incident under DFARS 252.204-7012?

You must report any cyber incident affecting covered defense information to DoD within 72 hours of discovery through the DoD reporting portal at dibnet.dod.mil.

This portal requires a DoD-approved medium assurance certificate obtained in advance. After reporting, you must preserve images of affected systems and monitoring data for at least 90 days and submit isolated malicious software to the government.

Ready to start your CMMC journey? Call Penny, our AI assistant, at 919-348-4912, or use our contact form to schedule a free scoping consultation.

Get the CMMC Compliance Guide

Free, practical, and specific to regulated environments. We will email it to you.

Send it to me

No spam. Unsubscribe anytime.