CMMC for Construction Contractors: What USACE and NAVFAC Bidders Need Now
By The Defense Compliance Report Editorial Team · Last verified: November 10, 2026
General information for the defense industrial base, not legal, contractual or compliance advice. Not affiliated with DoD, the Department of War, The Cyber AB, NIST or any government agency. Your solicitation, contract and contracting officer control what applies to you.
Short answer: As of November 10, 2026, DoD construction solicitations can only ask for CMMC Level 1 (Self) or CMMC Level 2 (Self). The July 13, 2026 memo that suspended CMMC Phase 2 bars new Level 2 (C3PAO) and Level 3 (DIBCAC) requirements. Contracting officers must amend active solicitations that still carry them. That does not make construction work exempt. USACE Portland's John Day Dam HVAC upgrade (a $25M to $100M job under NAICS 238220) makes Level 2 (Self) a condition of award. It also requires a NIST SP 800-171 assessment in SPRS before a bidder can even download the CUI documents. If your firm receives CUI-marked drawings, specifications or site security details, plan for Level 2 (Self). If you only handle basic contract information, Level 1 (Self) is the floor.
Who this page is for
- General contractors on MILCON, sustainment, restoration and modernization work, including MACC and JOC IDIQs.
- Architect-engineer (A-E) firms on design IDIQs that create or receive the government's drawings and specifications.
- Specialty trade subcontractors (HVAC, mechanical, electrical, plumbing, fire protection, controls) who receive plan sets from a prime.
If your firm designs products rather than facilities, CMMC for defense engineering firms is the closer fit. If you are a lower-tier sub on any DoD work, read CMMC for subcontractors alongside this page.
What CMMC requires in construction solicitations right now
| Item | Status on November 10, 2026 | Source |
|---|---|---|
| Phase 2 (planned for November 2026) | Suspended by the July 13, 2026 memo | USW(A&S) memo 26-P-1023 |
| Levels a requiring activity may designate | Level 1 (Self) or Level 2 (Self) only | Same memo, Attachment 1 |
| Level 2 (C3PAO) or Level 3 (DIBCAC) in an active solicitation | Must be removed by amendment "as soon as practicable" | Same memo, Attachment 1 |
| Level 2 (C3PAO) or Level 3 in an existing contract | Removed by modification before the next option or the next scheduled administrative modification | Same memo, Attachment 1 |
| CMMC waivers | Suspended during the review | Same memo, Attachment 1 |
| DFARS 252.204-7012 and NIST SP 800-171 Rev 2 | Still in effect | DFARS 252.204-7012 |
| Restart date for Phase 2 | None announced | DoD CIO CMMC program page |
The suspension changed who performs the assessment. A Level 2 (Self) assessment still scores your systems against all 110 NIST SP 800-171 Rev 2 requirements, and a senior official still affirms the result in SPRS.
What USACE and NAVFAC notices say
Three public notices on SAM.gov show how the rules are reaching construction bidders.
| Notice | What it says about CMMC | Status as checked November 10, 2026 |
|---|---|---|
| USACE Portland W9127N27BA007, John Day Dam Powerhouse HVAC Upgrades | Level 2 (Self) is a condition of award. The apparent successful offeror must have a current Level 2 (Self) status in SPRS for each relevant CMMC UID. Subs handling FCI only need Level 1 (Self); subs handling CUI need Level 2 (Self) current in SPRS before subcontract award. Access to FCI or CUI documents requires an active SAM registration and a current NIST SP 800-171 assessment (at least Basic confidence) in SPRS. | Presolicitation published October 29, 2026; IFB, firm-fixed-price, $25M to $100M, NAICS 238220. Renumbered from W9127N26BA006. |
| NAVFAC SW IDIQ JOC, NAS Lemoore (N6247324R0054) | Amendment 0004 revised the CMMC requirement at award to Level 2 (Self) and updated DFARS clauses. | EDWOSB set-aside, NAICS 238990; offers were due August 24, 2026. |
| NAVFAC SW Notice to Industry (N62473CMMCNotice) | Covers all NAVFAC SW planning, design and construction MACCs and A-E IDIQs. Says IDIQ awards on or after November 10, 2026 require Level 2 (C3PAO) or higher. | Published March 27, 2026, before the suspension, and still posted as Active. The July 13 memo bars new C3PAO designations, and the Lemoore amendment shows NAVFAC SW revising to Level 2 (Self). |
Read the NAVFAC SW notice as a signal of where the program was heading before July, not as the current requirement. The level that binds you is the one in the solicitation or task order in front of you. If a construction solicitation issued after July 13 still names Level 2 (C3PAO), ask the contracting officer in writing whether an amendment is coming.
What counts as CUI on a construction project
CMMC Level 2 applies when your information systems process, store or transmit CUI. On a construction job, CUI usually arrives with the solicitation package or the prime's plan set. The government decides what is CUI and marks it. Your job is to recognize the markings and keep that data inside the systems you assess.
| CUI category (CUI Registry) | What the registry says | Where it shows up on a job |
|---|---|---|
| DoD Critical Infrastructure Security Information | Includes "site-specific information on or relating to installation security," vulnerability assessments and explosives safety information | Site plans showing security features, anti-terrorism and force protection details, utility vulnerabilities |
| Physical Security (PHYS) | Information related to protection of federal buildings, grounds or property | Access control layouts, intrusion detection, guard and gate designs |
| Controlled Technical Information | Technical information with military or space application, marked with distribution statements B through F | Specifications and drawings for mission systems housed in the facility |
Unmarked bid documents, public pre-bid notices and your own estimating data are usually not CUI. A drawing set with a CUI banner or a distribution statement is. When you are unsure, ask the contracting officer, and treat the file as CUI until they answer. Our guide to CUI marking requirements covers how banners and distribution statements look.
Which construction systems fall in scope
The scoping rule in 32 CFR 170.19 sorts assets into CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets (including operational technology and IoT) and out-of-scope assets. Construction firms have a few asset types that office-based contractors rarely deal with.
| Construction asset | Why it matters for CMMC | NIST SP 800-171 Rev 2 requirements to plan for |
|---|---|---|
| Plan-room server, SharePoint or file share holding CUI drawings | CUI asset | 3.1.1 and 3.1.2 limit access to authorized users and functions; 3.3.1 audit logs |
| Project management and document control platform | External cloud system that stores CUI | 3.1.20 external systems; DFARS 7012 FedRAMP Moderate equivalence (see next section) |
| Field tablets and superintendents' laptops | CUI moves to the jobsite on these | 3.1.18 control mobile devices; 3.1.19 encrypt CUI on mobile devices; 3.5.3 multifactor authentication |
| Printed plan sets | Paper is media under NIST SP 800-171 | 3.8.1 protect paper and digital media; 3.8.4 mark media; 3.8.5 control media in transport; 3.8.3 destroy before disposal |
| Jobsite trailer or field office | Physical location where CUI is used | 3.10.1 to 3.10.5 physical access, visitors, access logs and devices; 3.10.6 alternate work sites |
| Building automation and controls you install | Often Specialized Assets (OT) under 170.19 | Documented in your SSP; handled per the asset category |
| Public bid sites and plan-sharing links | CUI must not be posted to publicly accessible systems | 3.1.22 control CUI on publicly accessible systems |
Several of these requirements can't go on a POA&M. Under 32 CFR 170.21, 3.1.20 (external systems), 3.1.22 (publicly accessible systems), 3.10.3 (escort visitors), 3.10.4 (physical access logs), 3.10.5 (physical access devices) and 3.12.4 (system security plan) must be met at assessment time. For a firm with jobsite trailers and shared plan links, those six are where self-assessments most often fall short.
Keeping CUI in one controlled environment is the main way to shrink this list. See our CMMC scoping guide and CMMC scope reduction for how enclaves work.
Construction software and FedRAMP: what the marketplace shows
DFARS 252.204-7012 paragraph (b)(2)(ii)(D) requires that an external cloud service provider storing, processing or transmitting covered defense information meet security requirements equivalent to the FedRAMP Moderate baseline. Several construction platforms list a government offering on the FedRAMP Marketplace.
| Offering (FedRAMP Marketplace listing) | Status | Impact level | Authorization date |
|---|---|---|---|
| Procore for Government | FedRAMP Authorized | Moderate | January 23, 2026 |
| Autodesk for Government | FedRAMP Authorized | Moderate | August 14, 2024 |
| Kahua Government Network | FedRAMP Authorized | Moderate | March 15, 2022 |
| Oracle Aconex for Defense | FedRAMP Authorized | Moderate | October 30, 2020 |
| Oracle Primavera Cloud for Government | Agency In Process | Moderate | Not yet authorized |
Data from FedRAMP's public marketplace dataset, last updated November 9, 2026. A listing covers the named government offering. Ask the vendor in writing whether your account is on that offering or on its standard commercial service, and get their customer responsibility matrix. You still own the configuration, user access and any copies your team downloads. This is not an endorsement, and we have no commercial relationship with these vendors.
Level 1 or Level 2: which one fits your firm
| Your situation | Likely CMMC status needed | Basis |
|---|---|---|
| You hold a DoD construction contract or subcontract but never receive CUI | Level 1 (Self), annual | 32 CFR 170.23 for subs handling FCI only |
| You receive CUI-marked drawings or specifications | Level 2 (Self) during the suspension | Solicitation requirement; 170.23 for subs handling CUI |
| A prime asks you for Level 2 (C3PAO) | Ask whether the prime contract still carries it; the July 13 memo bars new C3PAO designations | July 13 memo; 170.23 says subs follow the prime's assessment type when it is C3PAO |
| You only sell commercially available off-the-shelf items | CMMC does not apply to COTS-only procurements | 32 CFR 170.3 |
Our Level 1 vs Level 2 comparison goes deeper on the difference.
How Level 2 (Self) works for a construction firm
- Score your systems against NIST SP 800-171 Rev 2. Use the 110 requirements and the DoD scoring method. A perfect score is 110.
- Post the result in SPRS. 32 CFR 170.16 requires the results, including scope and CAGE codes, to go into SPRS. The SPRS CMMC page has the entry steps.
- Use a POA&M only within the limits. A conditional status needs a score of at least 88 of 110, only 1-point requirements may be open (with one narrow encryption exception), and open items must close within 180 days.
- Have your affirming official sign. Under 32 CFR 170.22, a senior official affirms compliance at each assessment and every year after.
- Flow it down. Your subs that will receive CUI need their own current Level 2 (Self) status in SPRS before you award their subcontract. The John Day notice states this directly.
- Repeat on schedule. Level 2 (Self) is a full self-assessment every three years plus an annual affirmation.
Our CMMC Level 2 assessment guide and SPRS score guide cover the scoring details. If your SPRS score is low, read how to improve your SPRS score before you post.
The DFARS clauses in a construction solicitation, decoded
DoD's Revolutionary FAR Overhaul changed some clause numbers in 2026. Under Class Deviation 2026-O0025 Rev 3, dated September 3, 2026, newer solicitations may show different numbers than older ones.
| Clause you may see | What it does |
|---|---|
| DFARS 252.204-7012, now dated (JUN 2026)(DEVIATION 2026-O0025) | Requires NIST SP 800-171 for covered defense information, 72-hour cyber incident reporting, FedRAMP Moderate equivalence for cloud providers and flowdown to subs |
| DFARS 252.240-7997 | The NIST SP 800-171 DoD Assessment clause under the deviation (renumbered from 252.204-7020; the 252.204-7019 provision is no longer prescribed) |
| DFARS 252.204-7021 | Requires you to keep the CMMC level in SPRS through performance, affirm annually and flow the requirement to subs |
| DFARS 252.204-7025 | Solicitation notice: you are not eligible for award without a current CMMC status and affirmation in SPRS, and you list CMMC UIDs in your offer |
For a fuller explanation of the incident reporting duty, see DFARS 252.204-7012 explained.
What CMMC costs a construction firm
DoD's own estimates in the CMMC final rule assume you have already implemented NIST SP 800-171. They cover the assessment and affirmation only, not the cost of fixing gaps.
| Assessment (small entity) | First assessment and affirmation | Three-year cost in the rule |
|---|---|---|
| Level 2 (Self) | $34,277 | $37,196 |
| Level 2 (C3PAO), suspended for new solicitations | $101,752 | $104,670 |
Implementation is usually the larger number for construction firms, because field devices, jobsite offices and cloud project platforms all have to be brought into scope or kept out of it. Estimate your own range with the CMMC cost calculator, and see CMMC cost for small business for typical line items.
Your first 30 days before the next bid
- Pull the solicitation and find the CMMC level. Look for DFARS 252.204-7025 and the stated level. On the John Day notice it is Level 2 (Self).
- Check your SPRS entry now. The USACE notice requires a NIST SP 800-171 assessment in SPRS before you can access CUI documents, so a missing score can lock you out before bidding starts.
- List every place CUI drawings will live. Plan room, project platform, email, field tablets, printed sets, and your subs' systems.
- Pick one controlled environment for CUI. Decide which platform holds CUI and keep it off general file shares and public plan links.
- Write or update your system security plan. 3.12.4 cannot be deferred to a POA&M.
- Fix the jobsite basics. Visitor escorts, physical access logs and control of keys and badges (3.10.3 to 3.10.5) also cannot be deferred.
- Ask your subs for their SPRS status. Our subcontractor SPRS request guide covers what to ask for, and the CMMC flow-down requirements page explains the prime's duty.
- Name your affirming official. That person signs in SPRS and carries the affirmation; read affirming official liability first.
Common mistakes on construction jobs
- Treating the suspension as a pause on everything. The July 13 memo keeps DFARS 7012 and Level 2 (Self). The John Day notice shows USACE still enforcing it at award.
- Sharing CUI drawings through open links. Posting or linking CUI where the public can reach it fails 3.1.22, which can't go on a POA&M.
- Ignoring paper. NIST SP 800-171 3.8.1 covers paper media. Printed plan sets in an unlocked trailer are in scope.
- Assuming a vendor's FedRAMP listing covers your account. Confirm which offering your tenant is on.
- Waiting for the prime to tell subs what to do. Under 170.23, subs handling CUI need their own Level 2 (Self) status before subcontract award.
Which provider category fits a construction firm
| If you need | Provider category | Start here |
|---|---|---|
| A score, SSP and POA&M before a bid | Readiness consultant or RPO | CMMC consultant |
| A controlled place to keep CUI drawings | CUI enclave or GCC High provider | CUI enclave providers |
| Ongoing IT plus compliance | Managed service provider | CMMC provider categories |
The CMMC provider categories page explains how these differ. Find My CMMC Path is free; we may receive a referral fee from providers, and providers can't pay for placement in a recommendation.
CMMC for construction contractors: FAQ
Do construction contractors need CMMC?
Yes, when the DoD contract or subcontract includes a CMMC requirement. Firms that handle only Federal Contract Information need Level 1 (Self). Firms that handle CUI need Level 2 (Self) during the current suspension. COTS-only procurements are excluded under 32 CFR 170.3.
Is CMMC Level 2 (C3PAO) required for NAVFAC work after November 10, 2026?
Not under the current rules. NAVFAC SW's March 27, 2026 notice anticipated Level 2 (C3PAO) for IDIQ awards after November 10, 2026. The July 13, 2026 memo bars new Level 2 (C3PAO) designations during the suspension, and NAVFAC SW amended the NAS Lemoore JOC solicitation to Level 2 (Self). Check the level in each solicitation or task order.
Are construction drawings CUI?
Only when the government has designated and marked them. Site-specific installation security information falls under DoD Critical Infrastructure Security Information. Physical security designs can fall under Physical Security. Technical information with military application marked with distribution statements B through F is Controlled Technical Information.
Do HVAC and electrical subcontractors need CMMC?
If they receive CUI, yes. The USACE John Day HVAC notice requires Level 2 (Self), current in SPRS, before subcontract award for any sub that will process, store or transmit CUI. Subs that receive only FCI need Level 1 (Self).
Do I need a SPRS score before I can see the drawings?
On the John Day Dam solicitation, yes. Contractors requesting access to documents with FCI or CUI must have an active SAM registration and a current NIST SP 800-171 assessment with at least a Basic confidence level in SPRS.
Are printed plan sets in scope?
Yes. NIST SP 800-171 Rev 2 requirement 3.8.1 covers system media containing CUI, both paper and digital. Plan for storage, marking, transport and destruction of printed sets.
Can we use Procore or Autodesk for CUI drawings?
Procore for Government and Autodesk for Government are listed as FedRAMP Authorized at Moderate on the FedRAMP Marketplace. DFARS 7012 requires FedRAMP Moderate equivalence for cloud providers that hold covered defense information. Confirm with the vendor that your account is on the government offering.
When will CMMC Phase 2 restart?
No restart date has been announced as of November 10, 2026. Watch the DoD CIO CMMC page and new solicitations for the next change.
How much does CMMC Level 2 (Self) cost?
DoD's final rule estimates $34,277 for a small entity's first Level 2 self-assessment and affirmation, and $37,196 over three years. Those figures assume the security requirements are already in place.
What we verified
On November 10, 2026 we opened each primary source linked on this page: the July 13, 2026 suspension memo, 32 CFR Part 170 sections 170.3, 170.16, 170.19, 170.21, 170.22 and 170.23 on eCFR, DFARS 252.204-7012, 7021 and 7025, Class Deviation 2026-O0025 Rev 3, NIST SP 800-171 Rev 2, three CUI Registry categories, the three SAM.gov notices, the FedRAMP Marketplace dataset updated November 9, 2026, and the CMMC final rule cost estimates. Notices and marketplace listings can change; check the live source before you bid.
Sources
- USW(A&S) memo 26-P-1023, Implementing Suspension of CMMC Phase 2 (July 13, 2026)
- USACE Portland, John Day Dam Powerhouse HVAC Upgrades, W9127N27BA007 (SAM.gov)
- NAVFAC SW, IDIQ JOC All Other Specialty Trade Projects, NAS Lemoore, N6247324R0054 (SAM.gov)
- NAVFAC SW, Notice to Industry: Application of CMMC Requirements, N62473CMMCNotice (SAM.gov)
- 32 CFR 170.3, Applicability
- 32 CFR 170.16, CMMC Level 2 self-assessment
- 32 CFR 170.19, CMMC scoping
- 32 CFR 170.21, Plan of Action and Milestones requirements
- 32 CFR 170.22, Affirmation
- 32 CFR 170.23, Application to subcontractors
- DFARS 252.204-7012
- DFARS 252.204-7021
- DFARS 252.204-7025
- DFARS Class Deviation 2026-O0025 Rev 3 (Part 240)
- NIST SP 800-171 Rev 2 (PDF)
- CUI Registry: DoD Critical Infrastructure Security Information
- CUI Registry: Physical Security
- CUI Registry: Controlled Technical Information
- FedRAMP Marketplace
- SPRS CMMC resources
- CMMC Program final rule, 89 FR 83092 (October 15, 2024)