Cybersecurity Maturity Model Certification (CMMC)

Where this applies

This record is scoped to United States. Scope is part of the claim: a rule that binds one part of a country does not bind the whole of it, and this library states the scope its sources state.

Instrument

32 CFR Part 170 (program rule); 48 CFR DFARS 204/212/217/252 (acquisition rule)

Who it binds

Defense contractors and their supply chain. Level 2 is assessed by a C3PAO, Level 3 by the DCMA DIBCAC.

What it requires

CMMC makes cybersecurity certification a condition of eligible DoD contracts, and the rules behind it remain in force: 32 CFR 170 and the 48 CFR DFARS acquisition rule are unchanged, as is DFARS 252.204-7012. The phase-in in 32 CFR 170.3 began with Phase 1 on 10 November 2025. The transition to Phase 2, which 32 CFR 170.3 sets one calendar year later (10 November 2026), is suspended: a Department of War memorandum of 13 July 2026 states that "the upcoming November 2026 transition to Phase 2 of CMMC implementation is suspended" and directs that, while the suspension holds, only Level 1 (Self) and Level 2 (Self) may be placed in requirements, with no Level 2 (C3PAO) or Level 3 (DIBCAC) assessment assigned. The suspension was made by administrative memorandum, not by a rule change. Further guidance was to follow the Department's 60-day review, so confirm the current position through the Department's own channel before relying on any date.

Related records and requirements

• Technology and Data — Applies if you hold an eligible DoD contract (not sector membership alone). Phase 2 rollout is currently suspended (DoD memorandum, 13 July 2026) — while suspended, only Level 1 (Self) and Level 2 (Self) may be required.
• Manufacturing and Industry — Applies if you hold an eligible DoD contract (not sector membership alone). Phase 2 rollout is currently suspended (DoD memorandum, 13 July 2026) — while suspended, only Level 1 (Self) and Level 2 (Self) may be required.