Question · CMMC
When does CMMC Level 2 certification become mandatory in contracts?
CMMC verifies that defense contractors meet existing safeguarding requirements for FCI (FAR 52.204-21) and CUI (NIST SP 800-171), with three levels and either self-assessment or third-party or government assessment.
01 / The answer
The short answer
There is no firm date now. Under 32 CFR 170.3, third-party Level 2 (C3PAO) certification was to become a standard award condition in Phase 2, starting November 10, 2026. On July 13, 2026 the Department of War suspended Phase 2 and directed that C3PAO and Level 3 requirements be removed from solicitations, and from existing contracts at the next option or modification. The CFR text has not been amended, and no outcome of the task force review had been published as of October 21, 2026. Check each solicitation.
02 / The rule
What CMMC requires
CMMC verifies that defense contractors meet existing safeguarding requirements for FCI (FAR 52.204-21) and CUI (NIST SP 800-171), with three levels and either self-assessment or third-party or government assessment. Phase 1 (self-assessments as a condition of award) took effect November 10, 2025; on July 13, 2026 the Department of War suspended Phase 2, which would have required C3PAO certification from November 10, 2026, pending a CMMC Reform Task Force review.
- 01Level 1: annually self-assess against the 15 FAR 52.204-21 safeguarding requirements and affirm in SPRS.
- 02Level 2: meet the 110 NIST SP 800-171 Rev. 2 requirements, by self-assessment or C3PAO assessment every three years.
- 03Level 3: hold Level 2 certification plus a government (DIBCAC) assessment of 24 NIST SP 800-172 requirements.
- 04Post results in SPRS and have a senior official affirm compliance annually.
03 / Records
Records to keep
- 01System security plan covering the assessment boundary
- 02SPRS score and annual affirmation records
- 03Plan of action and milestones with closeout dates
- 04CMMC certificate or self-assessment results and UID
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Holland & Knight
RELATED
Related: CMMC: the full guide · Is CMMC required now, or is it still being phased in? · What evidence does a C3PAO expect for AI under CMMC Level 2? · How do I show AI model behavior evidence for NIST SP 800-171 controls?