Answer-first · primary sources · no email gate
Do I need CMMC certification?
If you hold or bid on DoD contracts, you almost certainly need CMMC at some level. Handle only FCI → Level 1, an annual self-assessment with no certificate. Handle CUI → Level 2. A third-party C3PAO certification was to become the default for CUI contracts under Phase 2, but DoD suspended it on July 13, 2026 pending a 60-day review; self-assessment and your SPRS score still apply, and primes can still require certification. Here's how to tell which is you.
"Do I need CMMC?" is really three questions
1. Does CMMC apply to me at all?
CMMC attaches to DoD contracts and subcontracts. No DoD work means no CMMC obligation today, but the requirement arrives with the solicitation, and readiness takes months, so it is worth knowing before you bid.
2. Which level, 1 or 2?
FCI-only work is Level 1; any CUI puts you in Level 2. That decision turns on what information your contracts involve, and it is worth getting right. The Level 1 vs Level 2 guide walks it with a short quiz.
3. Self-assessment or third-party certification?
This is the part most people miss. Level 1 is always self-assessed. Level 2 has a self-assessment track for a subset of contracts. A C3PAO third-party certification was scheduled to become the default for contracts involving CUI under Phase 2 on November 10, 2026, but DoD suspended Phase 2 on July 13, 2026 pending a 60-day review — the self-assessment and SPRS score remain required, and a prime can still require certification to award.
Sources: 32 CFR 170.3(e) and 170.21; NIST SP 800-171 Rev 2; DFARS rule effective Nov 10, 2025. As of July 13, 2026, DoD suspended CMMC Phase 2 (the third-party-assessment requirement) pending a 60-day review; the NIST 800-171 self-assessment and SPRS requirement is unchanged.
Self-assessment ≠ certification
A self-assessed SPRS score is something you produce and post. A CMMC Level 2 certification is something a Certified Third-Party Assessment Organization (C3PAO) issues after assessing you. They are not the same milestone. Under Phase 2, contracts involving CUI were to increasingly require the certification, not just the score — but DoD suspended Phase 2 on July 13, 2026 pending a 60-day review, so today the self-assessment and SPRS score remain required and a prime can still require certification. Conditional Level 2 status is possible with a score of at least 88 of 110 where every open gap is POA&M-eligible and closes within 180 days.
Four myths that get contractors caught
"I already posted an SPRS score, so I'm certified."
A self-assessed SPRS score is not a CMMC certification. The score tells you where you stand; a certification is a separate, assessor-issued result. Third-party C3PAO assessment was to become a condition of award for CUI contracts under CMMC Phase 2, which DoD suspended on July 13, 2026 pending a 60-day review — but a prime can still require it, and it may return after the review. Either way, your self-assessment and SPRS score are still required.
"I'm just a subcontractor, so CMMC doesn't apply to me."
CMMC follows the information, not your tier. If a prime flows down DFARS 252.204-7012 and you handle covered defense information, the same level applies to you. Many subs need exactly the same Level 2 readiness as the prime.
"I'll deal with it once I win a contract that requires it."
C3PAO assessment waitlists already run months, and you cannot predict which solicitation will carry the requirement first under the per-solicitation rollout. Readiness that starts when a solicitation demands it usually arrives too late to bid.
"CMMC is just more paperwork. There's nothing to actually do."
Level 2 is all 110 NIST SP 800-171 requirements implemented and evidenced, from MFA and encryption to logging, access control, and an accurate SSP. That is real technical and process work, not a form. The SSP (3.12.4) gates everything: without one, no assessment can even be completed.
Straight answers
Do I need CMMC certification if I hold DoD contracts?
Almost certainly you need CMMC at some level. The open questions are which level and whether you self-assess or need a third-party certification. If your DoD work involves only Federal Contract Information (FCI), you self-assess at Level 1 (17 safeguards, annual, no certificate issued). If it involves Controlled Unclassified Information (CUI), you are in Level 2 (all 110 NIST SP 800-171 requirements). A C3PAO certification was to become the default condition of award for CUI contracts under Phase 2, but DoD suspended Phase 2 on July 13, 2026 pending a 60-day review; the self-assessment and SPRS score remain required, and a prime can still require certification to award.
What is the difference between a self-assessment and a CMMC certification?
A self-assessment is you scoring your own systems against NIST SP 800-171 and posting the result to SPRS, with no third party. A CMMC certification (Level 2) is a Certified Third-Party Assessment Organization (C3PAO) independently assessing you and issuing a result. Level 1 is always self-assessed; Level 2 has a self-assessment track for a subset of contracts. C3PAO certification was to become the default for CUI contracts under Phase 2, but DoD suspended Phase 2 on July 13, 2026 pending a 60-day review — the self-assessment and SPRS score remain required, and primes can still require certification.
Does CMMC apply to subcontractors?
Yes, when the data does. If a prime flows down DFARS 252.204-7012 and your performance involves covered defense information, the corresponding CMMC requirement applies to you as well. Being a subcontractor does not exempt you, because primes are obligated to ensure their subs meet the requirement.
Can I get a CMMC certification before I have a contract that requires it?
Yes. Given multi-month C3PAO waitlists and the unpredictable per-solicitation rollout, getting ready ahead of a requirement is the prudent move. You cannot reliably time it to a specific award. The conservative sequence is: measure your SPRS score now, close the must-fix gaps, then enter the assessor queue.
Is having a good SPRS score the same as being CMMC certified?
No. The SPRS score is a self-reported readiness number under the DoD Assessment Methodology; CMMC Level 2 certification is an independent C3PAO result. A strong score makes the assessment achievable (conditional Level 2 needs at least 88 of 110 with every open gap POA&M-eligible), but the score and the certification are different things. This is compliance information, not legal advice.
This is compliance information, not legal advice. The solicitation and your actual data flows govern; for contract-interpretation questions, consult qualified counsel.
Related guides
CMMC Level 2 requirements (all 110)
Every NIST SP 800-171 Rev 2 requirement grouped by the 14 families, with each control’s SPRS point value, Level 1 membership, and POA&M eligibility — a free, searchable explorer.
DFARS 252.204-7021 explained
The clause that makes CMMC a condition of contract award — what it requires, how it differs from 7012 and 252.240-7997 (formerly 7019/7020), and what to do when a solicitation carries it.
CMMC software: Muster vs Vanta vs Drata
An honest comparison of CMMC readiness software for small defense contractors — pricing, data handling, SSP/POA&M drafting, and SPRS scoring, with where each tool genuinely wins.
CMMC compliance checklist
The two-phase Level 2 checklist for small contractors — self-assessment readiness (gap assessment, SSP, POA&M, SPRS) then C3PAO readiness — with a phase-by-phase table and the primary-source rules.
Tools: SPRS score calculator · scoring methodology · CMMC Phase 2 status
Both paths start with your real SPRS score.
The free assessment computes your SPRS score with the exact DoD methodology and shows which gaps are POA&M-eligible and which you must fix before any assessor sees them.
Start the free assessment