CMMC Compliance in 2026: Levels, SPRS Scores, NIST SP 800-171 and What Contractors Must Do Now

The Cybersecurity Maturity Model Certification (CMMC) program is now part of how the Department of Defense awards contracts. If your company handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), CMMC compliance is no longer optional. This guide explains the CMMC levels, how SPRS scores work, and what to do while the rollout continues.

Where CMMC Stands in 2026

CMMC Phase 1 began on November 10, 2025, when the DFARS CMMC clause started appearing in new DoD solicitations. Phase 1 requires self-assessments. Phase 2, which would require third-party certification for most Level 2 contracts, was scheduled for November 10, 2026, but DoD paused it in July 2026 pending a program review. Watch for official updates, because dates can change.

What has not changed: DFARS 252.204-7012 safeguarding requirements, NIST SP 800-171 implementation, SPRS score submission and Phase 1 self-assessments all remain in force.

The Three CMMC Levels

• Level 1 (Foundational): for contractors that handle only FCI. 15 basic safeguarding requirements from FAR 52.204-21, with an annual self-assessment and affirmation.
• Level 2 (Advanced): for contractors that handle CUI. The 110 security requirements of NIST SP 800-171. Depending on the contract, either a self-assessment or a certification assessment by an authorized C3PAO, every three years.
• Level 3 (Expert): for the most sensitive programs. Level 2 plus selected NIST SP 800-172 requirements, assessed by the government (DIBCAC).

What Is an SPRS Score?

The Supplier Performance Risk System (SPRS) holds your NIST SP 800-171 assessment score. Scores range from 110 (all controls implemented) down to -203. Each unmet control subtracts 1, 3 or 5 points. Contracting officers can see your score, so an honest, current score matters.

Key Documents: SSP and POA&M

Your System Security Plan (SSP) describes your CUI environment and how each requirement is met. A Plan of Action and Milestones (POA&M) lists gaps and fix dates. Under CMMC, POA&Ms are allowed only for certain lower-weighted requirements and must be closed within 180 days for a conditional status to become final.

A Practical CMMC Readiness Checklist

• Identify where FCI and CUI live and shrink that scope (an enclave can reduce cost).
• Run a gap assessment against all 110 NIST SP 800-171 requirements.
• Write or update your SSP and POA&M.
• Submit an accurate score to SPRS and have a senior official affirm it.
• Check that cloud providers handling CUI meet FedRAMP Moderate or equivalent.
• Flow CMMC requirements down to subcontractors that touch FCI or CUI.
• Book a C3PAO early. Assessor capacity is limited compared to the size of the defense industrial base.

Frequently Asked Questions

Does CMMC apply to subcontractors?

Yes. Primes must flow down the required CMMC level to any subcontractor that processes, stores or transmits FCI or CUI.

How much does CMMC Level 2 certification cost?

Cost depends heavily on scope and how much is already in place. Remediation is usually the larger cost, not the assessment itself.

Does the Phase 2 pause mean I can wait?

No. NIST SP 800-171 has been a contractual requirement under DFARS 7012 for years, and false SPRS scores create False Claims Act risk.

Where is your company in its CMMC journey? Share lessons learned below.