CMMC Level 2 Certification Starts November 10, 2026: A Practical Guide for Defense Suppliers

← All resources

The Short Version

• November 10, 2026 begins Phase 2 of the Department of Defense (DoD) CMMC rollout. From that date, applicable new solicitations and contracts can require a CMMC Level 2 certification from an authorized third-party assessor (C3PAO) as a condition of award.
• Level 2 applies when you handle Controlled Unclassified Information (CUI). It is built on the 110 security requirements in NIST SP 800-171 Rev. 2.
• Requirements flow down: a prime contractor must pass CMMC requirements to subcontractors who handle the same information.
• Preparing for a Level 2 assessment usually takes months, not weeks. If CUI is in your contracts, start with a gap assessment now.

The CMMC Rollout Timeline

The DoD contract rule that puts CMMC into contracts (DFARS 252.204-7021) took effect on November 10, 2025. It phases requirements in over three years:

Contracting officers decide which contracts carry which level, so the requirement appears contract by contract. Watch your solicitations, and ask your prime what level they expect from you.

Level 1 or Level 2: Which Applies to You?

Level 1 — Federal Contract Information (FCI)

If you only handle FCI (information the government provides or generates under a contract that is not meant for public release), Level 1 applies: 15 basic safeguarding requirements from FAR 52.204-21, an annual self-assessment, and an annual affirmation posted in the Supplier Performance Risk System (SPRS). Level 1 does not allow open items on a plan of action.

Level 2 — Controlled Unclassified Information (CUI)

If you receive or create CUI — for example, controlled technical drawings, specifications, or export-controlled data marked as CUI — Level 2 applies. It covers the 110 requirements in NIST SP 800-171 Rev. 2, and in most contracts after November 10, 2026 it will be verified by a C3PAO rather than self-assessed.

Key Level 2 Rules to Know

• Scoring and conditional status. An assessment can result in conditional status with a plan of action and milestones (POA&M) if your score is at least 80% of the maximum (88 of 110 points). Open items must be closed and confirmed within 180 days, or the conditional status expires.
• Some requirements can’t wait. Certain requirements cannot be left open on a POA&M at all, so they must be in place before the assessor arrives.
• Certification lasts three years, with an annual affirmation of continued compliance by an affirming official at your company.
• SPRS matters. Assessment results and affirmations are recorded in SPRS, and primes must verify their subcontractors’ status directly.
• AIT does not certify. Only an authorized C3PAO can issue a Level 2 certification. Our job is to get you ready and keep you there.

Seven Steps to Take Now

1. Confirm your level. Identify whether you handle FCI only, or CUI, and which contracts are affected.
2. Define your boundary. Map where CUI lives and moves — people, devices, cloud services, and suppliers. Keeping CUI in a smaller, well-defined environment (an enclave) can reduce cost and effort.
3. Run a gap assessment against all 110 NIST SP 800-171 requirements, with evidence for each.
4. Write your System Security Plan (SSP) describing how each requirement is met, and a POA&M for what isn’t yet.
5. Fix the highest-risk gaps first, starting with requirements that can’t be left on a POA&M, plus multi-factor authentication, encryption, logging, and incident response.
6. Score yourself honestly and post to SPRS as your contracts require.
7. Book your C3PAO early. Assessor calendars fill up as deadlines approach; schedule once your evidence is ready.

Want to see what an engagement looks like? Read How Working With AIT Works or our IT audit and readiness assessments.

Common Questions

How Amelia Island Tech Can Help

We scope your CUI boundary, run the NIST SP 800-171 gap assessment, write your System Security Plan and POA&M, fix the gaps, and keep your evidence current so you’re ready for the assessor — with the same specialist from scoping to close. Lighthouse clients get ongoing compliance program management after the initial work.

Sources

• 32 CFR Part 170 — CMMC Program (eCFR)
• DoD CIO — Cybersecurity Maturity Model Certification
• Cooley — DoD final rule implementing the CMMC contract clause (Sept. 2025)
• NIST SP 800-171 Rev. 2 (the version CMMC Level 2 uses)

This guide is general information to help you plan, not legal advice. Confirm how a requirement applies to your business with your counsel, your contracting officer, or your regulator.