Breaking Down the DoD’s Latest CMMC Guidance: What Defense Contractors Need to Know

1. Your CMMC Level Determines Your Next Steps

Not all companies will need a third-party assessment, but you must determine your required level now:

Level 2 (Third-Party Certification, with some self-attestation exceptions)

• Who Needs It? - Companies handling CUI (e.g., Controlled Technical Information, Critical Infrastructure)
• Assessment Type - Third-Party Assessment (C3PAO)
• Key Requirement - Pass a formal CMMC certification assessment

Level 3 (Government Assessment)

• Who Needs It? - Companies facing advanced persistent threats due to innovative technologies, designs, or high aggregation of CUI
• Assessment Type - Government Assessment (DIBCAC)
• Key Requirement - Implement NIST SP 800-172 enhanced protections

Key takeaway: If you handle CUI, you will likely need a third-party assessment and may also require a government assessment.

2. Deadlines Are Coming—Don’t Wait to Get Ready

The DoD is phasing in CMMC requirements, meaning they will be enforced on strict timelines:

· Phase 1:  Begins at Effective date. Where applicable, solicitations include Levels 1 and 2 self-assessment and some solicitations may require Level 2 certification.

· Phase 2: Begins 6 months later. Where applicable, solicitations include Level 2 certification. Some solicitations may require Level 3. Solicitations may specify the certification due at award or at option period.

· Phase 3: Begins 12 months later (18 months after effective date). Where applicable, solicitations include Level 1, 2 or 3 requirements. For Level 3 only, solicitation may specify due at option period (all others due at award).

· Phase 4: 12 months later (30 months after Effective Date), DoD intends all solicitations will include the applicable CMMC level requirements.

Key takeaway: These deadlines mean you must start preparing now, not when the rule goes into effect.

3. Your Subcontractors Must Also Be Compliant

Even if your company is ready, your subcontractors must also meet CMMC requirements. If a subcontractor fails compliance, prime contractors could lose eligibility to bid on contracts or be forced to replace key suppliers—potentially causing delays, cost overruns, or compliance failures.

Actionable Steps:

• Review who in your supply chain will be impacted by CMMC.
• Require subcontractors to start their CMMC readiness assessments now.
• Consider working only with vendors already meeting NIST SP 800-171.

Key takeaway: Your compliance is only as strong as your weakest subcontractor—plan ahead.

4. Waivers Are Limited—Don’t Count on an Exception

In very limited circumstances, and in accordance with all applicable policies, procedures, and requirements, a Service Acquisition Executive (SAE) or Component Acquisition Executive (CAE) may elect to waive the inclusion of CMMC Program requirements in a solicitation or contract.

However, contractors and subcontractors will still be required to comply with all applicable cybersecurity and information security requirements.

Step 1: Identify Your CMMC Level

• Review contracts to determine if clauses require compliance at CMMC Level 1, 2, or 3.
• Use CFR 32 to determine the specific compliance steps required for your contract level.

Step 2: Conduct a Cybersecurity Review

• Compare your security controls to CFR 32 and NIST SP 800-171 or 800-172, depending on your level.
• Assess your CUI boundary and create a complete inventory of assets categorized according to CMMC requirements.
• Identify gaps and develop a Plan of Action and Milestones (POA&M) with timelines for completion to ensure you’re ready for your assessment.
• Address vulnerabilities before scheduling your CMMC assessment.

Step 3: Get Your Subcontractors on Board

• Ensure subcontractors understand their CMMC requirements.
• Establish flow-down requirements in contracts to enforce compliance.
• Consider vetting new subcontractors that already meet CMMC standards.

Step 4: Monitor Rulemaking and Plan Your Assessment Timelines

• Track updates to CMMC rulemaking efforts.
• Prepare for your assessment—if you require a third-party assessment, begin remediation efforts now to avoid surprises.

CMMC compliance isn’t just another checkbox—it’s a requirement that directly impacts your ability to work with the DoD. The guidance makes it clear:

• You will need a self-assessment, third-party assessment by a C3PAO, or possibly also a DIBCAC assessment against Level 3, depending on your contract’s clauses.
• Waivers will be rare and should not be counted on as a long-term solution.
• Your supply chain must also comply—your subcontractors’ non-compliance can disqualify your bids.
• Waiting to start will put you behind, potentially costing you future contracts.

Bottom line: Contractors who prepare now will have a competitive advantage over those who wait. If your organization relies on DoD contracts, ensure your cybersecurity practices are compliant before it’s too late.

Start preparing today—CMMC is coming, whether you’re ready or not. Learn more about how Coalfire Federal guide you to compliance effectively and efficiently.