CMMC in Plain English: What Defense Suppliers Need to Know Now

If you sell to the Department of Defense, or to someone who does, CMMC has moved from something to watch to something to do. Requirements started showing up in new defense solicitations in November 2025, and the phase that lets a contract demand third-party certification begins in November 2026.

Certification takes months to earn, and I have watched that timing catch suppliers out. So the time to work out what applies to you is now, before a contract arrives with the clause already in it.

What CMMC actually is

CMMC stands for Cybersecurity Maturity Model Certification. It's the Department of Defense's way of confirming that the companies in its supply chain protect the government information they handle. The security requirements themselves are mostly not new. Defense contracts have required them for years through DFARS clauses, largely on the honor system.

CMMC ends the honor system. Instead of promising you meet the requirements, you show it, and for many companies an independent assessor confirms it.

This reaches well past the big primes. If a prime contractor holds a DoD contract and sends you drawings or specifications that include controlled information, the requirement flows down to you. Machine shops, fabricators, electronics assemblers, engineering firms, and logistics providers are all in scope when the information they touch is in scope. Being two or three tiers down the supply chain doesn't take you out of it.

The three CMMC levels

Level 1 applies when you handle Federal Contract Information, or FCI. That's information provided by or generated for the government under a contract and not meant for public release. It requires 15 basic safeguarding practices, verified by an annual self-assessment that a senior company official personally affirms.

Level 2 applies when you handle Controlled Unclassified Information, or CUI. That covers the technical drawings and specifications most defense work involves. It requires all 110 security requirements of NIST SP 800-171, the national standard for protecting that information. Most companies at this level need an assessment by an authorized third-party assessment organization, called a C3PAO, every three years, with an annual affirmation in between.

Level 3 adds selected requirements from NIST SP 800-172 for a small set of contractors supporting the most sensitive programs, and the government performs that assessment itself.

Most small and midsize defense suppliers land at Level 1 or Level 2. In my experience, which one you are depends on the information moving through your shop, and company size has nothing to do with it.

The timeline that matters

• December 2024: the CMMC program rule took effect, defining the levels and how assessments work.
• November 2025: the acquisition rule took effect, and CMMC requirements began appearing in new DoD solicitations, starting with self-assessments.
• November 2026: phase two begins, and applicable new solicitations can require Level 2 certification by a C3PAO rather than a self-assessment.
• Through 2028: the requirements phase into essentially all applicable defense contracts.

The practical point is sequencing. Your certification has to exist before a contract that requires it can be awarded to you. The assessment has to be scheduled, and assessors are a limited pool.

The implementation work has to be finished before the assessment. For a company starting from a typical baseline, that chain runs for months. Waiting for the first solicitation that names CMMC is the expensive way to learn that.

What to do first

Here is the order I'd work in.

1. Work out what information you actually handle, and whether any of it is FCI or CUI. Your primes' flow-down clauses and the markings on the documents you receive will answer this. It sets your level, and everything else follows from it.
2. Scope the environment. CMMC applies to the systems that store, process, or transmit that information, plus whatever protects them. I've watched many shops shrink the problem by keeping CUI in one well-controlled place instead of everywhere email reaches.
3. Assess the gap honestly, comparing what you have against the requirements for your level. For Level 2 this produces a score that goes into the government's Supplier Performance Risk System, or SPRS, and primes increasingly ask for that number before they send work your way.
4. Close the gaps and write it down. You need a System Security Plan describing how each requirement is met, and a plan of action for anything still open. CMMC allows a conditional status with some items on a plan of action, but those have to be closed within 180 days, and some requirements can't be deferred at all.
5. Book the assessment early. Our CMMC readiness work is built around this sequence. If your level and contracts require a C3PAO, the queue is real. I've seen companies that schedule early pick their timing, and companies that schedule late get picked by it.

Where the effort usually goes

In my experience, across the 110 Level 2 requirements, a handful of areas absorb most of the work in a small business. They are multi-factor authentication everywhere it's required, encryption that meets the standard, and logging that would actually support an investigation.

Documentation is the fourth, and it's the one I see catch people out. Plenty of shops are doing much of the right work and have almost none of it written down, and to an assessor, undocumented looks the same as undone.

The other surprise is that the work keeps going after certification. Annual affirmations are a legal commitment by a company officer that the requirements are still met, so the monitoring and reviews have to keep running between assessments.

Whether CMMC applies to your business

Not every business needs this. If nothing in your contracts touches FCI or CUI, CMMC isn't your problem, and anybody who tells you otherwise is selling something.

The first step of any conversation with us is establishing whether the requirement actually applies to you and at what level. If the answer is that it doesn't, that's the answer I'll give you.

If it does apply, this is work we do. Our compliance services cover the gap assessment, the remediation, the documentation, and the ongoing operation that keeps an affirmation true. For manufacturers in the defense supply chain I've seen most versions of this problem. Our case study on CMMC compliance for a construction company shows one start to finish. If you have your own IT staff, we do this work alongside internal teams too.

The useful first step is a conversation about what your contracts require, and it costs nothing. Schedule a call or contact us and we'll help you work out where you stand.