No CUI, no sales pitchStart →
CMMC Compliance for DoD Subcontractors: What Level You Need, What Flows Down From Your Prime, and What to Do First
If you’re a DoD subcontractor, here’s the bottom line on CMMC compliance for DoD subcontractors: the requirement is real, it’s already showing up in DoD solicitations and subcontracts as a condition of award, and it flows down to you when your subcontract work will process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on contractor information systems. FCI-only work maps to Level 1 (Self). CUI work requires at least Level 2 (Self)— or Level 2 (C3PAO) when your prime contract requires it — and there’s no blanket exemption for being a sub or being small.
That paragraph answers the question most subs are actually typing at 11 p.m. after a prime sends a clause or a questionnaire. But there’s a trap hiding inside it — and it’s the reason so many subcontractors waste five figures in the first 30 days. We’ll get to it. First, the part you can act on right now.
Find yourself in this table:
| Where you land | Your likely path | Your first move |
|---|---|---|
| You handle FCI only, never CUI | Level 1 (Self) | Confirm in writing that no CUI will reach your systems |
| You handle CUI, prime requires Level 2 (Self) | Level 2 (Self) | Build your SSP and evidence; prepare your SPRS posting |
| You handle CUI, prime requires Level 2 (C3PAO) or Level 3 | Level 2 (C3PAO) | Get readiness help before you call an assessor |
| You’re not sure whether your data is FCI or CUI | Scope unclear | Send your prime the clarification email below |
| You touch no FCI or CUI, or the work is exclusively COTS | Likely no CMMC requirement for this work | Get written confirmation before you ignore it |
Start here — it’s free and takes about 60 seconds.
Find my subcontractor CMMC path →Does CMMC compliance for DoD subcontractors actually apply to you?
The trigger is the data you handle, not your size or your tier. CMMC applies to prime contractors and subcontractors at every tier that will process, store, or transmit FCI or CUI on contractor information systems in performance of a DoD contract or subcontract (32 CFR §170.23). If your work involves no FCI and no CUI on contractor information systems, you may be outside CMMC for that work — but get it confirmed in writing.
- ✓Flow-down is not automatic to every supplier. Primes flow CMMC down only to subcontractors that will handle FCI or CUI. A vendor who only sees invoice data, or a supplier who never receives anything beyond a purchase order, may sit outside it.
- ✓FCI is a lower bar than CUI — but it’s still a bar. Federal Contract Information is non-public information provided by or generated for the government under a contract. It excludes basic invoicing and payment data. If you only handle FCI, you’re at Level 1.
- ✓CUI is the line that drives Level 2. Technical drawings, specifications, controlled technical information, anything carrying a CUI marking or a distribution statement — that’s CUI. The moment your environment touches it, you’re at Level 2 or higher.
- ✓Exclusively COTS work is generally excluded. If an acquisition is solely for standard catalog items with no program-specific technical data, CMMC generally doesn’t attach (32 CFR §170.3). “Exclusively” matters — a contract that bundles COTS with covered work isn’t off the hook.
- ✓Using only your prime’s environment can change the math. If the prime keeps all CUI inside its own enclave and you never store, process, or transmit it on contractor information systems in your scope, your obligation can shrink dramatically.
What CMMC level does a DoD subcontractor need? The flow-down decision matrix
Your level is driven by the data you handle; your assessment type is driven by your prime contract’s requirement. Under 32 CFR §170.23, FCI-only subcontractors need Level 1 (Self); CUI subcontractors need at least Level 2 (Self); and when the prime contract requires Level 2 (C3PAO) or Level 3 (DIBCAC), a CUI subcontractor’s minimum becomes Level 2 (C3PAO) — unless the DoD provides specific flow-down guidance.
The 2026 Subcontractor CMMC Flow-Down Decision Matrix
| If your subcontract has you… | …and the prime’s contract requires… | Your minimum CMMC status | Who assesses you | POA&M to Conditional? |
|---|---|---|---|---|
| Handle only FCI (no CUI) | Any level | Level 1 (Self) | You (annual self-assessment) | No — POA&Ms not allowed at Level 1 |
| Handle CUI | Level 2 (Self) | Level 2 (Self) | You (self-assessment, every 3 years) | Yes, within strict limits |
| Handle CUI | Level 2 (C3PAO) | Level 2 (C3PAO) | An authorized C3PAO | Yes, within strict limits |
| Handle CUI | Level 3 (DIBCAC) | Level 2 (C3PAO) — not Level 3 | An authorized C3PAO | Yes, at Level 2, within strict limits |
| Handle no FCI or CUI in scope, or exclusively COTS work | — | Not subject for this subcontract | — | — |
Here’s the nuance almost no competing page states cleanly:
Two separate things flow down to you. 1. Your levelcomes from your data — FCI → Level 1, CUI → at least Level 2. Simple. 2. Your assessment type— whether you can self-assess or must bring in a C3PAO — flows from your prime contract’s requirement, not your prime’s preference and not your budget. If the prime contract requires Level 2 (C3PAO), you can’t quietly self-assess your CUI work to save money.
And one point that surprises people: even when the prime is at Level 3 (DIBCAC), a CUI subcontractor’s requirement is capped at Level 2 (C3PAO)— not Level 3. Level 3 is the prime’s burden on its own most-sensitive systems (32 CFR §170.23(a)(4)).
Decode your row before you spend a dollar. Tell us your level, scope, and timeline and we’ll match you with source-checked CMMC provider options that fit your flow-down, starting with the help you actually need first.
Get matched with source-checked provider options →Self-assessment or C3PAO? Who assesses you, and can you choose the cheaper path?
Some subcontractors can self-assess; some legally cannot — and you don’t get to pick the cheaper option. Level 1 is self-assessed every year. Level 2 (Self) is a recognized status when the contract or flow-down permits it. Level 2 (C3PAO) requires an independent third-party assessment, and if your flow-down requires it, a self-assessment will not satisfy the requirement, no matter how clean your environment is.
| Path | Who assesses | What you’re measured against | Where the result lives | Validity |
|---|---|---|---|---|
| Level 1 (Self) | You | The 15 safeguarding requirements in FAR 52.204-21(b)(1) | SPRS | Annual self-assessment + annual affirmation |
| Level 2 (Self) | You | The 110 requirements of NIST SP 800-171 Rev. 2, across 14 control families | SPRS | Every 3 years + annual affirmation |
| Level 2 (C3PAO) | An authorized C3PAO | The same 110 NIST SP 800-171 Rev. 2 requirements | eMASS → SPRS | Every 3 years + annual affirmation |
| Level 3 (DIBCAC) | DCMA DIBCAC (the government) | Level 2 plus 24 selected NIST SP 800-172 requirements (Feb. 2021 version) | eMASS → SPRS | Every 3 years + annual affirmation |
SPRS (Supplier Performance Risk System) is the DoD system where your self-assessment score and your affirmation live. eMASS is the government system a C3PAO uses to submit your certification results, which then flow to SPRS. An affirmation is a formal attestation of continuous compliance, submitted by an affirming official in your company.
On the Revision 2 vs. Revision 3 question:
NIST has published Revision 3, and you’ll find vendors and some guides referencing it. For CMMC, that’s wrong right now. 32 CFR Part 170 incorporates NIST SP 800-171 Revision 2 for CMMC Level 2, and it stays Revision 2 unless and until the DoD amends the rule (32 CFR §170.2). If a provider tells you to build to Rev. 3 for CMMC today, that’s worth a second opinion.
The honest part: why most subcontractors should NOT call a C3PAO first
If you panic and call a C3PAO first, you’re probably spending on the wrong thing. A C3PAO assesses; it does not fix your scope, write your System Security Plan (SSP), close your gaps, or sort out your cloud. And the rule actually forbids the firm that gets you ready from also being your assessor.
That’s not our opinion — it’s in the regulation. The CMMC Code of Professional Conduct, implementing 32 CFR §170.8(b)(17)(ii)(G), prohibits a CMMC ecosystem member from participating in the Level 2 certification process for any organization it served “as a consultant to prepare the organization for any CMMC assessment within 3 years.” That prohibition binds the C3PAO as an organization and every member of its assessment team. Preparation and assessment are legally separate. You generally use one firm to get ready and a different one to certify you.
So why is “don’t call a C3PAO first” actually goodnews? Because your first dollars — the ones that matter most — go toward things that are cheaper and more within your control: confirming your data type, shrinking your CUI footprint, building your SSP and evidence, and closing real gaps. The assessment comes later, when you’re ready.
If you’re genuinely assessment-ready
If you’re like most subs
See what getting ready actually involves before you commit. A readiness program — scoping, SSP, gap analysis, remediation — is where the real work and most of the real cost live.
Compare readiness provider categories →What CMMC really costs a subcontractor: the DoD’s own numbers vs. reality
The most defensible cost floor is the DoD’s own estimate — but it deliberately leaves out the most expensive part.In the CMMC rulemaking, the DoD pegged a small entity’s three-year Level 2 self-assessment at roughly $37,196, and a small entity’s three-year Level 2 (C3PAO) certification at roughly $104,670. Those figures are real and citable. They are also, by the DoD’s own design, only part of the bill.
| Cost element | DoD published estimate (assessment + affirmations only) | Industry-reported range to also budget |
|---|---|---|
| Level 1 (Self) self-assessment + affirmation | ~$6,000 (small entity); ~$4,000 (larger entity) | Often absorbed by existing IT |
| Level 2 (Self), 3-year | ~$37,196 (≈$34,000 first year) | — |
| Level 2 (C3PAO), 3-year | ~$104,670 (≈$101,752 first year) | C3PAO fees alone commonly run tens of thousands, set per firm |
| Gap assessment | excluded | ~$3,500–$20,000+ |
| Remediation / control implementation | excluded | ~$10,000–$250,000+ |
| CUI enclave (scope-reduction strategy) | excluded | ~$300–$400 per user/month, or ~$3,000–$4,000+/month managed |
| Tools (FIPS-validated encryption, SIEM, EDR, vulnerability scanning) | excluded | ~$10,000–$50,000+/year |
Why the DoD number is so much lower than what your peers report:
The government’s estimate starts at the assessment phase and assumes you’ve already implementedNIST SP 800-171 — because DFARS 252.204-7012 has required exactly that since 2017. If your environment isn’t already built to all 110 requirements, the DoD’s $104,670 is a floor, not a forecast.
First-cycle Level 2 costs — gap assessment through certification — commonly land in the $75,000–$300,000+ range (industry-reported). An industry survey of more than 2,000 defense contractors found roughly 70% had budgeted under $100,000for their CMMC program — below the DoD’s own three-year projection, let alone real-world implementation.
What your prime will actually verify before award
Two different gates apply, and subs need to understand both. For a DoD award, the solicitation provision DFARS 252.204-7025 makes the required CMMC level “or higher” a prior-to-award eligibility gate. For a subcontract award, the contract clause DFARS 252.204-7021 requires your prime to ensure you hold a current CMMC status at the appropriate level before it awards you the subcontract.
- ✓A “Conditional” status can be enough to win the award. If your Level 2 assessment results in an allowed POA&M, you can hold Conditional status — which is sufficient for award under 252.204-7025 — but you must close the POA&M to reach Final.
- ✓You’ll be asked for CMMC UIDs. A CMMC Unique Identifier is a 10-character alphanumeric code SPRS assigns to each assessed information system. Under 252.204-7025, you provide a UID for each system that will handle FCI or CUI.
- ✓Your prime can’t just look you up. The DoD has confirmed there’s no automated way for a prime to view a subcontractor’s CMMC status in SPRS. Verification is manual — primes ask you to share a screenshot of your SPRS status or a copy of your certificate.
The single highest-leverage thing you can do this week is stop guessing and ask. Copy, paste, and send this:
Subject: CMMC flow-down clarification for [subcontract / program name]
Hi [name] — before we scope our CMMC work, could you confirm what you expect to flow down to us for this subcontract?
- Will our work process, store, or transmit FCI, CUI, or both?
- If CUI, what CUI category or marking guidance applies?
- What exact CMMC status are you flowing down — Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3?
- Which clause is the requirement tied to — DFARS 252.204-7021, 252.204-7025, 252.204-7012, 7019, or 7020?
- Is CMMC status required before award, before an option exercise, before delivery, or at a later milestone?
- Which of our systems do you expect to process, store, or transmit FCI/CUI?
- Will any of our own sub-tier suppliers receive FCI/CUI from us?
- What proof do you need — SPRS screenshot, CMMC UID(s), affirmation, certificate, SSP summary, or something else?
- Should we avoid receiving any CUI until our required status is confirmed?
- Who is our written point of contact for flow-down interpretation?
Thanks — we want to get this right and avoid scoping the wrong thing.
Got a prime email but you’re not sure what it actually requires? Don’t buy help against a guess. Send us your level, scope, and timeline — no contract data, no CUI — and we’ll match you with the provider category that fits.
Decode my flow-down →What’s the difference between a NIST 800-171 SPRS score and CMMC status?
They’re related but not the same, and during the transition some subs will be asked for both. A NIST SP 800-171 DoD Assessment score — required under DFARS 252.204-7019 and 252.204-7020 — is a self-assessment score you post in SPRS showing how fully you’ve implemented the 110 NIST SP 800-171 Rev. 2 controls. A CMMC status under DFARS 252.204-7021/-7025 is the result of a CMMC assessment (self or C3PAO) at a specific level. The score is the older mechanism; CMMC is the verification layer the DoD built on top of it.
- ✓The 7020 obligation predates CMMC and still applies.Under DFARS 252.204-7020, a prime generally can’t award you a subcontract subject to NIST SP 800-171 unless you have a current NIST SP 800-171 DoD Assessment summary score — not more than three years old — posted in SPRS.
- ✓A high SPRS score is not the same as a CMMC status.When your prime asks for “your score,” clarify whether they mean your NIST 800-171 DoD Assessment score (7019/7020) or your CMMC status and UID (7021/7025). The MORSE Corp case below shows exactly why the number you post matters.
What if your CUI lives in Microsoft 365, GCC High, AWS GovCloud, an MSP, or another external service provider?
Moving CUI into a cloud or managed environment changes your scope and your evidence — it does not erase your CMMC obligation, and it does not make software “compliant” on its own.If an external service provider (ESP) — a cloud platform, an MSP, an MSSP, a secure collaboration tool — processes, stores, or transmits your CUI or the security data that protects it, that relationship sits inside your assessment scope and must be documented.
The Subcontractor CUI Environment Scope Matrix
| Option | What it can reduce | What stays your responsibility | What to request / not assume |
|---|---|---|---|
| Microsoft 365 GCC High | A compliant home for CUI email/files; many technical controls | SSP, configuration, evidence, user practices, the assessment itself | A shared-responsibility matrix; don’t assume the license equals compliance |
| AWS GovCloud | An environment that can support compliant workloads | Your configuration, documentation, control implementation, evidence | Proof of which controls the platform covers vs. which you own |
| A defined CUI enclave | Scope — isolating CUI so it doesn’t sprawl across laptops, email, and shares | Governance, monitoring, and evidence for the enclave | A boundary diagram and what’s in vs. out of scope |
| MSP / MSSP | Day-to-day operation of controls (identity, logging, endpoints, backups) | Accountability — the controls are still assessed against you | A documented Customer Responsibility Matrix (CRM), not “we handle security” |
| Non-cloud ESP | Specific functions you outsource | Mapping what they do, what you do, and what’s left over | A Service Description plus the CRM |
| GRC / compliance software | Organizing SSP, POA&M, policies, and evidence | The actual control implementation behind the records | Clarity that the tool documents compliance; it doesn’t create it |
An ESP changes where the work happens and who’s responsible, not whether you’re responsible. A serious provider gives you a Service Description and a Customer Responsibility Matrixspelling out which requirements it implements and which remain yours. “Our vendor handles security” is not an answer an assessor accepts. The CRM is.
Before you buy an enclave, GCC High, or a GRC platform, confirm your scope first. The right first move might be environment design, readiness, or evidence workflow — and the order matters.
Check whether scope, enclave, or readiness comes first →Your first 30, 60, and 90 days after a CMMC flow-down request
The fastest path is sequential, not heroic: scope first, gaps second, remediation third.Days 1–30 are for data type, clauses, ownership, and your SPRS/SSP reality. Days 31–60 are for a gap assessment, evidence, and mapping your cloud and ESP responsibilities. Days 61–90 are for closing blocking gaps and deciding whether you’re ready to plan an assessment or still need readiness work.
Days 1–30 — establish reality
- ›Confirm whether you handle FCI, CUI, or neither (use the prime email above).
- ›Find every clause in play: DFARS 252.204-7012, 7019, 7020, 7021, and the 7025 provision in any solicitation.
- ›Identify your CAGE code(s) and the specific information systems that will touch FCI/CUI.
- ›Assign one accountable internal owner. This can’t be a side project for “whoever has time.”
- ›Start or update your System Security Plan (SSP) — the document that defines your environment, scope, and how each control is implemented.
- ›Confirm your SPRS access and your current assessment status.
- ›Freeze any uncontrolled CUI sharing until your scope is clear.
Days 31–60 — find the gaps
- ›Run a NIST SP 800-171 Rev. 2 gap assessment if any CUI is in play.
- ›Build an evidence inventory — policies, configurations, logs, screenshots.
- ›List every external service provider and request each one’s Service Description and CRM.
- ›Draw your CUI boundary and a simple data-flow diagram.
- ›Prioritize the high-weight gaps (the ones that cost you the most points under the scoring methodology).
Days 61–90 — close and decide
- ›Remediate the blocking controls first.
- ›If you’re self-assessing, prepare your SPRS submission and affirmation.
- ›If you’re on a Level 2 (C3PAO) path, get a readiness review before you schedule an assessor.
- ›Decide whether scope reduction or an enclave strategy lowers your cost and complexity.
- ›Give your prime a documented status update — accurate, not overclaimed. “We’re implementing and on track for [milestone]” is honest. “We’re certified,” when you’re not, is the kind of statement that ends up in an enforcement action.
Our CMMC Readiness Checklist, mapped to the 14 NIST SP 800-171 control families, turns the plan above into a step-by-step worksheet you can hand to your team.
Download the readiness checklist →The CMMC rollout timeline — and why “Phase 2 is 2026” is a trap for subcontractors
The rules are already in force, and the phase dates are not your real deadline — your prime’s award schedule is. The CMMC Program Rule (32 CFR Part 170) was published October 15, 2024 and took effect December 16, 2024. The DFARS acquisition rule was published September 10, 2025 and took effect November 10, 2025, starting a four-phase rollout (32 CFR §170.3(e)):
| Phase | Begins | What it means for a subcontractor |
|---|---|---|
| Phase 1(underway) | November 10, 2025 | Level 1 (Self) and Level 2 (Self) appear as conditions of award; Level 2 (C3PAO) can appear at the DoD’s discretion |
| Phase 2 | November 10, 2026 | DoD intends to include Level 2 (C3PAO) as a condition of award for applicable CUI contracts (the rule lets DoD apply it at an option period instead) |
| Phase 3 | November 10, 2027 | Level 2 (C3PAO) expands further; Level 3 (DIBCAC) is introduced for applicable contracts |
| Phase 4 | November 10, 2028 | Full implementation across applicable DoD solicitations and contracts, including option periods |
The real constraint is runway, not a phase date.
Readiness for a Level 2 (C3PAO) assessment commonly runs 6 to 18 months(industry-reported). Phase 2’s certification standard lands November 10, 2026. Do that subtraction and the runway is already tight.
Primes aren’t waiting for the phases — they’re sending questionnaires and asking for SPRS evidence now. And according to Cyber AB town-hall data from spring 2026, there were roughly 100 authorized C3PAOs and around 750 certified assessorsserving tens of thousands of organizations expected to need Level 2 — with only around 1,000 organizations having achieved Level 2 certification, leaving the defense base near 1% certified. The bigger constraint isn’t assessor availability — it’s readiness. Start now.
What happens if you’re not ready: Conditional status, POA&M limits, and real enforcement
Falling short isn’t automatically fatal — but misrepresenting where you stand can be. (This section discusses legal risk and is general information, not legal advice — talk to counsel about your situation.) CMMC allows a Conditionalstatus for Level 2 if you meet strict conditions, and Conditional is enough to win an award. The line subcontractors must not cross is the one between “we have gaps and we’re remediating them” and “we told the government we’re compliant when we weren’t.”
Conditional-status mechanics (32 CFR §170.21):
- A POA&M can get you to Conditional Level 2 only if your score is at least 80% (a score of at least 88 of 110 under the DoD methodology), only for the specific lower-point requirements the rule allows — generally 1-point items, with a narrow exception for CUI encryption (SC.L2-3.13.11) — and never for the requirements the rule bars from a POA&M entirely.
- You then have 180 days to close the POA&M and pass a closeout assessment. Miss that window and your Conditional status expires.
- Level 1 allows no POA&M at all. It’s all-or-nothing.
The Department of Justice’s Civil Cyber-Fraud Initiative uses the False Claims Act to pursue contractors that misrepresent cybersecurity compliance, and subcontractors are not shielded just for being subs. Real, on-the-record examples — these resolved allegations, not admissions of liability:
| Who | When | Amount | What DOJ alleged | The lesson for a sub |
|---|---|---|---|---|
| Raytheon / RTX / Nightwing | May 2025 | $8.4 million | DOJ alleged Raytheon failed to develop and implement an SSP and comply with DFARS 252.204-7012 and FAR 52.204-21 on a system used for roughly 29 DoD contracts and subcontracts | The obligation runs through subcontracts, and it can follow an acquisition |
| MORSE Corp | March 2025 | $4.6 million | As part of the settlement, MORSE acknowledged it had posted a self-assessed SPRS score of 104 while a later third-party assessment scored negative 142 | An inflated SPRS self-score is the exposure — the distance between what you posted and what’s real |
| Georgia Tech Research Corp | September 2025 | $875,000 | DOJ alleged the Astrolavos Lab ran without required antivirus/anti-malware and without an SSP, and that an inflated self-assessment score was submitted to DoD | “We’ll fix it later,” plus a rosy score, is a False Claims Act risk |
Which CMMC provider category should a subcontractor talk to first?
If you don’t yet know your data type, scope, or assessment path, do not start with a C3PAO — start with the category that resolves your actual gap. For scoping, SSP, remediation, and managed compliance, that’s a readiness consultant (an RPO), a vCISO, or a CMMC-capable MSP/MSSP. For sprawling CUI, it’s an enclave or secure-collaboration provider. For evidence and workflow, it’s GRC software as a supporting layer. A C3PAO belongs at the end, when you’re assessment-ready.
| Your situation | First provider category | Why |
|---|---|---|
| You don’t know whether you handle CUI | Scope clarification / RPO / vCISO | You need data and boundary answers before tools |
| You have CUI but no SSP or evidence | RPO / readiness consultant | Implementation evidence comes before assessment |
| Unmanaged endpoints, identity, logging, backups | CMMC-capable MSP / MSSP | Controls have to work continuously, not once |
| CUI sprawled across email and file shares | CUI enclave / secure collaboration / GCC High implementation | Scope reduction lowers cost and complexity |
| You have evidence but no system to manage it | GRC / evidence-management software | Organizes SSP, POA&M, artifacts, and owners |
| Prime requires Level 2 (C3PAO) and you’re ready | Authorized C3PAO | The formal assessment path |
| You already used a readiness consultant | A separate C3PAO | The 3-year conflict-of-interest rule requires it |
The verification step a federal audit says you can’t skip
A January 2025 DoD Inspector General audit (DODIG-2025-056) reviewed 11 of the 48 C3PAOs authorized at the time and found the DoD had not effectively implementedthe authorization process — including authorizing some organizations without confirming a signed agreement or the required certified personnel. The audit’s own conclusion: without an effective process, the DoD “does not have assurance that all C3PAOs that perform the CMMC Level 2 assessments are qualified.” Before you trust any assessor, confirm its current authorization directly on the Cyber AB Marketplace. Don’t assume.
Still not sure which category fits you? Tell us your level, scope, and timeline — no CUI, no sales pitch — and we’ll match you with the right provider category first: readiness, enclave, evidence workflow, or assessment.
Get matched with source-checked provider options →The most expensive mistakes subcontractors make with CMMC
- Treating FCI and CUI as interchangeable. They drive different levels.
- Assuming all Level 2 needs a C3PAO — or assuming none of it does. Your prime contract’s requirement decides.
- Calling a C3PAO before your SSP, evidence, and scope are ready.
- Buying GCC High before you’ve defined your CUI boundary.
- Posting a stale or unsupportable SPRS score. (See: MORSE Corp.)
- Sending CUI through lead forms, spreadsheets, or email chains.
- Letting an informal prime email replace an actual clause review.
- Forgetting your own sub-tier flow-down.
- Treating a POA&M as if it were implementation. It isn’t — the requirement stays “not met” until you close it.
- Saying “certified” when you only hold a self-assessment status.
How we built this guide, and what we actually verified
Frequently asked questions
Does CMMC apply to subcontractors at every tier?
Does FCI-only subcontract work require Level 2?
Does handling CUI always mean a C3PAO assessment?
Can a subcontractor choose Level 2 (Self) because it’s cheaper?
Do small subcontractors get an exemption?
Does my prime automatically see my SPRS status?
What’s the difference between a NIST 800-171 SPRS score and CMMC status?
Can my readiness consultant also be my C3PAO?
Is NIST SP 800-171 Revision 3 the standard for CMMC Level 2 now?
When do subcontractors have to be compliant?
Need help deciding what type of CMMC provider you need?
Get matched with source-checked provider options →Related from The Defense Compliance Report
- Level 2 Self-Assessment vs. C3PAO Certification
- How to Verify a C3PAO on the Cyber AB Marketplace
- The Full CMMC Cost Breakdown
- CMMC Readiness Checklist (all 14 control families)
- Who to Hire First: CMMC Provider Categories
- CMMC Compliance for Small Defense Contractors
- CMMC Secure Enclave Options for CUI
- CMMC Consultants for Defense Contractors: Provider Categories Compared
- CMMC POA&M Software: Buyer’s Guide
- CMMC SSP Software: What to Buy, What to Verify