32 CFR Part 170 CMMC: What the Final Rule Actually Requires

A contractor’s guide to the CMMC Program Rule — how it differs from the DFARS clause, which level and assessment path may apply to you, and what to verify before you spend a dollar.

By The Defense Compliance Report Editorial Team

Last reviewed: June 30, 2026 · Independent. Not affiliated with the Cyber AB, the Department of Defense, DCMA DIBCAC, NIST, or any U.S. government agency.

32 CFR Part 170 CMMC in one screen

The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor’s level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.

Which contractors this rule reaches — and which it doesn’t

Before you spend a minute on the levels, place yourself. 32 CFR Part 170 applies to any DoD prime or subcontractor whose information systems will process, store, or transmit FCI or CUI in the performance of a contract, on contracts above the micro-purchase threshold — except contracts exclusively for commercially available off-the-shelf (COTS) items. It does notapply to federal information systems that a contractor operates on the government’s behalf, and DoD can waive it for a specific procurement. (Source: 32 CFR § 170.3.)

The right CMMC provider isn’t the same for every contractor — the category you need (a C3PAO, an RPO, an MSSP, a GRC platform, or a CUI enclave) depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, your cloud and IT environment, and your contract timeline. The contract clause sets your level, not a checklist. Because a general answer can’t resolve those for you, use The Defense Compliance Report’s Find My CMMC Path tool to map your situation to the right provider category before you request quotes — and do not submit CUI, drawings, or sensitive contract details.

What is 32 CFR Part 170 in CMMC?

32 CFR Part 170 is the federal regulation that establishes the CMMC program. It sets out how the Department of Defense verifies that contractors and subcontractors have implemented required cybersecurity standards on systems that process, store, or transmit FCI or CUI. It is the program rulebook — not, by itself, the contract requirement. (Source: 32 CFR § 170.1.)

Let’s decode the citation itself, because half the intimidation is just formatting. “32 CFR” means Title 32 of the Code of Federal Regulations — the slice of federal law that covers national defense. “Part 170” is the specific part that codifies CMMC. Put together, 32 CFR Part 170 is the rule that took CMMC from a DoD slide deck and made it enforceable federal regulation.

The rule traces to Section 1648 of the National Defense Authorization Act for Fiscal Year 2020 — that authority note tells the whole origin story.

What the rule actually does

The rule builds a complete program around cybersecurity requirements that, in most cases, already existed. Inside 32 CFR Part 170 you’ll find:

• The CMMC model and its three levels (§ 170.14).
• The assessment mechanisms for each level — self-assessment, third-party certification, and government assessment (§§ 170.15–170.18).
• Scoping rules that decide which systems are in and out (§ 170.19).
• POA&M (Plan of Action and Milestones) limits and the 180-day closeout window (§ 170.21).
• The annual affirmation requirement (§ 170.22).
• Subcontractor flow-down logic (§ 170.23).
• The scoring methodology (§ 170.24).
• The ecosystem roles — the C3PAO, the accreditation body, the assessor certification organization (Subpart C).

What 32 CFR Part 170 does not do

This is where contractors waste money, so we’ll be blunt:

• It does notinsert CMMC into your contract. That’s the DFARS clause’s job.
• It does not decide your level from a generic checklist. Your contract and your data type do.
• It does not make every contractor a Level 2 shop. Plenty of firms are Level 1, and some touch no FCI or CUI at all.
• It does not make NIST SP 800-171 Revision 3 the current CMMC Level 2 baseline. CMMC Level 2 maps to Revision 2 unless and until DoD amends the rule.
• It does not mean buying a tool equals compliance. A platform can help you get there; it cannot certify you.

Does 32 CFR Part 170 apply to me — and is it in my contract yet?

32 CFR Part 170 establishes the CMMC program, but a DFARS contract clause is what makes CMMC a contractual obligation. DFARS 252.204-7025 gives notice of the required CMMC level in a solicitation; DFARS 252.204-7021 carries the ongoing obligation once it’s in your contract. Those clauses began phasing into DoD contracts on November 10, 2025. (Sources: DFARS 252.204-7021, DFARS Subpart 204.75.)

The single most useful thing we can teach you about this rule is a distinction most articles blur. Different documents do different jobs, and confusing them is how people buy the wrong thing.

Think of it as a chain: standard → rule → clause. NIST writes the security requirements. 32 CFR Part 170 adopts them and builds the certification program. The DFARS clause drops that program into a specific contract. See DFARS 252.204-7025 in a solicitation, and the resulting contract will carry the DFARS 252.204-7021 CMMC obligation for the systems used in performance.

Where the phase-in stands right now

The DFARS rule that carries CMMC into contracts was published September 10, 2025 and became effective November 10, 2025 — the day Phase 1 began. Here’s what each phase authorizes:

Source: 32 CFR § 170.3(e); each phase begins one calendar year after the last.

One date deserves a highlighter. If you handle CUI and your work is likely to be designated Level 2 (C3PAO), your planning anchor is November 10, 2026— that’s when third-party assessments start becoming a condition of award for applicable acquisitions. Because a C3PAO assessment is a hard requirement, not a form you file, the runway is shorter than the calendar suggests once you factor in readiness and scheduling.

A major 2026 change: what the FAR overhaul did to DFARS 7019, 7020, and FAR 52.204-21

Your NIST SP 800-171 implementation obligations still live on through DFARS 252.204-7012, and your assessment obligation now runs through CMMC (DFARS 252.204-7021). Government-led NIST SP 800-171 assessments continue under the renumbered clause, DFARS 252.240-7997.

One wrinkle worth knowing: because these were class deviations, not formal rulemaking, the codified text on the eCFR and Acquisition.gov still displays 7019 and 7020. The deviations override them in practice. If a vendor or checklist still tells you to “post your 7019 self-assessment score,” that instruction is out of date. What matters now is your CMMC status and affirmation.

Stop asking “does this apply to me?” first

The abstract question — does 32 CFR Part 170 apply to me? — sends you into a regulatory rabbit hole. These operational questions get you an answer today. Ask, in order:

1. Does my solicitation, contract, option, modification, or flow-down include CMMC language — specifically DFARS 252.204-7025 or 252.204-7021?
2. Does the work involve FCI, CUI, or both?
3. What CMMC level and assessment type does the document name (Level 1 Self, Level 2 Self, Level 2 C3PAO, or Level 3 DIBCAC)?
4. Which of my systems will actually process, store, or transmit that information?
5. What’s my award or option timeline?

Answer those five and you’ve done more than 90% of the “do I need CMMC” analysis that matters.

We’ll also say the honest thing plainly: a web page cannot tell you your exact CMMC scope or your legal obligation. 32 CFR Part 170 defines the program; your contract language, your data, and your systems define your duty. If your situation is genuinely ambiguous, that’s a conversation for a CMMC Registered Practitioner (a credentialed CMMC advisor) or a qualified federal-contracts attorney.

Which CMMC level does 32 CFR Part 170 require?

32 CFR Part 170 maps CMMC Level 1 to the 15 basic safeguarding requirements in FAR 52.204-21, Level 2 to the 110 requirements in NIST SP 800-171 Revision 2, and Level 3 to 24 selected requirements from NIST SP 800-172. The contract and the sensitivity of the information — not a self-diagnosis — determine which level applies. (Source: 32 CFR § 170.14.)

For the full level-by-level breakdown, see our CMMC Level 2 requirements guide and the CMMC certification process.

Level 1 — 15 requirements, and no safety net

Level 1 covers Federal Contract Information (FCI) — information provided by or generated for the government under a contract that isn’t meant for public release. It requires the 15 basic safeguarding requirements in FAR 52.204-21, confirmed by an annual self-assessment and an affirmation in SPRS. One hard rule: Level 1 allows no POA&Ms. All 15 must be fully met at the time you affirm (§§ 170.15, 170.21).

A quick myth-buster: you may have read that Level 1 has “17” requirements. The rule counts 15— FAR 52.204-21(b)(1)(i) through (xv). The “17” traces to two things: the retired CMMC 1.0 model, which listed 17 practices, and crosswalks that map those 15 FAR requirements to 17 of the 110 NIST SP 800-171 requirements. Either way, the Level 1 requirement count under the rule is 15.

Level 2 — the 110, and the number most people land on

Level 2 covers Controlled Unclassified Information (CUI). It requires all 110 security requirements in NIST SP 800-171 Revision 2, organized into 14 control families and assessed against 320 assessment objectives in NIST SP 800-171A. Whether you may self-assess or must pass a C3PAO assessment depends on the contract (§§ 170.16, 170.17).

CMMC Level 2 currently uses NIST SP 800-171 Revision 2, not Revision 3. This matters because a lot of well-meaning guidance is quietly steering people toward Rev. 3. A NIST publication only becomes a CMMC obligation when DoD writes it into the rule — and as of this review, that’s still Rev. 2.

Level 3 — the government’s tier, and it’s not for most

Level 3 is for CUI tied to the DoD’s highest-priority programs — the ones facing advanced persistent threats (APTs). It layers 24 enhanced requirements selected from NIST SP 800-172 on top of a full Level 2 foundation, and it’s assessed exclusively by the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DCMA DIBAC) — the government, not a C3PAO. There’s a strict order of operations: you must earn a Final Level 2 (C3PAO)status on the relevant scope first, then undergo the separate DIBCAC assessment (§§ 170.14(c)(4), 170.18). DoD estimated Level 3 would apply to only about one percent of the defense industrial base — so if you’re wondering whether you’re Level 3, confirm it with your program office before you assume it.

Level 2 self-assessment vs Level 2 C3PAO — and should you call a C3PAO yet?

Level 2 (Self) and Level 2 (C3PAO) test the same 110 NIST SP 800-171 Rev. 2 requirements, but they produce different CMMC statuses through different assessors. A self-assessment is performed by your own organization and posted to SPRS; a C3PAO assessment is a formal certification conducted by a Cyber AB-authorized third party. (Source: 32 CFR §§ 170.16–170.17.)

The controls are identical. What changes is who signs off and how much rigor the sign-off carries. A Level 2 self-assessment is a documented internal review, submitted every three years with an annual affirmation. A Level 2 (C3PAO) assessment is an independent certification by a CMMC Third-Party Assessment Organization — one of the firms authorized by the Cyber AB.

When contractors see this rule, their instinct is to call a C3PAO. That is often the wrong first call — and it can cost you. A C3PAO assessment isn’t where you becomeready; it’s where your readiness gets tested. If your scope isn’t defined, your System Security Plan (SSP) isn’t written, your evidence isn’t collected, and your SPRS score isn’t where it needs to be, an early assessment is an expensive way to get a list of findings you already could have predicted.

There’s a bright-line rule that works in your favor. Under the CMMC Code of Professional Conduct and the ISO/IEC 17020:2012 impartiality standard, a C3PAO cannot assess a client it provided CMMC consulting or readiness services to within the previous three years. In plain terms: the firm that helps you get ready generally cannot also be the firm that certifies you. So the sequence is clear and it protects you: get readiness and implementation help first (from an RPO, an MSSP, a GRC platform, or a CUI enclave provider, depending on your gaps), thenengage a C3PAO when you’re genuinely assessment-ready.

Assessment-ready, or readiness-first?

Run this quick self-check. Every box needs to be a confident “yes” before a C3PAO assessment makes sense:

• Your CMMC assessment scope is defined and documented
• Your System Security Plan (SSP)is complete and current (it’s required — CA.L2-3.12.4, and it can never be deferred)
• You’ve collected evidence for all 110 requirements
• Your SPRS score reflects reality (realistically, 88 or higher for a conditional path)
• You’ve separated POA&M-eligible gaps from must-close gaps
• Your cloud, ESP, and CSP dependencies are documented (with FedRAMP handled where CUI is involved)
• Your affirming official is identified

Checked all seven with confidence? You’re likely ready to talk to a C3PAO. Missing several? Readiness or implementation help comes first — and that’s the more common (and cheaper) starting point. Either way, the right category depends on where you landed.

How is CMMC scored, and can you POA&M your way through?

For CMMC Level 2, the DoD Assessment Methodology starts you at 110 points and deducts 1, 3, or 5 points per unmet requirement, on a scale that runs from −203 to 110. You need at least 88 of 110 to earn a Conditional status, and you may place only limited 1-point gaps on a POA&M — which must be closed within 180 days. (Sources: 32 CFR § 170.21, § 170.24.)

Read the math and the 88 threshold turns out to be tougher than “80% is a passing grade” sounds. To reach 88, every3-point and 5-point requirement has to be fully met — those are the high-risk controls like multifactor authentication and FIPS-validated encryption. The only breathing room is a small handful of 1-point items. A POA&M is a short, disciplined finish line, not a “we’ll get to it” cushion.

One more distinction: the POA&M (the post-assessment list that governs your 180-day window) is not the same as the Operational Plan of Action (OPA) — the ongoing document that satisfies requirement CA.L2-3.12.2 between assessments. Different artifacts, different purposes. Conflating them is a common finding.

Scoping, the cloud, your MSP, and your subcontractors

32 CFR Part 170 requires you to define your CMMC assessment scope before the assessment, and the rule applies to the contractor information systems used in performance that handle FCI or CUI — plus, for Level 2 and 3, assets that provide security protections for CUI systems or aren’t isolated from them. External service providers and cloud services can pull assets into scope, and a cloud service provider that handles CUI triggers FedRAMP requirements under DFARS 252.204-7012. (Source: 32 CFR § 170.19.)

Scope comes before tools — always

Scope is the most expensive thing to get wrong, and no purchase defines it for you. Your scope is built from your assets, data flows, users, systems, external providers, and — above all — where CUI actually lives and moves. Get the boundary right and you can dramatically shrink what you have to secure and prove. Get it wrong and you either over-spend protecting things that don’t need it or fail an assessment because something in scope was never documented.

Here’s how the Level 2 asset categories break down:

Source: 32 CFR § 170.19. “We use GCC High” or “we bought an enclave” is a good start — it is not, by itself, a finished scoping answer.

Flow-down: what primes and subs each owe

32 CFR Part 170 pushes CMMC requirements down the supply chain, and DFARS 252.204-7021 requires a contractor to flow down the substance of the clause and verify a subcontractor’s status before subcontract award — except for subcontracts solely for COTS items. (Sources: DFARS 252.204-7021, 32 CFR § 170.23.)

If you’re a prime, your job is to identify which subs will actually touch FCI or CUI, flow down the correct level, and verify their status before award. The trap here is over-flowing — demanding Level 2 from a supplier who never touches CUI. If you’re a subcontractor, don’t accept a blanket demand at face value. Ask the prime: What CMMC level and data type is this tied to? Is it driven by an actual solicitation or contract, or internal policy? And do my own systems process, store, or transmit the FCI or CUI in question? The answers decide what you actually owe.

For the full supply-chain breakdown, see our CMMC flow-down requirements guide.

Common myths about 32 CFR Part 170 — and what the rule actually says

Because CMMC evolved from a 2020-era model into a 2024 Final Rule, a surprising amount of published content carries outdated or simply incorrect facts — wrong effective dates, the retired “17-control” figure for Level 1, and Revision 2 versus Revision 3 mix-ups. Every correction below is checked against the rule itself.

The state of the CMMC ecosystem right now

DoD’s rulemaking estimated that 8,350 medium and large entities would need Level 2 certification assessments, out of a broader population estimated at roughly 80,000 organizations handling CUI. As of early-to-mid 2026, publicly reported figures put the number of authorized C3PAOs and the number of certified organizations far below that demand — which is why the bottleneck most contractors underestimate is their own readiness plus C3PAO scheduling. (Primary figure: 89 FR 83092.)

• Authorized C3PAOs: publicly reported in roughly the 70–105 range through early-to-mid 2026 (verify the live count at cyberab.org before relying on it).
• Certified Level 2 organizations: reported at roughly 500–1,000 as of early-to-mid 2026 — a small fraction of the expected population.
• C3PAO scheduling lead times: widely reported at 6–12 months, with some assessors booked into 2027.

The takeaway isn’t panic; it’s sequencing. With certification lagging demand and third-party assessments becoming a condition of award in Phase 2, the firms that book their readiness work now — and their assessment slot early — are the ones who won’t be scrambling when a Level 2 (C3PAO) requirement lands in a solicitation they want to win.

What to do the moment you see “32 CFR Part 170” or CMMC in a solicitation

Don’t start by buying software or scheduling an assessment. Start by extracting the required CMMC level from the document, confirming whether you handle FCI or CUI, mapping the systems in scope, checking your SPRS status and affirmation, and only then choosing the right provider category for readiness, implementation, evidence, or assessment. (Source: DFARS 252.204-7021.)

The 32 CFR Part 170 Contractor Action Map

This asset translates each key part of the rule into the one thing a contractor should verify, the misread to avoid, and the next move — with the primary source for each row. Note that it routes you to a provider category, never a named vendor, and is not a score, a ranking, or compliance advice.

What we verified for this page

We wrote this from primary and official sources, not vendor marketing. We read the current 32 CFR Part 170 rule text on the eCFR, confirmed the Federal Register citation and effective date, checked the DFARS clause language and phase dates on Acquisition.gov, verified the NIST version mapping against NIST’s own catalog, and confirmed the February 2026 clause changes against DoD class-deviation guidance.

What we checked, as of June 30, 2026:

• eCFR, 32 CFR Part 170— current rule text: structure, definitions, the 15/110/24 level counts, applicability (§ 170.3), scoping (§ 170.19), POA&M rules (§ 170.21), scoring (§ 170.24), and flow-down (§ 170.23).
• Federal Register, 89 FR 83092 — publication Oct 15, 2024; effective Dec 16, 2024.
• Acquisition.gov, DFARS Subpart 204.75, 252.204-7021, and 252.204-7025 — the CMMC clause structure and the four-phase schedule (Phase 1 began Nov 10, 2025; Phase 2 begins Nov 10, 2026).
• February 2026 class deviations — the elimination of DFARS 252.204-7019 and renumbering of 252.204-7020 to 252.240-7997, and the renumbering of FAR 52.204-21 to 52.240-93, with DFARS 252.204-7012 and the CMMC clauses unchanged.
• NIST CSRC — SP 800-171 Rev. 2 (the current Level 2 baseline) and SP 800-172 (the Level 3 enhanced requirements).

What we did not verify, and you should confirm for your own situation:

• We did not use Cyber AB Marketplace counts as the basis for any regulatory claim; the ecosystem figures are publicly reported ranges. Verify the live count directly at cyberab.org on the day you rely on it.
• We did not review your contract, your solicitation, or your SPRS record.
• We did not assess your scope or determine your legal obligation — that’s a job for a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney.
• We did not rank or endorse any provider. This is educational research, not legal, contractual, or compliance advice.

Frequently asked questions about 32 CFR Part 170 CMMC

Most confusion about 32 CFR Part 170 comes from bundling separate things — the program rule, the DFARS clauses, the NIST standard, your assessment status, and your SPRS affirmation — into one pile. These answers pull them apart.

Need a next step, not just an explanation?

Tell us your level, scope, and timeline, and we’ll match you with source-checked CMMC provider options.

Do not submit CUI, drawings, export-controlled technical data, contract attachments, or sensitive customer information. Use general descriptors only.

Find My CMMC Path →orCMMC readiness checklist mapped to the 14 NIST SP 800-171 control families.