The CMMC Final Rule, Explained: What Changed, When It Hits, and What to Do Now

By The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance.

Last reviewed: August 2026

The Defense Compliance Report is not affiliated with, endorsed by, or sponsored by the U.S. Department of Defense, the Cyber AB, DCMA DIBCAC, NIST, or any U.S. Government agency. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification. This is educational research, not legal, contractual, or compliance advice. Confirm scope and applicability with a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney.

The bottom line, up front

The CMMC Final Rule is active in two parts. The program rule — 32 CFR Part 170 — created the Cybersecurity Maturity Model Certification (CMMC) program and took effect December 16, 2024. The acquisition rule — the DFARS rule (DFARS Case 2019-D041) — put CMMC into DoD contracts and took effect November 10, 2025. Both are live today. [Federal Register, 89 FR 83092; Federal Register, DFARS final rule 2025-17359]

Three things decide what you actually owe:

1. Your data. Do you handle Federal Contract Information (FCI), Controlled Unclassified Information (CUI), both, or neither? That sets your CMMC level.
2. Your contract clause. A provision called DFARS 252.204-7025in the solicitation tells you the exact CMMC status required to be eligible for award — Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC). The clause sets your level. A checklist can't.
3. Your phase.We're in Phase 1, which leans on self-assessment. Phase 2 was suspended July 13, 2026 with no replacement date announced — during the suspension, new procurement designations are limited to Level 1 (Self) and Level 2 (Self). [32 CFR 170.3(e); DoW July 13, 2026 release]

The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor's level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.

One honest caveat before we go deep

No page — including this one — can tell you your required CMMC level. Only your contract clause can. Anyone who quotes you a "CMMC package" before reading your solicitation is guessing. Once you know your clause, your data type, and your scope, the rest of the decision gets a lot smaller — and this page will show you exactly where to find each piece and what it means.

Who this is for — and who should read something else

This page is for the people who have to make the call: CISOs, IT directors, compliance managers, FSOs, contracts officers, and owners of small DIB suppliers.

• If you only sell COTS products to the DoD, CMMC generally does not apply to you. [32 CFR 170; Federal Register] Confirm it with your contracts lead and move on.
• If you already know your level and want the step-by-step process, start with our CMMC certification process guide instead.
• If you're trying to size an isolated CUI environment, our CMMC enclave cost breakdown is the better door.

Is the CMMC Final Rule actually in effect right now?

Yes. The CMMC program rule (32 CFR Part 170) took effect December 16, 2024, and the DFARS acquisition rule took effect November 10, 2025. Phase 1 of the rollout is active. On July 13, 2026, the Department suspended Phase II and all pending implementation milestones with no replacement date announced. [Federal Register, 89 FR 83092; 32 CFR 170.3(e); DoW July 13, 2026 release] The requirement is not "coming." Phase 1 is here and in force.

"Effective" does not mean every contract changed overnight. DoD is rolling CMMC into solicitations, and Phase 1 focuses on Level 1 and Level 2 self-assessments. During the Phase II suspension, new procurement designations are limited to Level 1 (Self) and Level 2 (Self). [32 CFR 170.3(e)]

Why does everyone keep calling it "two rules"?

The CMMC Final Rule is two separate rulemakings. 32 CFR Part 170 is the program rule — it defines how CMMC works. The DFARS acquisition rule is the contract rule — it puts CMMC into solicitations and makes your status a condition of award. You need both to understand your obligation. [Federal Register, 89 FR 83092; Federal Register, DFARS final rule]

The program rule (32 CFR Part 170) is the rulebook. Published October 15, 2024 (89 FR 83092), effective December 16, 2024. It defines the levels, assessment types, scoping, scoring, plans of action, the annual affirmation, and the roles in the assessment ecosystem. When you want to know what CMMC requires, you're asking about 32 CFR Part 170. [Federal Register, 89 FR 83092]

The acquisition rule (the DFARS rule) is the switch that turns it on inside contracts. Published September 10, 2025, took effect November 10, 2025. [Federal Register, DFARS final rule]It works through two instruments you'll actually see in your paperwork:

• DFARS 252.204-7025 (a solicitation provision) — the notice that tells offerors which CMMC status is required to be eligible for award. [Acquisition.gov, 252.204-7025]
• DFARS 252.204-7021 (a contract clause) — the requirement to hold and maintain that status through performance and flow it down to subcontractors. [Acquisition.gov, 252.204-7021]

The two rules, side by side

Sources: Federal Register (89 FR 83092); Federal Register (DFARS final rule); Acquisition.gov (252.204-7021, 252.204-7025).

Does the CMMC Final Rule apply to me?

CMMC applies to any DoD contractor or subcontractor whose systems process, store, or transmit FCI or CUI in the course of a contract. If you only handle FCI, you're generally looking at Level 1. If you handle CUI, you're at Level 2 or higher. If you deal exclusively in COTS products, you're generally exempt. [32 CFR 170; Federal Register]

Two data types drive everything:

• Federal Contract Information (FCI):information provided by or generated for the government under a contract that's not intended for public release. FCI puts you at Level 1.
• Controlled Unclassified Information (CUI): information the government requires to be safeguarded under law, regulation, or government-wide policy. CUI puts you at Level 2 — and, for the most sensitive programs, Level 3.

The mistake we watch small manufacturers make is assuming "DoD subcontract" automatically means Level 2. It doesn't. If a prime only flows you FCI, you're likely at Level 1. If they flow you CUI, you're at least Level 2. The trigger is the data, not the size of the contract or your tier in the supply chain.

Three applicability rules worth knowing:

• Flow-down is real and it reaches deep. Under 32 CFR 170.23, primes must flow CMMC requirements down to any subcontractor that will process, store, or transmit FCI or CUI — including second- and third-tier subs that never contract directly with the DoD. [32 CFR 170.23]
• Cloud for CUI has a hard bar. If a cloud service provider (CSP) stores, processes, or transmits your CUI, that environment must meet the FedRAMP Moderate baseline (or demonstrate FedRAMP Moderate equivalency). [32 CFR 170.19; DFARS 252.204-7012]"We use the cloud" is not the same as "we're compliant."
• COTS-only is the main exemption. Contractors dealing exclusively in commercially available off-the-shelf products are generally outside CMMC. [Federal Register]

Read the clause first

You cannot reason your way to your required level from a blog post. The number lives in your solicitation, your contract, or your prime's written flow-down. So before you price anything:

The right CMMC provider isn't the same for every contractor — the category you need (a C3PAO, an RPO, an MSSP, a GRC platform, or a CUI enclave) depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, your cloud and IT environment, and your contract timeline. The contract clause sets your level, not a checklist. Use The Defense Compliance Report's Find My CMMC Path tool to map your situation to the right provider category before you request quotes — and do not submit CUI, drawings, or sensitive contract details.

The CMMC Final Rule Trigger Map

Most guides explain the rule. Almost none tell you what to do when a specific thing happens to you. This is the core of The CMMC Path Framework— our logic for mapping a contractor's situation to the right next step. It routes you to a provider category, never a named provider, and it is not a score, a ranking, or compliance advice.

Regulatory basis: 32 CFR Part 170 defines applicability, phases, levels, scoping, assessment paths, POA&M limits, and flow-down; DFARS 252.204-7025 requires the solicitation to state the required status; DFARS 252.204-7021 requires you to maintain that status; SPRS is where status and affirmations are posted. [eCFR, 32 CFR Part 170; Acquisition.gov]

What does the CMMC Final Rule actually require? The three levels

CMMC has three levels, and they are not interchangeable. Level 1 protects FCI with 15 requirements and an annual self-assessment. Level 2 protects CUI with 110 requirements from NIST SP 800-171 Revision 2. Level 3 adds 24 requirements from NIST SP 800-172 for the most sensitive programs and is assessed by the government. [32 CFR 170.14; Federal Register] Your contract clause tells you which one you need.

Level 1 — Foundational (FCI)

Fifteen basic safeguarding requirements, drawn from the federal clause historically numbered FAR 52.204-21. [Federal Register] You self-assess annually, post the result in SPRS, and submit an annual affirmation. There is no POA&M at Level 1 — all 15 must be fully met, no exceptions. A false Level 1 affirmation in SPRS is still a false statement to the government.

Level 2 — Advanced (CUI)

This is where most of the Defense Industrial Base lives. Level 2 requires all 110 security requirements from NIST SP 800-171 Revision 2, organized into 14 control families. [32 CFR 170.14; NIST SP 800-171 Rev. 2] Those 110 requirements break down into 320 discrete assessment objectives — the individual pass/fail checkpoints an assessor actually scores under NIST SP 800-171A. "We do MFA" is not the same as passing every objective tied to it.

Level 2 comes in two flavors, and the difference is worth real money:

• Level 2 (Self): you assess yourself and post the score. Available for applicable contracts, especially during Phase 1.
• Level 2 (C3PAO): a Certified Third-Party Assessment Organization (C3PAO) — an independent firm authorized by the Cyber AB — assesses you. The C3PAO enters results into the government's eMASS system, which transmits your status to SPRS. [Federal Register]

Both paths are valid for three years, with an annual affirmation in between. Which one you owe is set by the clause, not by the phrase "Level 2" alone.

Level 3 — Expert (most sensitive CUI)

Level 3 layers 24 selected requirements from NIST SP 800-172 on top of all 110 Level 2 requirements — 134 in total. [Federal Register; NIST SP 800-172, Feb. 2021] You must already hold a Final Level 2 (C3PAO)status before you can pursue it, and the assessment is performed by the government's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) — not a C3PAO. It's reserved for programs facing nation-state-level threats.

Level 2 (Self) vs. Level 2 (C3PAO): the expensive mix-up

Seeing "Level 2" in a clause does not tell you whether you can self-assess or must hire a C3PAO. That is a separate specification in your contract's required CMMC status. Assuming "Level 2 means C3PAO" — or that "self-assessment means easy" — is one of the most common and costly errors we see. [Acquisition.gov, 252.204-7025]

What will the CMMC Final Rule cost?

The DoD's published cost estimates are assessment-and-affirmation figures, not full implementation budgets. For a small entity, DoD estimates roughly $6,000 a year for Level 1, about $37,000 over three years for Level 2 (Self), and about $104,670 over three years for Level 2 (C3PAO). Crucially, those numbers exclude the cost of actually building your security environment. [Federal Register, 32 CFR Part 170 Regulatory Impact Analysis] The real budget is almost always larger — but it's also more controllable than the scary headline suggests.

When DoD priced the program, it assumed you've been implementing NIST SP 800-171 since DFARS 252.204-7012 first appeared in 2017. So its estimates cover only the cost to prove compliance — not the cost to achieve it. [Federal Register]In DoD's words, those implementation costs "should already have been incurred."

DoD's own estimates vs. the real buying decision

DoD figures: 32 CFR Part 170 Regulatory Impact Analysis, published in the Federal Register Oct. 15, 2024. Market figures are industry-reported ranges, not DoD estimates.

In the open market, a C3PAO assessment fee alone commonly runs $30,000–$75,000, and assessment fees are typically only about a quarter of total compliance cost. Full first-year spend to reach Level 2 frequently lands in the $100,000–$300,000+ range depending on scope and starting maturity. [Industry-reported; PreVeil, Secureframe, and others]

Three levers control that number, in order of impact:

1. Scope. If CUI flows through your entire network, your entire network is in scope. Isolating CUI into a defined boundary — an enclave — is the single biggest cost reducer available to most small contractors.
2. Starting maturity. A contractor that has genuinely run NIST 800-171 since 2017 pays to verify. One starting from scratch pays to build.
3. Whether you need an enclave, managed security, documentation help, or GRC tooling — and whether you buy those before or after you've defined scope.

And a note of genuine hope: cost offsets exist. Some states fund CMMC readiness directly (Connecticut has offered grants up to $35,000), and on cost-reimbursable work, compliance spend can be treated as an allowable cost under FAR Part 31. [State program materials; FAR Part 31] Talk to your accountant and your contracts lead before you assume the whole bill is out of pocket.

For a deeper breakdown by scope, environment, and provider type, see our CMMC Level 2 cost guide.

When do the requirements hit? The four-phase rollout

The original rule codified four annual phases starting November 10, 2025. Phase 1 is active. On July 13, 2026, the Department suspended Phase II and all pending milestones — no new Level 2 (C3PAO) or Level 3 designations are permitted, and there is no announced replacement date. [32 CFR 170.3(e); DoW July 13, 2026 release]

The table below shows the original codified schedule with current suspension status. Phase 1 self-assessment obligations remain in force; Phases 2–4 are suspended. [Federal Register; DoW release]

Source: 32 CFR 170.3(e); DoD CIO CMMC resources.

These are the original rollout dates; the first year's historical end date does not terminate applicable Phase 1 self-assessment or safeguarding obligations.

The original November 10, 2026 Phase 2 transition is suspended. Readiness work may still be necessary for your current safeguarding, self-assessment, status, and affirmation obligations. Confirm the current written solicitation, contract modification, or subcontract requirement before committing to an assessment date. See the CMMC deadline status tracker for the current timeline and sources.

What changed in 2026? The FAR overhaul and clause renumbering

On February 1, 2026, a set of class deviations under the Revolutionary FAR Overhaul renumbered the cybersecurity clauses. DFARS 252.204-7019 was eliminated, DFARS 252.204-7020 was moved to DFARS 252.240-7997, and FAR 52.204-21 was renumbered to FAR 52.240-93. The CMMC clauses — 252.204-7021 and 252.204-7025 — and the safeguarding clause 252.204-7012 did not change. [DoD class deviation 2026-O0025; DFARS Part 240; DFARS Part 40]

The Revolutionary FAR Overhaul (RFO) began with Executive Order 14275 in April 2025 and is being implemented in two steps: interim class deviations now, formal rulemaking later. The first tranche — 31-plus DFARS class deviations — took effect February 1, 2026, creating a new FAR Part 40 and DFARS Part 240 to consolidate cybersecurity and supply-chain requirements. [DoD class deviations; industry legal analysis, incl. Wiley]The renumbering is administrative, but the practical effects are real.

The 2026 CMMC clause crosswalk

Use this crosswalk only with the applicable deviation and the actual clause version incorporated in your procurement. A renumbering does not, by itself, invalidate an older clause already incorporated in a contract.

Sources: DoD class deviation 2026-O0025 (DFARS 240.370-5); DFARS Part 40 / Part 240; corroborated by Wiley, Summit 7, and other 2026 legal and practitioner analyses.

Two things to do about all this:

• Expect to juggle both numbering systems. Solicitations issued after February 1, 2026 use the new numbers; older contracts and the current Code of Federal Regulations still show the old ones — until formal rulemaking catches up. [DoD class deviations]
• Update your proposal boilerplate and compliance mappings. If your SSP, templates, or training reference 52.204-21 or 7019/7020 by number, add the new citations now.

A quick naming note, because you'll see it in the wild: an executive order in September 2025 authorized "Department of War" as a secondary title for the Department of Defense in non-statutory communications. The CMMC rule (32 CFR Part 170) and the DFARS are statutory and regulatory, so they still say "Department of Defense." We use "DoD" throughout for that reason. [EO 14347; National Security Act of 1947]

Does CMMC use NIST SP 800-171 Rev. 2 or Rev. 3?

CMMC Level 2's assessment baseline remains NIST SP 800-171 Revision 2 under the current program rule. The July 13 implementation procedures also identify Revision 2 for the interim Level 2 self-assessment requirement. A newer NIST publication does not by itself amend CMMC's incorporated baseline. Distinguish the CMMC rule from separate DFARS safeguarding directions, and verify any future transition from its actual implementing source rather than assume an advance-notice period. See 32 CFR § 170.24 and the July 13 implementation procedures.

Your assessment today is against Rev. 2. Watch NIST's Computer Security Resource Center and the DoD CIO CMMC page for the transition, but don't let a vendor sell you a "Rev. 3-ready" program as if it were the current requirement. It isn't.

What if I'm not fully compliant? POA&Ms, conditional status, and the 80% rule

A Plan of Action and Milestones (POA&M) is not blanket permission to pass with gaps. Level 1 allows no POA&M at all. At Level 2, you can earn a Conditional status only if you have a weighted score of at least 88 out of 110 points, with every remaining gap eligible for a POA&M under 32 CFR § 170.21(a)(2), and every open item must be closed within 180 days of the Conditional CMMC Status Date. [32 CFR 170.21; Federal Register]

• Level 1: no POA&M. All 15 requirements must be fully met. [32 CFR 170.15]
• Level 2 — the 80% gate: you can achieve Conditional Level 2 with a weighted score of at least 88 out of 110 points, with every remaining gap eligible for a POA&M under 32 CFR § 170.21(a)(2). Fall below that, and a POA&M won't save the assessment.
• Not everything can go on a POA&M. The highest-weighted requirements — including multifactor authentication — generally cannot be deferred. A narrow exception exists around FIPS-validated encryption when encryption is deployed but not yet validated. [32 CFR 170.21; DoD Assessment Methodology]
• The 180-day clock is hard.If a closeout assessment doesn't confirm every item is met within 180 days, the Conditional Level 2 status expires, and standard contractual remedies apply. [Federal Register] Close the items and you convert to a Final status.

The 180-day conditional status milestone schedule

CMMC Level 2 scoring starts at a maximum of 110 points and subtracts the assigned values for requirements scored NOT MET. The rule provides limited scoring adjustments for multifactor authentication and CUI encryption; it is not an unrestricted partial-credit system. A qualifying score does not override the separate POA&M exclusions. See 32 CFR § 170.24.

How is the CMMC Final Rule actually enforced?

CMMC can affect award eligibility, maintenance of contractual status, and available contract remedies. Knowingly false cybersecurity representations can also create False Claims Act exposure when the legal elements are met. A deficiency or inaccurate statement does not, by itself, establish fraud.

Level 1 has an annual assessment cycle. Level 2 and Level 3 generally have three-year assessment cycles, with annual affirmations and continuous compliance still required. Conditional status has a separate 180-day closeout limit. Track the status for the actual system and required level, not just the date on a certificate.

Because a CMMC status is now a condition of award, a knowingly inaccurate affirmation can be a false statement to the government under the False Claims Act (FCA), which carries treble damages and whistleblower (qui tam) exposure. The DOJ's Civil Cyber-Fraud Initiative, launched in 2021, exists specifically to bring these cases. Aerospace-and-defense contractor Aerojet Rocketdyne agreed to a $9 million settlement in 2022 to resolve allegations it misrepresented its compliance with federal cybersecurity requirements. [DOJ; public court records]The lesson isn't to fear the rule — it's that the affirmation is a legal instrument, and it should be true.

The C3PAO problem you need to know about — and what to do

In January 2025, the DoD Office of Inspector General reported that DoD had not effectively implemented the process for authorizing the very organizations that perform Level 2 assessments. [DoD OIG, Report DODIG-2025-056] Reviewing 11 of the then-48 authorized C3PAOs, the OIG found:

• Two were authorized without a signed C3PAO Agreement and Code of Professional Conduct;
• Four had quality-control leads whose certifications were never verified; and
• All 11 were authorized without adequately confirming that certified assessors and quality-control leads were actually on staff or under contract. [DoD OIG, DODIG-2025-056; MeriTalk]

Verify that the proposed assessor is currently authorized or accredited for the work, and resolve concerns about its status or assessment team before engagement. This is a due-diligence step, not a conclusion about liability in a particular case.

For a curated list of authorized C3PAOs and what to verify, see our guide to the best C3PAOs for Level 2.

Where does the Defense Industrial Base actually stand?

For source-dated assessment counts and their limitations, use our CMMC assessment statistics tracker. Certification counts are not a measurement of overall industry readiness or appointment availability. We maintain the current source ledger there rather than duplicating figures that can go stale independently.

Do not book an assessment solely to beat the suspended November 10, 2026 transition. First establish a current contractual or business reason to pursue certification, then confirm readiness, the proposed scope, actual assessor availability, and the engagement's change or cancellation terms. Follow the CMMC deadline status tracker for official changes rather than an assumed restart date.

Assessor credentialing moved to ISACA (as the CMMC Assessor & Instructor Certification Organization, CAICO) in April 2026, and the Cyber AB is shifting from "standing up capacity" to accrediting assessors for consistency. [Cyber AB Town Hall, 2026]

What should you do now?

Your next step is not "hire a C3PAO." It's to confirm your required CMMC status, verify whether you handle FCI or CUI, define your assessment scope, check your SPRS record, and only then choose the provider category that matches your gap. [Acquisition.gov, 252.204-7025; 32 CFR 170] Sequence matters — buying before scoping is how contractors waste six figures.

Here's the checklist we'd run, in order:

1. Pull the paperwork — the solicitation, contract, subcontract, or prime flow-down.
2. Search it for the clauses — DFARS 252.204-7025 (your required status) and 252.204-7021 (your obligation to maintain it). Remember the new numbering for anything issued after February 1, 2026.
3. Identify your required CMMC status — Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC).
4. Confirm your data — FCI, CUI, both, or neither.
5. Map where FCI/CUI actually lives — email, ERP, file shares, CAD, supplier portals, removable media. This is your scope, and scope is your cost.
6. Check SPRS — is your status current? Are your CAGE codes, score, scope, and affirmation right?
7. Choose the provider category that fits the gap — internal, RP/RPO, MSSP/MSP, GRC platform, CUI enclave, or C3PAO.

Which provider category fits your next step?

The rule doesn't point you to one universal vendor. It points you to a category based on your gap. Note the independence rule baked into the last row.

A word on that last row: a firm that prepares you generally cannot also be the C3PAO that assesses that same work. Readiness and assessment must stay separate. [32 CFR 170.8; Cyber AB Code of Professional Conduct; CMMC Assessment Process] If a single vendor offers to "get you ready and certify you," that's a flag, not a convenience.

For small businesses, see our guide to CMMC providers for small businesses.

What we actually verified for this guide

We don't ask you to take our word for it. Here's the source behind each major claim, verified in June 2026 against primary or authoritative sources.

• The two rules and their effective dates — Federal Register (32 CFR Part 170, 89 FR 83092, effective Dec. 16, 2024) and the DFARS final rule (effective Nov. 10, 2025).
• The four-phase schedule — 32 CFR 170.3(e) and the DoD CIO CMMC resources page.
• Levels, scoping, POA&M limits, and the 80% rule — eCFR (32 CFR Part 170, incl. §§170.14, 170.16, 170.17, 170.19, 170.21, 170.23) and the Federal Register discussion of the final rule.
• NIST versions — NIST SP 800-171 Rev. 2 and NIST SP 800-172 (Feb. 2021) via NIST CSRC; Rev. 2 pinning via DoD class deviation.
• The 2026 clause renumbering — DoD class deviation 2026-O0025 (DFARS Part 240 / FAR Part 40), corroborated by Wiley, Summit 7, and other 2026 legal analyses.
• Cost estimates — the Regulatory Impact Analysis in 32 CFR Part 170 (Federal Register); market ranges attributed to industry sources, not to DoD.
• Enforcement and the C3PAO audit — Acquisition.gov (252.204-7012, 252.204-7021, 252.204-7025), SPRS documentation, and DoD OIG Report DODIG-2025-056.
• Ecosystem counts — the Cyber AB Town Hall (March 2026) and Cyber AB Marketplace; verify live figures at cyberab.org/marketplace.
• The department-naming note — Executive Order 14347 (Sept. 2025) and the National Security Act of 1947.

What we could not independently verify to the dollar: the exact market price of any specific assessment or provider engagement. Treat all market pricing here as ranges, not quotes.

CMMC Final Rule FAQ

Related reading

• CMMC Certification Process — step-by-step from scoping to SPRS
• CMMC Level 2 Assessment Guide — self vs. C3PAO, evidence, POA&M, and SPRS
• CMMC Level 2 Cost — DoD estimates vs. real market budgets
• CMMC Enclave Cost — how scope isolation changes your budget
• Best C3PAOs for Level 2 — what to verify before you sign
• CMMC Providers for Small Business — categories that fit small DIB budgets
• CMMC 2.0 Overview — the complete contractor decision resource

The Defense Compliance Report is the independent CMMC decision layer for defense contractors — mapping contract requirements, FCI/CUI scope, environments, provider categories, costs, and evidence into the next correct step before you hire. Choose the right CMMC path before you hire. This article is educational research, not legal, contractual, or compliance advice; confirm your requirements with a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney. Last reviewed June 2026.

Disclosure: The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification.