United States (federal) · regulation
CMMC: what it requires, and the records to keep
CMMC verifies that defense contractors meet existing safeguarding requirements for FCI (FAR 52.204-21) and CUI (NIST SP 800-171), with three levels and either self-assessment or third-party or government assessment. Phase 1 (self-assessments as a condition of award) took effect November 10, 2025; on July 13, 2026 the Department of War suspended Phase 2, which would have required C3PAO certification from November 10, 2026, pending a CMMC Reform Task Force review.
01 / What it requires
What CMMC requires
Defense contractors and subcontractors that process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on contractor systems.
- 01Level 1: annually self-assess against the 15 FAR 52.204-21 safeguarding requirements and affirm in SPRS.
- 02Level 2: meet the 110 NIST SP 800-171 Rev. 2 requirements, by self-assessment or C3PAO assessment every three years.
- 03Level 3: hold Level 2 certification plus a government (DIBCAC) assessment of 24 NIST SP 800-172 requirements.
- 04Post results in SPRS and have a senior official affirm compliance annually.
- 05Give the contracting officer the CMMC unique identifiers (UIDs) for systems handling FCI or CUI and report any changes to them during performance (DFARS 252.204-7021(e), NOV 2025).
- 06Flow down the required CMMC level to subcontractors handling FCI or CUI.
02 / AI work
Where it touches AI work
Applies to AI systems as to any system: AI tools, models or cloud AI services that process FCI or CUI fall inside the assessed boundary and must meet the same controls.
03 / Dates
The dates that matter
32 CFR part 170 program rule published
32 CFR part 170 takes effect
DFARS CMMC contract rule published
DFARS rule effective; Phase 1 self-assessments begin
Department of War suspends Phase 2 and creates CMMC Reform Task Force
Original Phase 2 C3PAO start date, now suspended
04 / Enforcement
Who enforces it
DoD contracting officers (no award without required status); false affirmations can bring False Claims Act liability (treble damages plus per-claim penalties) and suspension or debarment.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01System security plan covering the assessment boundary
- 02SPRS score and annual affirmation records
- 03Plan of action and milestones with closeout dates
- 04CMMC certificate or self-assessment results and UID
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Is CMMC required now, or is it still being phased in?+
CMMC is required now, but only at Phase 1 levels. Since the DFARS rule took effect on November 10, 2025, DoD solicitations can require Level 1 (Self) or Level 2 (Self) status, posted in SPRS with an annual affirmation. Phase 2, which would have added third-party (C3PAO) Level 2 certification from November 10, 2026, was suspended by the Department of War on July 13, 2026 pending a CMMC Reform Task Force review. DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 still apply in full. Read the full answer
When does CMMC Level 2 certification become mandatory in contracts?+
There is no firm date now. Under 32 CFR 170.3, third-party Level 2 (C3PAO) certification was to become a standard award condition in Phase 2, starting November 10, 2026. On July 13, 2026 the Department of War suspended Phase 2 and directed that C3PAO and Level 3 requirements be removed from solicitations, and from existing contracts at the next option or modification. The CFR text has not been amended, and no outcome of the task force review had been published as of October 21, 2026. Check each solicitation. Read the full answer
What evidence does a C3PAO expect for AI under CMMC Level 2?+
A C3PAO treats an AI tool like any other asset in the assessment scope: it checks that the 110 NIST SP 800-171 Rev. 2 requirements are met wherever the tool processes, stores or transmits CUI. Expect to show the system security plan covering the AI service and its data flows, access control and authentication settings, audit logs (3.3), configuration baselines (3.4), integrity monitoring (3.14), and FedRAMP Moderate or equivalent evidence for any external cloud AI service. While Phase 2 is suspended, C3PAO certification is optional for most contracts. Read the full answer
How do I show AI model behavior evidence for NIST SP 800-171 controls?+
Map the model's behaviour to the 800-171 requirements it touches and keep repeatable records. The usual families are Audit and Accountability (3.3: log who used the model and what it did), Configuration Management (3.4: baseline the model version, settings and data sources, and control changes) and System and Information Integrity (3.14: monitor for unexpected behaviour and act on it). Run a documented evaluation on a set schedule, store results so they cannot be silently altered, and reference them in the system security plan. 800-171 has no AI-specific requirement. Read the full answer
SOURCES
Go back to the source
Holland & Knight
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: CMMC vs NIST SP 800-53 Rev. 5 · CMMC vs ATO · CMMC vs DFARS 252.204-7012 · CMMC vs DoW IL2 / IL4 · CMMC for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4