CMMC Program Rule vs Acquisition Rule: 32 CFR vs 48 CFR

By The Defense Compliance Report Editorial Team · Last reviewed: July 2026

First, the fast orientation. Here’s which rule to look at, depending on what you’re actually asking:

The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor’s level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.

CMMC Program Rule vs Acquisition Rule: what’s the difference?

The cleanest way to hold it in your head: 32 CFR Part 170 is the engine. The DFARS acquisition rule is the ignition. The engine defines how everything works. The ignition is what actually turns it on inside a specific contract. You can have a fully built engine sitting in the garage — that’s where CMMC was between December 2024 and November 2025 — and nothing new happens on your contracts until someone turns the key.

Here’s the full side-by-side. We built this from the rules themselves, not from other people’s summaries.

The two-rule crosswalk

Sources: 32 CFR Part 170 and 89 FR 83092; 90 FR 43560 (DFARS Case 2019-D041).

One point worth pinning down, because it feeds a lot of the confusion: the 2025 acquisition rule did not invent DFARS 252.204-7021. That clause traces back to a 2020 interim DFARS rule (which introduced the 7019/7020/7021 series). The 2025 final rule revised 252.204-7021 for CMMC 2.0 and added 252.204-7025 as a genuinely new solicitation provision. So when you read that the rule “added the CMMC clause,” read it as updated an existing one and added a new companion. For detail on the earlier clause history, see our CMMC Final Rule guide and the 32 CFR Part 170 deep-dive.

And a naming note, since it comes up: some 2025–2026 materials refer to the “Department of War.” We use “Department of Defense (DoD)” here because the FAR and DFARS — the regulations that actually govern your contract — still use “DoD.”

What does the CMMC Program Rule (32 CFR Part 170) actually define?

The Program Rule defines the CMMC model and how a contractor achieves and keeps a status. It covers the requirement sources for Level 1, Level 2, and Level 3; the assessment types; the scoring methodology; scoping; the narrow POA&M rules; the affirmation duty; and how requirements flow to subcontractors. It is the “what” and the “how.” It is not, by itself, a contract clause.

Think of everything below as living inside 32 CFR Part 170. None of it changes because a solicitation does or doesn’t mention CMMC — it’s the fixed standard the contract points to.

The three levels and where their requirements come from

Level 1 uses the 15 basic safeguarding requirements in FAR 52.204-21. Level 2 is identical to the 110 security requirements in NIST SP 800-171 Revision 2, organized into 14 control families and measured against 320 assessment objectives. Level 3 layers 24 selected enhanced requirements from the February 2021 version of NIST SP 800-172 on top of Level 2.

That last row of the crosswalk is the one that saves people money, so it’s worth stating plainly: Level 2 is the big one. It’s the CMMC path for contractor systems that will process, store, or transmit Controlled Unclassified Information (CUI) when CMMC applies — and the solicitation decides whether that path is Level 2 (Self) or Level 2 (C3PAO). It maps to NIST SP 800-171 Revision 2, not Revision 3 (more on that trap shortly). Level 1 is the FCI-only floor. Level 3 is the small universe of priority DoD programs that need the highest assurance, assessed by DIBCAC. See our CMMC levels overview for the full breakdown and our FCI vs CUI guide for the information-type distinction.

Assessment types and CMMC statuses

CMMC statuses come in Conditional and Final flavors, and they’re tied to a specific assessment type: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), and Level 3 (DIBCAC). Level 1 and Level 2 self-assessments are done by the contractor; a Level 2 certification assessment is done by an authorized C3PAO; a Level 3 assessment is done by the government’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).

This is the distinction to never blur: a Level 2 (Self) status is nota Level 2 (C3PAO) status. If your contract requires C3PAO certification, a self-assessment doesn’t satisfy it — no matter how thorough your self-assessment was. Which assessment type you need is set by the contract, using the level definitions in the Program Rule. For a full walk-through of the four assessment paths and what each involves, see our CMMC certification process guide.

Scoring, POA&Ms, and conditional status

For Level 2, scoring starts at 110 and deducts points for unmet requirements. To earn a Conditional Level 2 status, your score divided by the total requirements must be at least 0.8 — that’s a minimum of 88 out of 110— and only certain gaps can go on a Plan of Action and Milestones (POA&M). Level 1 does not allow POA&Ms at all.

The POA&M rules are stricter than most people assume, and this is where contractors get burned. Only requirements worth 1 point can go on a POA&M; the 3- and 5-point requirements must be fully implemented before your assessment. There’s one narrow exception for CUI encryption that isn’t yet FIPS-validated. Six specific 1-point controls are prohibited from a POA&M entirely. And the clock is real: you have 180 daysfrom your Conditional CMMC Status Date to close out every POA&M item, or your Conditional status expires and standard contractual remedies apply. For the full rules, see our Conditional Level 2 and POA&M closeout page.

Annual affirmation and the CMMC UID

The Program Rule requires an affirmation of continuing compliance — an initial one after assessment (and after POA&M closeout, where applicable) and then annually — submitted electronically in the Supplier Performance Risk System (SPRS). Each assessed system also gets a CMMC Unique Identifier (UID): a ten-character alphanumeric code that lives in SPRS.

Two things people miss here. First, the affirmation is a separate, recurring duty — you can have a passing score and still fall out of compliance by missing your annual affirmation. Second, the affirmation is signed by a designated “affirming official”(the acquisition rule replaced the older term “senior company official” with “affirming official”), so there’s a named human on the hook for it. Sources: 32 CFR § 170.22 and the DFARS acquisition rule.

What does the CMMC Acquisition Rule (the DFARS rule) actually do?

The Acquisition Rule amends the DFARS to make CMMC operational in DoD acquisitions. It tells contracting officers when to use the CMMC contract clause and solicitation provision, and it ties your eligibility for award and performance to a current CMMC status and affirmation in SPRS. It doesn’t touch the security controls — it’s the contracting machinery that turns the Program Rule’s standard into a hard requirement on a specific procurement.

Two DFARS clauses do the work. Here’s what each one is and what to look for.

DFARS 252.204-7025 — the solicitation provision (your early warning)

DFARS 252.204-7025, “Notice of Cybersecurity Maturity Model Certification Level Requirements,” is the provision that appears in the solicitation. It’s where the contracting officer inserts the required level and assessment type — Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC) — and it makes an offeror ineligible for award without the required current CMMC status and a current affirmation in SPRS for the systems that will touch FCI or CUI. It also requires offerors to provide the CMMC UIDs for those systems.

DFARS 252.204-7021 — the contract clause (your ongoing obligation)

DFARS 252.204-7021, “Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements,” is the clause that lands in the contract. It requires you to maintain the required current CMMC status for the period of performance, file annual affirmations in SPRS, report your CMMC UIDs, process FCI or CUI only on systems that hold the required status, and flow the requirement down to applicable subcontractors.

Two words in this clause carry a lot of weight. “Current” isn’t marketing language — the rule defines it precisely and differently depending on whether your status is conditional, Final Level 1, Final Level 2, or Final Level 3, and whether your affirmation is up to date. And “maintain” means this isn’t a one-time gate; if a Level 2 (C3PAO) or Level 3 certification expires during performance, you’re expected to renew at or above the required level, and failure can trigger standard contractual remedies. Source: DFARS 252.204-7021 on Acquisition.gov.

DFARS 204.7504 — when contracting officers must use the clauses

Codified DFARS 204.7504 prescribes when officers use -7021 and -7025. It carries the COTS-only exclusion and a phase-specific structure that runs through November 9, 2028 before full Phase 4 use. (During the February 2026 FAR overhaul transition, DoD reorganized these information-security provisions under a new DFARS Part 240 through class deviations, so you may see them cited under both the codified Part 204 structure and the deviation’s Part 240 structure — the requirement itself is the same. More on that below.)

Which rule actually creates your obligation?

So when a question comes up, the useful move is to figure out which rule answers it. We built this matrix to do exactly that — map the real question to the controlling rule, the source, and where to look.

Which rule answers my question?

When did each rule take effect, and what phase are we in now?

Two dates cause most of the timeline confusion, so keep them separate: December 16, 2024 (Program Rule effective — the standard exists, voluntary assessments allowed) and November 10, 2025 (Acquisition Rule effective — CMMC can now appear in contracts). No new CMMC contract-clause requirement was triggered by the December 2024 date by itself. (Existing cyber clauses like DFARS 252.204-7012 and FAR 52.204-21 already imposed safeguarding and incident-reporting duties long before CMMC — CMMC adds the assessment, certification, and affirmation layer on top.) The November 2025 date is when the key turned.

The CMMC phase-trigger matrix

Source: the phase schedule at 32 CFR § 170.3 and the acquisition rule’s November 10, 2025 effective date.

The scale here is why the phase-in exists. In its regulatory analysis, DoD estimated the CMMC expansion would affect 337,968 contractors and subcontractors, including roughly 229,818 small businesses, with the ramp starting small — on the order of 1,100 small entities in year one — and widening each year. That’s the real reason not to treat a distant phase date as a comfortable runway: certification depends on a finite pool of authorized C3PAOs, and demand climbs as the phases advance. Before you assume a Phase 2 date gives you plenty of time, verify current authorized C3PAO availability in the Cyber AB Marketplace and back into your timeline from there. Source: 90 FR 43560.

For a deep dive on the November 2026 Phase 2 milestone and exactly which contracts it affects, see our CMMC Phase 2 deadline guide.

How DFARS 252.204-7012, 7019, 7020, 7021, and 7025 fit together after the February 2026 FAR overhaul

This is the single biggest source of fresh confusion in the market right now, so let’s be precise. A wave of “DFARS 7019 and 7020 are gone” and “no more basic self-assessments” headlines hit in early 2026. Read fast, they sound like CMMC changed. It didn’t. What changed is the plumbing around the oldNIST SP 800-171 self-assessment path — the one that predates CMMC going live. Here’s the clause-by-clause reality, built from the DoD class-deviation index and the current DFARS text.

What the 2026 FAR overhaul changed — and what it didn’t

Two practical cautions. First, because this was done by class deviation rather than formal rulemaking, the Code of Federal Regulations still shows the old clause numbers, so during the transition you may see both old and new numbers referring to the same requirement in different documents. Expect to juggle both for a while. Second — and this is the one that actually costs money — the elimination of the Basic self-assessment path under 7019 does not mean self-assessment obligations disappeared. If your contract requires Level 2 (Self), you still complete a NIST SP 800-171 self-assessment and post it, now under the CMMC framework via 252.204-7021. Verify the current text yourself on the DoD class-deviation index rather than trusting a headline.

The two-rule clause checklist

If you’re staring at a solicitation or contract right now, run this quick check before you spend a dollar on compliance:

• →DFARS 252.204-7025 present in the solicitation? What CMMC level/assessment type does it name?
• →DFARS 252.204-7021 included in the contract (or being added by modification)?
• →What CMMC level is required, and do you have the matching current status in SPRS?
• →CMMC UID for each system that will process, store, or transmit FCI or CUI?
• →Annual affirmation of continuous compliance — is it current in SPRS?
• →For any sub handling FCI or CUI — confirmed required level before subcontract award?
• →COTS-only claim — confirmed the acquisition is solely for COTS items?

Work top to bottom. The first box you can’t check confidently is where your next conversation — with your contracting officer, an RP/RPO, or the Find My CMMC Path tool — should start.

Does CMMC use NIST SP 800-171 Rev. 2 or Rev. 3?

This is a trap with a real price tag. If you build your assessment plan against Rev. 3 because it’s the “newest” version in the NIST catalog, you can end up scoped and documented against a control set your assessment doesn’t use — wasted effort, and confusion when the assessor works from Rev. 2. To keep the DFARS 252.204-7012 reference from automatically pulling contractors to Rev. 3, DoD issued Class Deviation 2024-O0013, which directs contractors subject to 252.204-7012 to comply with NIST SP 800-171 Revision 2. Separately, 32 CFR Part 170 maps CMMC Level 2 to Revision 2. Two different authorities, same practical answer: plan against Rev. 2 today.

The same version-control point applies to Level 3. NIST finalized NIST SP 800-172 Revision 3 on May 13, 2026 — but 32 CFR Part 170 currently incorporates 24 selected enhanced requirements from the February 2021 version of SP 800-172, not Revision 3. DoD has said adopting a newer version into CMMC would require further rulemaking, so a Level 3 candidate today still builds to the February 2021 requirements. Follow the version referenced in your solicitation, and watch dodcio.defense.gov/CMMC for any future transition. Sources: NIST SP 800-171 Rev. 2, NIST SP 800-172 Rev. 3 (May 13, 2026), and 32 CFR § 170.14.

Who decides whether I need Level 1, Level 2 (Self), Level 2 (C3PAO), or Level 3?

Here’s how to read the answer once it’s in front of you:

• →If the solicitation says Level 1 (Self):You’re on the FCI-only path unless something else in the contract says otherwise. You need an annual self-assessment and affirmation against the 15 basic safeguarding requirements in FAR 52.204-21.
• →If it says Level 2 (Self):You’re in a CUI-related Level 2 path, but the contract allows a self-assessment instead of a C3PAO certification. You still assess against all 110 NIST SP 800-171 Rev. 2 requirements, maintain the documentation, and affirm in SPRS.
• →If it says Level 2 (C3PAO): You need a Level 2 certification assessment by an authorized C3PAO, with the required status and affirmation in SPRS. A Level 2 (Self) status does not satisfy a Level 2 (C3PAO) requirement.
• →If it says Level 3 (DIBCAC):This is the highest current tier. It requires Final Level 2 (C3PAO) status for the same scope as a prerequisite, plus the 24 enhanced NIST SP 800-172 (Feb 2021) requirements, and it’s assessed by the government’s DIBCAC.

How do the two rules affect subcontractors and flow-down?

Two things routinely surprise people here, and both matter for planning. First, “we’re just a subcontractor” is not an exemption. If CUI is flowing to you, you carry the requirement, and your prime is on the hook to confirm you hold a current CMMC status at the level appropriate for the information being flowed down before subcontract award. Second — and this is a genuine operational headache baked into the rule — a prime cannot see your SPRS record. Subcontractors post their own assessments and affirmations, but DoD doesn’t share that data up the chain, so primes have to verify compliance directly, usually by asking for it in writing. If you’re a prime, build a subcontractor verification process now. If you’re a sub, expect to be asked to prove your status, and never send CUI, drawings, or sensitive contract details through an ordinary intake form or email to do it. Sources: 32 CFR § 170.23 and DFARS 252.204-7021.

What if my contract is only for COTS items?

If the solicitation or contract is solely for commercially available off-the-shelf (COTS) items, DFARS 204.7504 excludes it from the CMMC clause prescription. That’s the exception — and it’s narrow.

The word doing the heavy lifting is “solely.” Don’t decide it from system use alone, and don’t confuse “commercial” with “COTS-only” — plenty of commercial product and service work falls outside the narrow COTS exception. Confirm the actual acquisition type and whether the clause is present, and if there’s any ambiguity in the solicitation, ask the contracting officer before you assume you’re excluded or spend anything on compliance. This is a spot where a quick check with a federal-contracts attorney is cheaper than guessing wrong. Source: DFARS 204.7504 on Acquisition.gov.

Now that you understand the two rules, which provider category do you need?

It depends on the question you’re actually trying to answer. If you’re still decoding a clause, start with contract review and a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney. If you need readiness or remediation, look at an RPO/RP, MSP, MSSP, vCISO, GRC platform, or CUI enclave. If your solicitation requires Level 2 (C3PAO) and you’re genuinely assessment-ready, then evaluate authorized C3PAOs. And keep readiness and formal assessment separate: Cyber AB’s authorization requirements for C3PAOs include conflict-of-interest and impartiality rules for Level 2 certification assessments, so you generally shouldn’t hire your readiness/remediation provider as your C3PAO for the same engagement.

Here’s the honest mapping from situation to next step. Note the middle column is the categoryto consider — we don’t rank named providers on this page, and we never imply anyone is endorsed, verified, or guaranteed to get you certified.

Situation → provider category

For more on the full provider landscape, see our CMMC provider categories guide.

What we actually verified for this page

We don’t ask you to take “trust us” at face value. Here’s exactly what we checked, against which primary source, what we used it for, and its status as of July 2026 — so you can verify the rule path yourself before making an expensive decision.

How we built the two-rule crosswalk: we started with the primary legal and program sources above — not vendor summaries — classified each claim as a regulatory fact, a current-verification fact, or an editorial judgment, and then mapped each rule fact to the practical decision it drives: clause, scope, status, SPRS, flow-down, timeline, and provider category. We don’t publish named-provider rankings on this page, and our provider-category guidance is editorial — grounded in the verified facts here, not a substitute for legal or compliance advice.

Frequently asked questions

The bottom line

Two rules. Two jobs. 32 CFR Part 170 defines CMMC. The 48 CFR/DFARS acquisition rule puts it in your contract through 252.204-7021 and 252.204-7025. The Program Rule became effective December 16, 2024; the Acquisition Rule became effective November 10, 2025 and started the phased rollout. The February 2026 FAR overhaul renumbered the olderassessment clauses but left the CMMC rules alone. What triggers your obligation isn’t a date on a calendar — it’s the clause in your solicitation, which sets your level and assessment type.

Once you know which rule is driving your situation and what your contract actually requires, the only question left is who to bring in — and that answer depends on your level, your FCI/CUI scope, your environment, and your timeline.