CMMC Solicitation Tracker: How CMMC Requirements Show Up in DoD Solicitations

FCI (Federal Contract Information): non-public information provided by or generated for the government under a contract to deliver a product or service. Defined in FAR 52.204-21.

CUI (Controlled Unclassified Information): information requiring safeguarding or dissemination controls, defined in 32 CFR Part 2002. CUI generally triggers Level 2 or higher.

C3PAO: a CMMC Third-Party Assessment Organization, authorized by The Cyber AB to run Level 2 certification assessments.

DIBCAC: the Defense Industrial Base Cybersecurity Assessment Center, which runs Level 3 government assessments.

SPRS: the Supplier Performance Risk System, where CMMC statuses and scores are posted and where contracting officers verify them.

CMMC UID: ten alpha-numeric characters assigned to each CMMC assessment and reflected in SPRS for each contractor information system.

POA&M: a Plan of Action and Milestones — the remediation plan behind a “conditional” status.

Across the public solicitations we sampled, Level 2 (Self) is the most frequently stated requirement, and CMMC often functions as an access gate — controlling entry to technical data packages or protected documents, or required with the proposal itself — not only as a final award condition. This is a source-linked seed sample, not a complete census, so the counts below describe these specific rows rather than a market-wide percentage.

The table is our initial sample of real DoD opportunities that reference CMMC. Every row links to its source notice on SAM.gov so you can read the exact language yourself. We are confirming each row against its notice and attachments; rows whose level lives in an access-controlled attachment are marked “Attachment review,” and rows describing a future requirement are marked “Anticipated.”

This tracker shows how CMMC requirements are actually written into public solicitations: the stated level, the clause invoked, whether a CMMC UID is requested, and whether CMMC gates award, proposal submission, or document access. It does not show who is certified, it does not capture non-public or access-controlled attachments we could not open, and it is not legal advice about your specific bid.

We assembled the sample from public DoD opportunity records on SAM.gov, then normalized each row against the governing rules. We searched for CMMC-specific terms, captured the exact requirement language, classified the level and gate with fixed rules, and cross-checked every regulatory field — clause numbers, level definitions, and phase dates — against the DFARS, 32 CFR Part 170, and the Department’s CMMC FAQ.

Rows are not marked verified until the SAM.gov notice or attachment has been opened, the exact phrase copied, and the source status recorded; every row links to its source so anyone can confirm the language independently.

Search terms. We queried SAM.gov opportunity records for: CMMC, Cybersecurity Maturity Model Certification, DFARS 252.204-7021, DFARS 252.204-7025, CMMC Level 1, CMMC Level 2, CMMC Level 3, C3PAO, DIBCAC, SPRS, and CMMC UID.

Search run — July 1, 2026.Filter: Department of Defense contract opportunities. For each candidate we recorded the notice ID, opened the notice, checked attachments where accessible, copied the exact CMMC phrase, and classified the level, assessment path, and gate. Candidates that referenced “CMMI,” generic cybersecurity language with no CMMC term, or that were superseded by a later amendment were excluded.

The Department is phasing CMMC into solicitations over four one-year stages, and the schedule is fixed in regulation. Phase 1 (self-assessment as the award gate) began November 10, 2025. Phase 2 adds mandatory Level 2 C3PAO certification on November 10, 2026. Phase 3 adds Level 3 (DIBCAC) on November 10, 2027. Phase 4 — full implementation — begins November 10, 2028.

We pulled this directly from the regulation. The four phases and their dates are set by 32 CFR 170.3(e), tied to the DFARS rule’s effective date of November 10, 2025.

Two DFARS pieces do the work. The solicitation provision, DFARS 252.204-7025, is the gate: it states the required CMMC level, makes an offeror ineligible for award without the required current status and affirmation in SPRS, and requires CMMC UIDs in the proposal. The contract clause, DFARS 252.204-7021, is the ongoing obligation: it requires the contractor to hold and maintain that status for the life of the contract and to flow the requirement down to relevant subcontractors.

If you read one line of clause text, read the fill-in a contracting officer completes:

“The CMMC level required by this solicitation is: ____ — Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC).” — DFARS 252.204-7025

That single blank is why the level— not “CMMC, yes/no” — is the field that matters.

When the CMMC provision applies, an offeror must have a current CMMC status at the required level (or higher) and a current annual affirmation posted in SPRS before award, plus the CMMC UID for every in-scope system in the proposal. Miss any of those and the offer is ineligible. CMMC is not an evaluation factor or a set-aside — it is a pass/fail eligibility condition when it’s included.

The mechanics, in the order they bite:

• The proposal. You list the CMMC UID(s) for each system that will handle FCI or CUI. Systems not represented by a listed UID cannot be used for FCI or CUI during performance (DoD CMMC Program FAQ, C-A5).
• Verification at award. The contracting officer checks SPRS against your UIDs and cannot award to an offeror lacking the required status (DFARS 204.7503).
• Conditional status and the 180-day clock. A Level 2 or Level 3 assessment that isn’t fully met can yield a conditional status — awarded on a score of at least 80% of the maximum, with unmet items on a POA&M. That POA&M must be closed within 180 days or the conditional status expires, and certain “critical” requirements identified in 32 CFR 170.21 cannot go on a POA&M at all.
• Affirmations. Every level requires an affirmation of continuous compliance at assessment and annually thereafter.
• Subcontractor flow-down. The required level follows the data, not the prime’s level. Subcontractors handling FCI or CUI are subject to the requirement, and when a prime contract requires Level 3, the minimum flow-down is a Level 2 independent assessment absent specific guidance (DoD CMMC Program FAQ, B-A6; 32 CFR 170.23).

You can reproduce this tracker’s core in an afternoon: search SAM.gov for CMMC terms, open the attachments (not just the notice), confirm the requirement is real by checking for the 252.204-7025 provision and a stated level, and then confirm your own eligibility in SPRS.