CMMC Level 2 Required in Solicitation: What To Do Now

By The Defense Compliance Report Editorial Team · Last reviewed: June 2026 · Last verified: June 18, 2026

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We are not affiliated with the Cyber AB, the Department of Defense, DCMA DIBCAC, NIST, or any U.S. government agency. This is educational research, not legal, contractual, or compliance advice — confirm scope and applicability with a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney.

The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor’s level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.

If CMMC Level 2 is required in your solicitation and you’re not sure what to do, the single most important first move is to read the exact status the contracting officer wrote and see whether it says Level 2 (Self) or Level 2 (C3PAO). Those two words point to very different work, cost, and lead time. You also need a current CMMC status in the Supplier Performance Risk System (SPRS) at the required level before award — for Level 2, a current Conditional status can support award while you finish remediation; Level 1 must be Final (it allows no Conditional status).

That’s the bottom line. Now the part that actually settles the panic: seeing “CMMC Level 2” in an RFP, RFQ, or a prime’s flow-down email does notautomatically mean you’ve lost the bid. It means a clock started. Whether you can still win this one — and what you do in the next 48 hours — comes down to a handful of specific facts you can check today. We read the actual clause language on Acquisition.gov and the CMMC rule in the Code of Federal Regulations so you can move on verified information.

Quick triage: read this in 60 seconds

Definitions and the full matrix are below. CUI = Controlled Unclassified Information. FCI = Federal Contract Information. C3PAO = Certified Third-Party Assessment Organization. TDP = Technical Data Package.

What does “CMMC Level 2 required” actually mean in a solicitation?

When a Department of Defense (DoD) solicitation says CMMC Level 2 is required, it means the contracting officer has identified a CMMC status you must hold before award for each information system that will process, store, or transmit FCI or CUI during performance. The required status is set in the solicitation provision DFARS 252.204-7025 (“Notice of Cybersecurity Maturity Model Certification Level Requirements”), and the matching contract clause DFARS 252.204-7021 governs what you must maintain after award. “Required prior to award” is an eligibility gate, not a problem you can resolve later. (DFARS 252.204-7025; DFARS 252.204-7021, Acquisition.gov.)

Here’s the mechanic most explainers skip. The 7025 provision contains a fill-in-the-blank line — “The CMMC level required by this solicitation is: ____” — and the contracting officer is instructed to insert exactly one of four options: CMMC Level 1 (Self), CMMC Level 2 (Self), CMMC Level 2 (C3PAO), or CMMC Level 3 (DIBCAC). That level (or higher) is required prior to award for each in-scope system. We pulled that language directly from the provision text on Acquisition.gov. So your first job isn’t to study a 110-control checklist. It’s to find that filled-in value and read it carefully.

Cybersecurity Maturity Model Certification (CMMC) is the DoD’s program for verifying that defense contractors have actually implemented the cybersecurity requirements they’ve been contractually obligated to meet for years. It became a federal rule when 32 CFR Part 170 took effect on December 16, 2024, and it began appearing in contracts when the acquisition rule — the DFARS rule effective November 10, 2025 — went live. We are currently in Phase 1 (November 10, 2025 through November 9, 2026), the first stage of a multi-year rollout. That timing matters, and we’ll come back to it. (32 CFR Part 170; Federal Register, DFARS Case 2019-D041.)

Where to find the CMMC language in your solicitation

Open the document and search the text for “CMMC,” “252.204-7025,” and “252.204-7021.” The required level lives in the 7025 provision. You may also see CMMC references in Section L (instructions to offerors), Section M (evaluation), a CUI or cybersecurity attachment, or a data-access requirement tied to drawings or a TDP. If a prime sent you a flow-down, the requirement may sit in a subcontract clause or a teaming document instead.

Clause map: what each DFARS clause does — and doesn’t

The Defense Federal Acquisition Regulation Supplement (DFARS) uses several cybersecurity clauses that contractors routinely confuse. They are not interchangeable.

Sources: clause text on Acquisition.gov (DFARS 252.204-7012, -7019, -7020, -7021, -7025).

For a deeper read on the safeguarding clause, see our explainer on DFARS 252.204-7012. And if you’re seeing 7012 but not7021 or 7025, that combination means something specific — confirm whether the CMMC award gate applies.

Do not submit CUI, drawings, or sensitive contract details into the tool. We may receive compensation for qualified introductions or partner referrals when disclosed; compensation does not control our regulatory analysis or provider-category routing.

First, find out if it says “Level 2 (Self)” or “Level 2 (C3PAO)”

Level 2 (Self) and Level 2 (C3PAO) both require implementing the same 110 security requirements from NIST SP 800-171 Revision 2, organized into 14 control families — but they are not the same award path. Level 2 (Self) means you conduct the self-assessment and post the result in SPRS. Level 2 (C3PAO) means a Certified Third-Party Assessment Organization (C3PAO) — an independent assessor authorized by the Cyber AB — must assess and certify you, with results recorded in the CMMC instance of eMASS. A Level 2 (Self) status does not satisfy a Level 2 (C3PAO) requirement. (NIST SP 800-171 Rev. 2, NIST CSRC; 32 CFR §§ 170.16–170.17.)

This is the fork that changes everything. Same controls, different verifier — and the C3PAO path typically adds tens of thousands of dollars in assessment fees alone (commonly in the ~$30,000–$80,000+ range in 2026 market reporting), plus scheduling lead time, because you need an outside assessor’s calendar and a higher bar of documented evidence. So the difference between those two words in your solicitation can be a six-figure swing in what you have to do. See our guide on CMMC Level 2 cost for current ranges. Read the line before you spend a dollar.

Level 2 Self vs Level 2 C3PAO at a glance

Sources: DoD CIO CMMC resource (About CMMC); 32 CFR Part 170; NIST SP 800-171 Rev. 2.

Why “Self” doesn’t mean “easy”

This catches good companies off guard, so we’ll say it plainly: Level 2 (Self) is not a lighter standard. You still implement all 110 requirements and their assessment objectives (NIST SP 800-171A defines the assessment objectives behind those 110 requirements). The only thing “Self” removes is the third-party assessor — not the work, not the evidence, and not the annual affirmation signed by a senior official. Because both paths use the same 110-control baseline, the implementation and remediation work — usually your biggest expense — overlaps heavily. The C3PAO path adds the assessor’s fee and a higher evidence bar on top. See our CMMC Level 2 checklist and assessment preparation guide for what the evidence bar actually looks like.

Can the contracting officer require C3PAO right now, during Phase 1?

Yes. During Phase 1 — the first 12 months — the Department’s stated intent is that most solicitations use self-assessments for Levels 1 and 2, but the rule gives program offices discretion to require Level 2 (C3PAO) even now, and some live solicitations already do. Phase 2 begins November 10, 2026, the stage where DoD intends to require Level 2 (C3PAO) as a condition of award for applicable CUI contracts (DoD may instead defer that requirement to a contract option period in some cases). So don’t assume “we’re in Phase 1, so it must be Self.” Read the provision. (32 CFR § 170.3(e); DoD CIO CMMC resource.)

Here’s the honest part, before we go further. If your solicitation requires Level 2 (C3PAO), you’ve done little or no NIST SP 800-171 work, and the proposal is due in the next 60–90 days — you almost certainly cannot become certified in time, and no consultant, managed service provider, or software platform can change that. The 110 controls take months to implement and document, and C3PAO assessment calendars are limited. Pretending otherwise would cost you money and trust.

But “not certified in time for this one” is not the same as “out.” You have real, legitimate options — a Conditional statusif you can get close enough, teaming or subcontracting with a partner who already holds the status, or asking the contracting officer about timing and scope. We cover all of them below. We’d rather route you to a workable path than sell you false hope.

Can you still bid? What you need in SPRS before award

For a solicitation using DFARS 252.204-7025, “we’re working on CMMC” is not enough. To be eligible for award, you must have — for each information system that will handle FCI or CUI — a current CMMC status in SPRS at the required level or higher, a current annual affirmation of continuous compliance, and the applicable CMMC Unique Identifier (UID). A contracting officer shall not award to an offeror that lacks the required current status in SPRS at award. The relief valve: for Level 2, a current Conditional status can support award while you finish remediation; Level 1 must be Final (it allows no Conditional status). (DFARS 252.204-7025; DFARS Subpart 204.75, Acquisition.gov.)

Three terms award eligibility turns on:

• SPRS (Supplier Performance Risk System): the DoD system of record where your CMMC status and assessment results are posted. Contracting officers check it. See: how to verify CMMC status in SPRS.
• CMMC UID (Unique Identifier): a 10-character alphanumeric identifier assigned to each CMMC assessment and reflected in SPRS for each contractor information system. The 7025 provision requires you to list the applicable UID(s) in your proposal. (DFARS 252.204-7021.)
• Annual affirmation: a yearly attestation of continuous compliance, entered in SPRS by a senior Affirming Official, confirming you still meet the requirements. (32 CFR § 170.22.)

One precise detail that trips up companies that “did CMMC a while ago”: under DFARS 252.204-7021, a Final Level 2 status is considered current only if it’s not older than three years, with an affirmation not older than one year. A lapsed affirmationcan break an otherwise-valid status. We confirmed these “current” definitions in the clause text on Acquisition.gov.

What to verify in SPRS — today

CMMC Level 2 required in solicitation: your first 48 hours

In your first 48 hours, don’t start with vendor calls — start by extracting facts. Copy the exact clause language, identify Self vs C3PAO, confirm the proposal and award timing, check SPRS, map which systems touch FCI or CUI, and document any question that must go to the contracting officer or prime. Vendor selection comes afteryou know what you’re actually solving.

Want a self-serve next step you can take without talking to anyone? Our CMMC Readiness Checklistwalks the 14 NIST SP 800-171 Rev. 2 control families so you can see, roughly, how far your current environment is from Level 2 before you spend on outside help. Treat it as a deliverable, not a sales call — it’s there to lower your uncertainty.

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification.

What we actually verified for this page

We built this from primary and official sources, not secondhand summaries. Here’s what we checked and what each source establishes, so you can verify any claim yourself.

We did not verify your specific solicitation, systems, scope, or status — we can’t see them. This page explains the official rule structure and points you to the right next step. For your situation, confirm scope and applicability with a CMMC RP/RPO or a qualified federal-contracts attorney. See our methodology and corrections policy.

CMMC Level 2 required in solicitation: FAQ