Updated:
June 18, 2026
CMMC 2.0 Starts New Compliance Era For DoD Contractors
The Pentagon’s CMMC 2.0 regime has moved from policy design to contract enforcement, forcing defense contractors and subcontractors to prove cybersecurity controls before they can win or keep many Defense Department awards. The latest confirmed development came on June 17, 2026, when Federal News Network reported that a Senate defense bill would create a grant program to help small firms pay CMMC assessment costs.
What Did The CMMC 2.0 Final Rule Change For DoD Contractors?
CMMC 2.0 changed Defense Department cybersecurity compliance from largely self-attested obligations into a contract eligibility system tied to verified assessment levels. DoD said the program verifies whether contractors protect Federal Contract Information and Controlled Unclassified Information throughout contract performance.
The 32 CFR final rule took effect on December 16, 2024. The DFARS final rule took effect on November 10, 2025, placing CMMC requirements into solicitations and contracts through DFARS clauses 252.204-7021 and 252.204-7025.
What Is The Timeline For CMMC 2.0 From 2010 To 2026?
CMMC’s roots date to Executive Order 13556 in November 2010, which created a governmentwide Controlled Unclassified Information program. DoD said it began developing CMMC in 2019 to move away from contractor self-attestation.
DoD issued an interim DFARS rule on September 29, 2020. It shifted to CMMC 2.0 in November 2021 after industry feedback, reducing the model from five levels to three. DoD proposed the program rule on December 26, 2023, proposed the DFARS contract rule on August 15, 2024, finalized the program rule on October 15, 2024, and finalized the DFARS rule on September 10, 2025.
Phase 1 began on November 10, 2025. DoD says the rollout runs for three years before CMMC becomes broadly mandatory across covered contracts.
What Does CMMC 2.0 Require At Levels 1, 2, And 3?
CMMC 2.0 has three assessment levels tied to the sensitivity of defense information handled on contractor systems. Level 1 covers basic safeguarding of FCI, Level 2 covers broad protection of CUI, and Level 3 covers higher-level protection against advanced persistent threats.
Level 1 requires an annual self-assessment and annual affirmation against 15 FAR 52.204-21 requirements. Level 2 requires either a self-assessment or C3PAO assessment every three years, plus annual affirmation against 110 NIST SP 800-171 Revision 2 requirements. Level 3 requires final Level 2 status, a DCMA DIBCAC assessment every three years, and annual affirmation against 24 NIST SP 800-172 requirements.
Which DoD Contractors Are Affected By CMMC 2.0?
CMMC 2.0 affects prime contractors and subcontractors whose systems process, store, or transmit FCI or CUI for Defense Department work. DoD estimated the defense industrial base includes more than 220,000 companies, with malicious actors targeting firms across the multi-tier supply chain.
The DFARS rule estimated 337,968 unique impacted entities, including prime contractors and subcontractors. DoD estimated 229,818, or 68%, are small entities.
What Penalties Or Contract Consequences Come With CMMC 2.0?
The main CMMC 2.0 consequence is contract ineligibility when a required status is missing, outdated, or not posted in DoD systems. The DFARS rule requires offerors and contractors to post Level 1 or Level 2 self-assessment results in SPRS before award, option exercise, or performance-period extension.
Contractors must maintain the required CMMC status for the life of the contract. Senior officials must affirm continuous compliance annually in SPRS or when compliance status changes.
What Should Contractors Do Now To Prepare For CMMC 2.0?
Defense contractors should map FCI and CUI systems, complete the correct Level 1, 2, or 3 assessment path, close POA&M gaps within allowed limits, and maintain evidence for annual affirmations. DoD requires contractors to identify contractor information systems through CMMC unique identifiers in SPRS.
Practical steps include updating the System Security Plan, testing NIST SP 800-171 controls, validating cloud provider obligations, checking subcontractor flow-down terms, and scheduling C3PAO assessments early when Level 2 certification is required.
How Has Industry Responded To CMMC 2.0 Costs?
Industry comments focused heavily on cost, small-business burden, and the risk that compliance could become a barrier to defense work. DoD said commenters warned that upfront costs, C3PAO assessment fees, limited in-house security staff, and continuing compliance work could disrupt smaller companies.
DoD rejected the argument that companies handling CUI should avoid the baseline requirements. It said firms that cannot meet DFARS 252.204-7012 and NIST SP 800-171 should not process, store, or transmit CUI.
What Will CMMC 2.0 Cost The Defense Industrial Base?
DoD estimated the DFARS rule would cost $344,909,991 in present value over 10 years at a 3% discount rate, including $329,097,922 in public costs and $15,812,069 in government costs. At a 7% discount rate, DoD estimated $266,290,415 in total present value costs.
The latest policy debate remains focused on small firms. On June 17, 2026, Federal News Network reported that Senate defense legislation would authorize grants of up to $100,000 each, with a $50 million program cap, to offset direct Level 2 third-party assessment costs for small businesses and new entrants.
What Open Questions Remain For CMMC 2.0 In 2026?
The main unresolved CMMC 2.0 issues in 2026 concern small-business cost relief, assessment capacity, subcontractor flow-down execution, and how quickly contracting officers will add requirements across programs. The Senate grant proposal is not law, so its funding, eligibility rules, and implementation deadline remain unsettled.
The broader question is whether CMMC can raise supply-chain security without reducing competition in the defense industrial base. DoD says verification is necessary because it lacks the capacity to directly assess more than 220,000 contractors every three years.
How Bright Defense Helps DoD Contractors Meet CMMC 2.0 Requirements
Bright Defense helps DoD contractors prepare for CMMC 2.0 through Penetration Testing, Continuous Compliance, and Security Assessments mapped to CUI and FCI environments. These services help contractors validate controls, identify gaps before a C3PAO assessment, document remediation, and maintain evidence for annual affirmations.
For contractors facing Level 2 or Level 3 expectations, Bright Defense can test security controls, review exposed attack paths, assess cloud and network configurations, and support ongoing compliance readiness as CMMC requirements appear in solicitations and contracts.
Sources Cited In This CMMC 2.0 Report
- Federal Register — Cybersecurity Maturity Model Certification Program (October 15, 2024) https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program
- Federal Register — DFARS: Assessing Contractor Implementation Of Cybersecurity Requirements (September 10, 2025) https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of
- U.S. Department Of Defense — CMMC 2.0 Details And Links To Key Resources (2026) https://business.defense.gov/Programs/Cyber-Security-Resources/CMMC-20/
- DoD CIO — About CMMC (2026)
- https://dodcio.defense.gov/CMMC/About/
- Electronic Code Of Federal Regulations — 32 CFR Part 170, CMMC Program (2026) https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170
- Federal News Network — Senate NDAA Proposes CMMC Grant Program (June 17, 2026) https://federalnewsnetwork.com/cybersecurity/2026/06/senate-ndaa-proposes-cmmc-grant-program/
- DefenseScoop — Final Rule For CMMC Cybersecurity Program Goes Into Effect For Defense Contractors (December 16, 2024) https://defensescoop.com/2024/12/16/final-rule-cmmc-cybersecurity-requirements-go-into-effect-defense-contractors/
- Federal News Network — With CMMC Rule Final, DoD Focused On Training, Small Business Relief (September 2025) https://federalnewsnetwork.com/acquisition-policy/2025/09/with-cmmc-rule-final-dod-focused-on-training-small-business-relief/
- TechRadar — US Department Of Defense Issues Strict New Cyber Rules For Potential Contractors (September 10, 2025) https://www.techradar.com/pro/security/us-department-of-defense-issues-strict-new-cyber-rules-for-potential-contractors/
Get In Touch
