Can't Bid Without CMMC Certification? What the Rule Actually Says

By The Defense Compliance Report Editorial Team · Last reviewed: June 2026 · Last verified: June 19, 2026

Not affiliated with the Cyber AB, the Department of Defense, DCMA DIBCAC, NIST, or any U.S. government agency. Educational research only — not legal, contractual, or compliance advice. The contract clause and your FCI/CUI handling set your level — not a checklist. Confirm scope and applicability with a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney.

Take a breath, because the full picture is more workable than the panic. Here’s the part most pages bury: depending on your contract, you may only need a self-assessment you run yourself — not a six-figure third-party certificate — and for Level 2 and Level 3, a conditional status can let you win the award while you close the last gaps. Which of those is true for you comes down to about five facts in your solicitation. The rest of this page pulls those facts out and gives you the answer for each scenario.

The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor’s level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.

Which situation are you in?

Most people who land here are reacting to one specific trigger. Find yours, get the short answer, then take the first action. The detail — and the proof — is below.

The CMMC Bid Eligibility Matrix: bid vs. win, by level and assessment type

No CMMC status is scored in the competition — CMMC is not an evaluation factor or set-aside. But award eligibility requires the status the solicitation names, and for Levels 2 and 3 a conditional status can carry you to award for up to 180 days, while Level 1 requires a final status at award. The differences that matter most are whether your contract needs a self-assessment or a third-party certification.

“Can’t bid without CMMC certification” — is that actually true?

It’s usually incomplete.CMMC is not a scored evaluation factor or set-aside, so it doesn’t block you from competing the way the phrase implies. But it is a pass/fail award-eligibility gate: the contracting officer “shall not award” a covered contract to an offeror that lacks the required CMMC status, and if DFARS 252.204-7025 applies, your proposal must include your CMMC UID(s) from SPRS.

We read the rule so you don’t have to assemble it from a dozen vendor blogs. When the DoD published the final acquisition rule in the Federal Register (DFARS Case 2019-D041, published September 10, 2025), it answered this exact question in response to a public comment. Someone asked whether CMMC was a competition evaluation factor or a set-aside. The DoD’s answer: it is neither. The mechanism is simpler and harsher than “you get points for it.” It’s a gate.

DFARS 204.7502 — the policy that took effect November 10, 2025— puts it plainly: contracting officers “shall not award a contract, task order, or delivery order to an offeror that does not have a current CMMC status at the CMMC level required by the solicitation,” and contractors must “achieve, at time of award,” that status for every system that will process, store, or transmit FCI or CUI.

So why does everyone say “you can’t bid”? Because business development teams and primes compress the rule into a warning — and because the proposal itself isn’t a clean free pass. If the solicitation carries the DFARS 252.204-7025 notice, your proposal has to list your CMMC UID(s), which you can only get after posting an assessment in SPRS. Functionally, if you can’t reach the required status by award, submitting spends money you won’t recover. That’s exactly why the 7025 notice (“Notice of CMMC Level Requirements”) appears in the solicitation itself— to tell you the required level up front, before you sink hours into a bid you can’t win.

What CMMC UID or SPRS evidence goes in your proposal?

When DFARS 252.204-7025 is in the solicitation, the offeror must provide, in the proposal, the CMMC unique identifier(s) (CMMC UIDs) issued by SPRS for each contractor information system that will process, store, or transmit FCI or CUI, and must update the list as new UIDs are generated.A CMMC UID is created in SPRS only after you enter your self-assessment results — so you generally need a posted CMMC status before the proposal is due.

This is the detail that turns “we’ll deal with CMMC at award” into “we need a status now.” The 7025 provision spells out three things the offeror needs:

• In the proposal: your CMMC UID(s) from SPRS for each in-scope system. No posted assessment, no UID.
• For award eligibility: a current CMMC status at the required level and a current affirmation of continuous compliance, both in SPRS.
• If your status is Conditional: you must close out a valid POA&M to reach Final, under 32 CFR § 170.21.

A practical sequence: scope the systems that will touch FCI or CUI, run the required assessment (self or C3PAO), post results in SPRS to generate the UID, complete the affirmation, and reference the UID(s) in the proposal. If you’re reading this with a proposal due soon and no posted status, that gap — not the certificate itself — is the thing to move on today.

Which clause decides whether CMMC blocks the award?

The clause that creates the award gate is usually DFARS 252.204-7025, the solicitation provision that names the required CMMC level and ties award eligibility to a current status in SPRS. DFARS 252.204-7021 then requires you to maintain that status during performance and flow it down to subcontractors. DFARS 252.204-7019 and 7020 can independently affect award through a separate NIST SP 800-171 score requirement, even where CMMC certification is not yet the gate.

Four DFARS clauses and one FAR clause do different jobs. Reading them as one blob is how contractors talk themselves into the wrong purchase.

Where to find it in the solicitation

Pull the actual document and search it. Check Section I (contract clauses), Section L (proposal instructions), Section M (evaluation factors), the attachments and CDRLs, any prime subcontract terms, and the CUI-handling or data-access instructions. The required CMMC level and assessment type live in the 7025 notice; the proposal instructions tell you exactly what evidence — including your CMMC UID(s) — to include.

Copy this into your internal bid/no-bid note

You don’t have enough information to make a bid decision until you can fill in every line.

Solicitation / opportunity:  ____________________
Clauses present:             7025 □  7021 □  7019 □  7020 □  7012 □
Required CMMC level:         L1 □  L2 (Self) □  L2 (C3PAO) □  L3 □
Data in scope:               FCI □   CUI □
Systems in scope:            enterprise / enclave / program system
Required timing:             proposal □  award □  option □  subcontract award □
Current SPRS evidence:       status □  NIST score □  affirmation □  CMMC UID □
Gap:                         none / missing affirmation / missing UID /
                             not assessment-ready / unclear prime language
Owner + next action:         ____________________

Do you need “certification” — or just a CMMC status?

Many contractors panicking about “certification” don’t need one.Only Level 2 (C3PAO) and Level 3 (DIBCAC) produce a third-party or government certification. Level 1 and Level 2 (Self) are met by a self-assessment you perform and post in SPRS with a senior-official affirmation — no outside assessor and no certificate. The word “certification” in the program’s name does not mean every contract requires an audit; the assessment type is set by your contract clause.

There are four CMMC statuses, and the gap between the cheapest and the most expensive is enormous:

• Level 1 (Self): an annual self-assessment against the 15 FAR 52.204-21 safeguards, affirmed in SPRS by a senior company official. No third party. (32 CFR § 170.15)
• Level 2 (Self): a self-assessment against the 110 NIST SP 800-171 Rev. 2 requirements, scored and posted in SPRS, valid three years with annual affirmation. Still no third party. (32 CFR § 170.16)
• Level 2 (C3PAO): the same 110 requirements, but assessed and certified by a Certified Third-Party Assessment Organization (C3PAO). (32 CFR § 170.17)
• Level 3 (DIBCAC): builds on a Final Level 2 (C3PAO) and adds a government-led DCMA DIBCAC assessment of 24 selected NIST SP 800-172 requirements.

One accuracy point worth more than it looks: for CMMC, Level 2 maps to NIST SP 800-171 Revision 2, not Revision 3, unless and until the DoD amends the rule. If a vendor’s pitch leans on Rev. 3 as the controlling CMMC standard, treat it as a flag, not a feature.

Is CMMC required at bid time, award time, option exercise, or subcontract award?

For the offeror, the requirement is an award gate: a current CMMC status and affirmation at the required level must be in SPRS before award, and maintained throughout performance. A contracting officer may not exercise an option or extend performance unless your status is current at the required level. For subcontractors, the prime must ensure the right status before awarding the subcontract.

The timing is where “can’t bid” gets misread most often. There are five distinct moments, and they don’t all carry the same gate.

The DoD’s own Regulatory Impact Analysis states it cleanly: “Before contract award, the offeror must achieve the specified CMMC level for the contractor information system… that will process, store, or transmit the information to be protected.” And DFARS 204.7502 is explicit that a contracting officer may award, exercise an option, or extend performance only when your CMMC status is at the required level or higher.

The phased schedule — and why it isn’t a grace period

CMMC is rolling into contracts in four phases, set out in 32 CFR § 170.3(e) and on the DoD CIO’s CMMC site. The schedule controls whena given level can appear in your solicitations — it does not give anyone permission to wait.

Can you still win while you’re finishing? (Conditional status)

For Levels 2 and 3, yes — within limits. DFARS 204.7502 allows award with a Conditional CMMC status for up to 180 days, and 32 CFR § 170.21 sets the bar: your score must be at least 80% (for Level 2, at least 88 of 110 points), only low-value 1-point items may sit on a POA&M, specified critical requirements may not be deferred, and a System Security Plan must be in place. You then have 180 days to close the POA&M via a closeout assessment or the conditional status expires. Level 1 has no conditional path — it requires a final status at award and allows no POA&M.

Before you hire a C3PAO, verify it yourself

Verify a C3PAO’s current status in the Cyber AB Marketplace yourself, and keep readiness work separate from the formal assessment.Under the CMMC Assessment Process and Code of Professional Conduct, a C3PAO must disclose and avoid or sufficiently mitigate conflicts of interest, and a 2025 DoD Inspector General audit found gaps in how some C3PAOs were authorized — so a current, self-checked status matters more than a vendor’s marketing.

Two facts should shape how you choose an assessor. First, independence.The CMMC Assessment Process (the Cyber AB’s published procedure) requires conflicts of interest to be disclosed and either avoided or sufficiently mitigated; where a conflict can’t be mitigated, the C3PAO shall not proceed. In practice, that means keeping readiness/remediation and the formal assessment in separate lanes — a C3PAO that has given you implementation advice to improve your readiness can conflict itself out of performing your assessment.

Second, don’t assume the registry polices itself perfectly. In DoD OIG Report No. DODIG-2025-056 (January 10, 2025), the Inspector General reviewed 11 of the 48 C3PAOs authorized as of September 2023 and reported that two C3PAOs were authorized without a signed C3PAO Agreement and Code of Professional Conduct, four without verifying their quality-control leads’ certification, and all without adequately confirming a certified assessor and quality-control lead on the team. The fix is simple and free: before you sign anything, confirm the C3PAO’s current authorization in the Cyber AB Marketplace and ask for the assessment team’s credentials. (This is due diligence, not a claim that any specific C3PAO is unreliable.) See also: how to evaluate C3PAOs for CMMC Level 2.

What we actually verified for this page

Every regulatory statement on this page is tied to a primary source we read directly, with the date we checked it. We separate regulatory facts (sourced to the rule) from editorial judgments (clearly labeled as our analysis).

Last verified: June 19, 2026. What we read and cross-checked:

• The bid-vs-award rule — DFARS 204.7502 and 204.7503, and the Federal Register final rule (DFARS Case 2019-D041, published Sept. 10, 2025) confirming CMMC is “not an evaluation factor or set-aside requirement.”
• The proposal gate — DFARS 252.204-7025 (NOV 2025): CMMC level “required prior to award,” the offeror “will not be eligible for award” without a current status and affirmation, and the offeror “shall provide, in the proposal, the CMMC unique identifier(s).”
• Maintain and flow down — DFARS 252.204-7021, including the duty to ensure a subcontractor’s status before subcontract award.
• Conditional status, POA&M, scoring — 32 CFR Part 170 §§ 170.16, 170.17, 170.21, and 170.24 (80% threshold; 180-day closeout).
• Subcontractor levels — 32 CFR § 170.23.
• The levels — FAR 52.204-21 (15 Level 1 safeguards); NIST SP 800-171 Rev. 2 (110 requirements, 14 families); NIST SP 800-172 (Level 3 enhanced).
• The pre-CMMC SPRS gate — DFARS 252.204-7019/7020.
• Phase timing — 32 CFR § 170.3(e) and the DoD CIO CMMC site.
• Cost — DoD’s Regulatory Impact Analysis.
• Assessor oversight — the Cyber AB CMMC Assessment Process and DoD OIG Report DODIG-2025-056.

Authorship: written and verified by The Defense Compliance Report Editorial Team. This is editorial research and has not been formally reviewed by a CMMC Subject Matter Advisor; confirm your specific situation with an RP/RPO or a federal-contracts attorney. See our Methodology and Editorial & Advertising Policy, and report an error via Corrections.

CMMC bid eligibility FAQ