CMMC Phase 2 starts November 10, 2026: a readiness guide for small defense suppliers

CMMC Phase 2 begins on November 10, 2026. Its main change is that applicable Department of Defense solicitations can require a Level 2 certification assessment performed by a third-party assessment organization (a C3PAO) as a condition of award, where Phase 1 relied on self-assessments. If your company handles Controlled Unclassified Information (CUI), the question that matters is whether your environment can pass that assessment, and most of the answer depends on work you can start this month.

What actually changes on November 10, 2026

The Cybersecurity Maturity Model Certification program rule, 32 CFR part 170, was published on October 15, 2024 and took effect on December 16, 2024. It ties the rollout to a second rule: Phase 1 starts on the effective date of the DFARS acquisition rule. That DFARS rule was published on September 10, 2025 and took effect on November 10, 2025. Phase 1 therefore began on November 10, 2025, and Phase 2 begins one calendar year later.

The phases build on each other:

• Phase 1 (from November 10, 2025): Level 1 (Self) or Level 2 (Self) as a condition of award for applicable solicitations.
• Phase 2 (from November 10, 2026): adds Level 2 (C3PAO) certification assessments as a condition of award for applicable solicitations. The rule allows DoD to delay that requirement to an option period in some cases.
• Phase 3: begins one year after Phase 2.
• Phase 4 (full implementation): begins one year after Phase 3.

The practical effect for a small supplier is that a self-assessment may no longer be enough to win or keep certain work. An outside assessor will look at your environment, your documentation, and your evidence.

Level 1 or Level 2: which one applies to you

The level is driven by the type of information you handle under the contract.

• Level 1 covers Federal Contract Information (FCI) and consists of the 15 security requirements in FAR 52.204-21. These are basic safeguarding practices: controlling who can access systems, authenticating users, protecting against malicious code, and similar fundamentals.
• Level 2 covers Controlled Unclassified Information (CUI) and consists of the 110 security requirements of NIST SP 800-171 Rev 2.

If your contracts only involve FCI, Level 1 is the target. If you receive, create, store, or transmit CUI, you are working toward Level 2, and whether a given solicitation calls for a self-assessment or a C3PAO assessment is set by the solicitation itself. Your contracting officer and your prime contractor are the authoritative sources for which level a specific contract requires.

Scoping: find where FCI and CUI actually live

Scoping is where most of the cost of CMMC is decided. Every system that stores, processes, or transmits CUI falls inside the assessment, along with the systems that protect them. A loosely defined scope pulls the whole company into the assessment. A deliberate one can keep it to a defined enclave.

In most environments we review, CUI turns up in more places than leadership expects:

• Email attachments forwarded between engineering, purchasing, and outside partners.
• Shared drives and cloud file shares that grew without folder-level permissions.
• Personal laptops or home printers used during a busy quarter.
• Drawings and specifications pulled onto shop-floor workstations.

Start with a data-flow inventory: where CUI arrives, where it is stored, who touches it, and where it leaves. Then decide whether to protect it where it already sits or move it into a segregated environment with tighter controls. Either decision is valid. What fails an assessment is not knowing.

A 30/60/90-day readiness sequence

With roughly a month before Phase 2 starts, a staged plan keeps the effort focused. This sequence assumes Level 2 is the target.

First 30 days: know your position.

• Confirm which current and upcoming contracts involve FCI or CUI.
• Complete the data-flow inventory and draw a scope boundary.
• Run a gap assessment against the 110 NIST SP 800-171 Rev 2 requirements, recording each as met or not met with the evidence you would show.
• Identify an owner for the System Security Plan (SSP).

Days 31 to 60: close the high-impact gaps.

• Enforce multi-factor authentication on every account in scope, starting with administrators and remote access.
• Turn on centralized logging and confirm logs are retained and reviewed.
• Tighten access so users reach only the CUI their role requires.
• Confirm endpoint protection, patching, and encryption are consistent across in-scope devices.
• Write or update the SSP so it describes what is actually deployed.

Days 61 to 90: evidence and rehearsal.

• Collect evidence for each requirement: screenshots, configuration exports, policies, training records, and logs.
• Draft a Plan of Action and Milestones (POA&M) for anything still open, with owners and dates.
• Run an internal mock assessment, walking through each requirement as an assessor would.
• Decide when to engage a C3PAO, based on what the mock assessment shows.

Ninety days will not close every gap for every company. The point is to replace uncertainty with a documented position and a dated plan.

What the POA&M rules allow, and what they do not

The program rule allows a Conditional Level 2 status, but the limits are specific. A company needs a minimum score of 80%, only certain requirements are permitted to be listed as NOT MET on a POA&M, and those items must be closed out within 180 days. Anything outside those limits has to be fully implemented before the assessment.

Treat the POA&M as a short-term bridge for a small number of eligible items, with a funded plan to close each one. A POA&M that lists foundational controls as future work is a sign the environment is not ready for assessment yet.

How Intelligent Group can help

Intelligent Group supports CMMC readiness. We are not a C3PAO, we do not perform certification assessments, and we do not provide legal advice; contract and regulatory interpretation belongs with your contracting officer and counsel. What we do is the operational work around readiness: compliance support for scoping, gap analysis, and SSP and POA&M preparation; ongoing compliance management so controls stay in place after the assessment; and IT assessments that document where your environment stands today. If you are also preparing a written response plan, our guide to building an incident response plan covers the basics.

Frequently asked questions

Does Phase 2 mean every defense contract now requires a third-party assessment?

No. Phase 2 adds Level 2 (C3PAO) certification assessments as a condition of award for applicable solicitations, and the rule allows DoD to delay that requirement to an option period. The solicitation and contract define what is required. Confirm the requirement for each contract with your contracting officer or prime.

We only handle Federal Contract Information. What do we need?

Level 1 applies to FCI and consists of the 15 security requirements in FAR 52.204-21. These are foundational controls that most organizations should have in place regardless of contract requirements. Document how you meet each one so you can support your self-assessment.

Can we pass with open items on a POA&M?

Possibly, within narrow limits. A Conditional Level 2 status requires a minimum score of 80%, only permitted items may be listed as NOT MET, and those items must be closed out within 180 days. Plan to have the large majority of requirements fully implemented before any assessment.

How long does Level 2 readiness take?

It depends on scope, existing controls, and documentation. A company with consistent MFA, logging, and access controls is in a very different position from one starting with shared accounts and no SSP. A gap assessment against the 110 requirements is the only reliable way to estimate the timeline for your environment.