CMMC
Cybersecurity Maturity Model Certification (CMMC) Program (32 CFR Part 170 and DFARS 48 CFR rule)
CMMC is DoD's program for verifying that defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The program rule, 32 CFR Part 170 (89 FR 83092), took effect on December 16, 2024, and the DFARS acquisition rule (90 FR 43560, DFARS Case 2019-D041) took effect on November 10, 2025, which started Phase 1. Level 1 covers the 15 FAR 52.204-21 safeguarding requirements, Level 2 is identical to the 110 requirements of NIST SP 800-171 Rev. 2, including multi-factor authentication, and Level 3 adds 24 selected NIST SP 800-172 requirements. Phase 2, which brings third-party (C3PAO) Level 2 certification into applicable contracts, starts on November 10, 2026.
Who it applies to
DoD contract and subcontract awardees that will process, store or transmit Federal Contract Information or Controlled Unclassified Information on contractor information systems, where a DoD solicitation specifies a CMMC level. Prime contractors must flow CMMC requirements down to subcontractors at all tiers that handle FCI or CUI: Level 1 (Self) for FCI only, and at least Level 2 (Self) for CUI, rising to the prime's C3PAO or DIBCAC level where the prime contract requires it.
Identity requirements
- Level 1: meet the identification and authentication safeguards of FAR 52.204-21 (IA.L1-b.1.v and b.1.vi) as part of an annual self-assessment, with no plan of action and milestones (POA&M) allowed
- Level 2: implement all 110 NIST SP 800-171 Rev. 2 requirements, including multi-factor authentication (IA.L2-3.5.3), assessed every three years by the contractor or by a C3PAO, as the solicitation specifies
- Under the CMMC scoring method, missing MFA costs 5 points, or 3 points if MFA covers only remote and privileged users; because a POA&M may only hold requirements worth 1 point (with one encryption exception), an MFA gap cannot be deferred to a POA&M
- Level 3: add 24 NIST SP 800-172 requirements, including bidirectional, cryptographically based and replay-resistant authentication of systems and components before network connection (IA.L3-3.5.1e) and blocking unknown or unauthenticated components (IA.L3-3.5.3e), assessed by DCMA DIBCAC
- Close any POA&M items within 180 days of the Conditional status, or the Conditional status expires
- Have an Affirming Official, a senior level representative of the organization, affirm continuing compliance in SPRS after every assessment, including POA&M closeout, and annually; the CMMC status lapses if the annual affirmation is missed
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | MFA is a Level 2 requirement worth up to 5 points that cannot sit on a POA&M, so contractors need it in place for all users before an assessment. Level 3 extends authentication to systems and components, which must authenticate cryptographically before connecting. |
| Privileged access (PAM) | The scoring method treats MFA for remote and privileged users as the first step and full user coverage as the finish line, and NIST SP 800-171 least-privilege requirements are part of Level 2. |
| Audit, logging & accountability | Results go into SPRS or CMMC eMASS, and an Affirming Official must affirm compliance after each assessment and every year, which makes the affirmation a personal accountability point. |
Upcoming deadlines
- November 10, 2026 CMMC Phase 2: Level 2 third-party (C3PAO) certification in DoD contracts
- November 10, 2027 CMMC Phase 3: Level 2 (C3PAO) for all applicable contracts and Level 3 introduced
- November 10, 2028 CMMC Phase 4: full implementation
Penalties
CMMC is enforced through contracting rather than fines: during the phase-in, DoD intends to require the specified CMMC status as a condition of contract award and, from later phases, as a condition for exercising option periods. A CMMC status lapses if the annual affirmation is not submitted.
Status and dates last verified against primary sources on 2026-11-05.
CMMC: frequently asked questions
- Does CMMC require multi-factor authentication?
- Yes, at Level 2 and above. Level 2 is identical to NIST SP 800-171 Rev. 2, which includes multi-factor authentication as requirement IA.L2-3.5.3. Under the CMMC scoring method in 32 CFR 170.24, MFA is worth up to 5 points, and only 1-point requirements (plus a non-FIPS encryption exception) can be placed on a POA&M, so missing MFA blocks a Conditional status.
- What are the CMMC phase dates?
- Phase 1 began on November 10, 2025, when the DFARS rule took effect. Under 32 CFR 170.3(e), each later phase starts one calendar year after the previous one: Phase 2 on November 10, 2026 (Level 2 C3PAO certification in applicable contracts), Phase 3 on November 10, 2027 (Level 2 C3PAO for all applicable contracts and Level 3 where applicable) and Phase 4, full implementation, on November 10, 2028.
- How long is a CMMC certification valid?
- A Level 2 or Level 3 status is valid for three years from the CMMC Status Date, provided the contractor submits the required affirmation after each assessment and annually. Level 1 self-assessments are repeated every year.