Question · CMMC
Is CMMC required now, or is it still being phased in?
CMMC verifies that defense contractors meet existing safeguarding requirements for FCI (FAR 52.204-21) and CUI (NIST SP 800-171), with three levels and either self-assessment or third-party or government assessment.
01 / The answer
The short answer
CMMC is required now, but only at Phase 1 levels. Since the DFARS rule took effect on November 10, 2025, DoD solicitations can require Level 1 (Self) or Level 2 (Self) status, posted in SPRS with an annual affirmation. Phase 2, which would have added third-party (C3PAO) Level 2 certification from November 10, 2026, was suspended by the Department of War on July 13, 2026 pending a CMMC Reform Task Force review. DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 still apply in full.
02 / The rule
What CMMC requires
CMMC verifies that defense contractors meet existing safeguarding requirements for FCI (FAR 52.204-21) and CUI (NIST SP 800-171), with three levels and either self-assessment or third-party or government assessment. Phase 1 (self-assessments as a condition of award) took effect November 10, 2025; on July 13, 2026 the Department of War suspended Phase 2, which would have required C3PAO certification from November 10, 2026, pending a CMMC Reform Task Force review.
- 01Level 1: annually self-assess against the 15 FAR 52.204-21 safeguarding requirements and affirm in SPRS.
- 02Level 2: meet the 110 NIST SP 800-171 Rev. 2 requirements, by self-assessment or C3PAO assessment every three years.
- 03Level 3: hold Level 2 certification plus a government (DIBCAC) assessment of 24 NIST SP 800-172 requirements.
- 04Post results in SPRS and have a senior official affirm compliance annually.
03 / Records
Records to keep
- 01System security plan covering the assessment boundary
- 02SPRS score and annual affirmation records
- 03Plan of action and milestones with closeout dates
- 04CMMC certificate or self-assessment results and UID
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Holland & Knight
RELATED
Related: CMMC: the full guide · When does CMMC Level 2 certification become mandatory in contracts? · What evidence does a C3PAO expect for AI under CMMC Level 2? · How do I show AI model behavior evidence for NIST SP 800-171 controls?