CMMC Compliance: The Ins & Outs (2026 Guide)

Key Takeaways

• CMMC is the Department of Defense’s program for verifying that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), built on the 110 security requirements in NIST SP 800-171.
• It applies to any organization in the defense industrial base whose contracts carry the requirement: prime contractors, subcontractors at every tier, and the MSPs that support them.
• There are three CMMC levels, but Level 2 (the full 110 NIST SP 800-171 controls) is the one most contractors need to meet.
• On July 13, 2026, the DoD suspended the planned Phase 2 rollout of mandatory third-party (C3PAO) certification, but Phase 1 self-assessment requirements and existing contract obligations still apply.
• The underlying obligation to prove alignment with NIST SP 800-171 isn’t going away; work done to prepare now still counts, regardless of how the assessment schedule shifts.

What You Need to Know About CMMC

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense’s framework for verifying that companies in the defense industrial base are actually protecting the federal data they handle, specifically FCI and CUI, rather than simply attesting that they do. It applies across the entire supply chain, from large prime contractors down to small subcontractors several tiers removed from the original award.

On July 13, 2026, the DoD suspended the planned transition to CMMC Phase 2, which would have made third-party certification mandatory for most Level 2 contractors starting that November. That suspension changed the enforcement timeline; it didn’t erase the underlying requirements. CMMC compliance requirements tied to Phase 1, along with existing contractual obligations to comply with NIST SP 800-171, remain in force while the DoD reviews the program.

This guide walks through what CMMC actually requires, what changed with the 2026 suspension, and what defense contractors and the MSPs supporting them should be doing right now. We’ll cover who CMMC applies to, the three CMMC levels, the core compliance requirements, how assessments work, how to prepare, and what all of this means specifically for MSPs.

The CMMC Timeline & the 2026 Phase 2 Suspension

CMMC is rolling out in four phases, though where things actually stand in 2026 looks different from where the original schedule intended.

CMMC Implementation Phases

• Phase 1 (November 10, 2025): Level 1 and Level 2 self-assessment requirements began appearing in applicable DoD solicitations and contracts.
• Phase 2 (November 10, 2026): Originally scheduled to add mandatory Level 2 third-party (C3PAO) certification requirements for contracts involving CUI.
• Phase 3 (November 10, 2027): Originally scheduled to add Level 3 government-led assessments.
• Phase 4 (November 10, 2028): Originally scheduled to complete CMMC implementation across all applicable solicitations and contracts.

Phases 2 through 4 are currently paused following the DoD’s July 13, 2026 suspension announcement, and no new date has been set for when they’ll resume.

What the Phase 2 Suspension Means

On July 13, 2026, the DoD suspended the planned rollout of Phase 2, which would have required most contractors handling CUI to obtain a costly third-party C3PAO certification rather than self-assess. The DoD cited concerns about the program’s cost and burden on small and mid-sized businesses, and it established a CMMC Reform Task Force to conduct a 60-day review of the program and issue recommendations.

In the interim, contracting officers may include Level 1 or Level 2 self-assessment requirements in solicitations, but may not require a Level 2 C3PAO certification or a Level 3 government-led assessment.

Importantly, this suspension does not eliminate CMMC requirements already applicable to existing contracts. Phase 1 self-assessment obligations, DFARS 252.204-7012 and 252.204-7019 requirements, NIST SP 800-171 compliance, and SPRS score submissions all continue without interruption.

Contractors should keep meeting their current self-assessment and affirmation obligations, keep their System Security Plan (SSP) and Plans of Action and Milestones (POA&Ms) current, and continue remediating known gaps; the review process is expected to adjust the certification schedule and possibly some program mechanics, not eliminate the underlying security obligations.

It isn’t yet clear when Phase 2 or later phases will resume, so we won’t speculate on a timeline.

The 3 CMMC Levels Explained

CMMC defines three levels, scoped by the sensitivity of the information an organization handles. Your level isn’t a preference; it’s dictated by the contracts you hold or are pursuing.

CMMC Level 1

CMMC Level 1 applies to organizations that handle FCI and consists of 15 basic safeguarding practices drawn from FAR clause 52.204-21. It’s the lightest tier in the model, and it’s verified through an annual self-assessment with a formal affirmation of compliance.

CMMC Level 2

CMMC Level 2 is where most of the market actually lives, because it’s the tier that applies to organizations handling CUI. Level 2 requires implementing all 110 security requirements in NIST SP 800-171, and the assessment path depends on your contract: some Level 2 requirements call for a self-assessment, while others call for third-party certification through a C3PAO.

That third-party rollout is exactly what the DoD suspended in July 2026, so the C3PAO requirement is currently paused for now even though the underlying 110 controls still apply contractually in many cases.

Don’t underestimate the practical lift here. Scoping your environment correctly, building out a System Security Plan (SSP), and assembling the evidence to back up every control turns CMMC Level 2 into a genuine project, not a checklist you fill out in an afternoon.

CMMC Level 3

CMMC Level 3 applies to the highest-sensitivity programs, where the risk of advanced persistent threats is greatest. It builds directly on Level 2, adding a selected set of 24 enhanced requirements from NIST SP 800-172 on top of the full 110 from NIST SP 800-171 (134 controls in total).

Level 3 assessments are government-led, conducted by the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), and, like Level 2’s C3PAO requirement, are currently paused under the same 2026 suspension.

CMMC Level Comparison

How Do You Know Which CMMC Level You Need?

Your required CMMC level comes from three things together: what your contract specifies, the type of information you handle (FCI versus CUI), and your role in the supply chain: prime, subcontractor, or service provider supporting either. DoD contracts increasingly state the required level explicitly.

You can’t choose a lower level because it’s easier, and choosing a higher one than your contracts require just adds unnecessary cost and complexity.

What Are the CMMC Compliance Requirements?

The exact CMMC compliance requirements you need to meet depend on your level. For Level 2, they map directly to the 14 control families in NIST SP 800-171. Rather than walking through all 110 individually, here they are grouped by function; for the complete, authoritative list, go to NIST SP 800-171 itself.

Access Control, Identity & Authentication

This family covers least privilege, multi-factor authentication, privileged account governance, remote access controls, and credential management. It’s arguably the most consequential category in practice, since modern attackers increasingly log in with valid, stolen credentials rather than break in through a technical exploit.

Strong identity threat detection and response is what catches the difference between a legitimate login and a compromised one.

Audit & Accountability (Logging)

Generating and retaining audit records, monitoring system activity, and producing usable evidence on demand, not just collecting logs somewhere they’re never reviewed, falls under this family. It’s also one of the most commonly failed areas in real assessments, often because log retention quietly lapses well before anyone notices.

Compliant log retention is what keeps that evidence available when an assessor asks for it.

Incident Response & Detection

This covers a documented incident response capability, detection and reporting procedures, containment and recovery steps, and the documentation to show all of it actually happened. Assessors want to see evidence the capability operates in practice, not just a plan sitting in a binder.

This is where managed detection and response (MDR) provides the operational backbone a written IR plan depends on.

System & Information Integrity

This family covers identifying and remediating security flaws, monitoring for threats and unauthorized changes, and maintaining an ongoing vulnerability management program rather than a once-a-year scan.

Configuration & Communications Protection

Secure baseline configurations, formal change management, boundary defense, encryption of CUI both at rest and in transit, and network segmentation all live here: the controls that keep an environment from drifting away from its assessed state over time.

Awareness, Training & Documentation

Security awareness training and clearly assigned, role-based responsibilities matter on their own, but this is also where the documentation spine of any CMMC assessment lives: the System Security Plan (SSP) and any Plans of Action and Milestones (POA&Ms) for known gaps.

A few remaining control families (media protection, physical protection, personnel security, maintenance, and risk assessment) round out the full 110 requirements and are worth reviewing directly in NIST SP 800-171, even though they don’t each warrant a dedicated section here.

How Does a CMMC Assessment Work?

A CMMC assessment verifies whether an organization has actually implemented the security requirements applicable to its contracts, not whether it has written policies describing what it intends to do.

Today, that mostly means a self-assessment: an organization evaluates its own environment against the applicable NIST SP 800-171 requirements, calculates a score, submits it to the Supplier Performance Risk System (SPRS), and affirms compliance annually.

For Level 2 contracts involving CUI, some solicitations call for a C3PAO (an accredited third-party assessor) to independently verify the same 110 controls; that third-party track is exactly what’s paused under the current Phase 2 suspension, though it’s expected to return in some form once the DoD’s review concludes.

Whichever path applies, the standard is the same: implementation has to be demonstrable through documentation and evidence, such as configuration exports, log samples, test records, and training rosters, not simply asserted in an SSP.

What Happens If You Find Compliance Gaps?

Finding gaps during a self-assessment isn’t a failure; not addressing them is. The practical process is straightforward: identify the gap, prioritize it based on risk, document a permitted corrective action through a POA&M where the rules allow one, and then verify, not just assume, that the remediation actually closed the gap once it’s implemented.

How to Prepare for CMMC Compliance: 5 Key Steps

The suspension of Phase 2 doesn’t change what preparation looks like; it just removes the artificial deadline pressure. These five steps hold up regardless of when third-party certification resumes.

Step 1: Determine Your CMMC Scope

Identify which contracts carry CMMC requirements and where FCI or CUI actually lives in your environment. Map the systems, users, devices, applications, and environments that touch that data, along with any third parties or service providers connected to them.

Step 2: Identify Your Applicable Level

Review your current and target contracts to determine which CMMC level applies, and understand the assessment expectations tied to that level.

Step 3: Assess Current Security Practices

Run a gap assessment against the 110 requirements in NIST SP 800-171, calculate your score, submit it to SPRS, and prioritize the highest-risk gaps first rather than tackling them in whatever order they surface.

Step 4: Remediate & Verify

Implement the controls that are missing, correct any misconfigurations you find, and verify that remediation actually works rather than simply documenting the intent to fix something.

Step 5: Maintain Documentation & Evidence

Keep your SSP current, keep POA&Ms and assessment records organized, and make sure evidence is easy to produce on short notice rather than reconstructed under pressure.

Beyond that, keep an eye on the outcome of the DoD’s Reform Task Force review, since requirements may resume with adjusted rules, and revisit your readiness ahead of any contract renewal rather than waiting for the next deadline to force the issue.

What Does CMMC Compliance Mean for MSPs?

The Phase 2 suspension is not a reason for MSPs or their clients to ease off CMMC preparation. Phase 1 self-assessment obligations are still active, prime contractors are still flowing CMMC requirements down to their subcontractors and the MSPs supporting them, and the underlying NIST SP 800-171 obligation is highly likely to come back around in some form once the DoD’s review concludes.

MSPs typically play a defined role in a client’s CMMC readiness: implementing, managing, monitoring, and documenting the technical controls that map to NIST SP 800-171: identity and access controls, logging, endpoint monitoring, vulnerability management, and incident response among them.

But it’s worth being direct about the boundary here: an MSP’s tools and services support a client’s compliance posture, they don’t create it. Ownership of the compliance program itself, including the SSP, the assessment, and the affirmation, stays with the client.

There’s a point a lot of MSPs and their vendors miss entirely: an MSP’s own environment can fall inside a client’s CMMC assessment boundary as an External Service Provider (ESP), which means how that relationship is documented and scoped matters as much as the security controls themselves.

Blackpoint, for example, operates as an ESP that does not collect, store, process, or transmit CUI. With Privacy Mode enabled for a tenant, Blackpoint’s SOC can continue investigating and responding to threats without pulling files that may contain regulated data off an endpoint without partner consent, a technical control that helps keep the boundary clean.

Partners typically document Blackpoint’s role in the client’s SSP and request a Customer Shared Responsibility Matrix, which spells out exactly which controls Blackpoint helps satisfy and which remain the customer’s responsibility. Getting this right is part of what separates a defensible, audit-ready ESP relationship from one that creates ambiguity the client has to explain to an assessor.

For a closer look at how MSPs navigate this kind of shared-responsibility scoping more broadly, see our MSP guide to SOC compliance.

Why Continuous Security Operations Matter for CMMC

CMMC compliance isn’t a one-time hurdle; an environment keeps changing after the assessment closes. New users get added, configurations drift, and new vulnerabilities surface, all of which can quietly erode the posture that was just verified.

Ongoing monitoring, detection, response, and logging are what keep an organization ready between assessments rather than scrambling to reconstruct evidence right before the next one. A 24/7 SOC is what makes that continuous visibility realistic instead of aspirational.

CMMC Compliance Checklist

This is the ongoing operations-and-readiness tracker to return to after the prep work above is done; it deliberately doesn’t repeat scoping, level selection, or gap assessment.

Security Operations

• Maintain access controls
• Monitor in-scope systems and environments
• Maintain required security logs and retention
• Detect, investigate, and respond to security events
• Maintain and test incident response procedures

Assessment Readiness

• Maintain SSP and POA&M documentation current
• Maintain evidence of implemented practices
• Verify remediation of identified gaps
• Understand and prepare for the applicable assessment process

Ongoing Readiness

• Monitor changes to the environment (new users, devices, configurations)
• Address new vulnerabilities and risks as they emerge
• Review security practices regularly, not just before an assessment
• Track the Phase 2 review outcome and changes to contracts and requirements

CMMC Compliance Is a Posture, Not a Deadline

CMMC verifies security that defense contractors are already obligated to have in place; the 2026 suspension changed the enforcement schedule, not the underlying obligation. There’s a real difference between checking boxes right before an assessment and actually operating the security practices CMMC verifies day to day, and that difference is what determines whether a program holds up under scrutiny.

Controls that are implemented, monitored, and documented as a matter of course will survive whatever version of CMMC emerges from the DoD’s review. The ins here are the controls themselves; the outs are the misconceptions and the shifting schedule around them, and it’s the schedule, not the obligations, that keeps changing.

Strengthen Your Security Operations

Readiness comes down to having the right security operations in place and being able to prove they’re working. Blackpoint helps support the security operations underlying CMMC compliance efforts (continuous monitoring, detection and response, and compliant logging) so organizations and the MSPs serving them have the operational foundation an assessment actually checks for.

See how Blackpoint helps you meet compliance requirements →

Sources

• DoD CIO – CMMC Program Overview
• Supplier Performance Risk System (SPRS) – CMMC
• NIST SP 800-171 Rev. 2
• Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements
• Pentagon suspends CMMC phase two requirements, launches review of program: Federal News Network

About the Author

Julia Srienc

Julia Srienc is the Director of Internal Security Compliance at Blackpoint Cyber, where she oversees the company’s compliance and privacy programs and ensures that Blackpoint solutions effectively support the global MSP community.

Julia brings over 15 years of experience in cybersecurity, risk management, compliance, and intelligence, spanning everything from policy to practice. Prior to joining Blackpoint Cyber, Julia served as a virtual CISO, advising corporate clients on security program design and implementation, conducting pre-transaction due diligence for M&A, and managing a digital executive protection program. Her earlier career included tracking nation-state threat actors and supporting the development of cyber policy and diplomacy.

Julia holds a Bachelor’s in International Politics and a Master’s in Security Studies from Georgetown University’s School of Foreign Service.