Quick answers to the questions defense contractors ask most about CMMC 2.0, NIST
800-171, and the assessment process.
Is CMMC still happening after the Phase 2 suspension?
Yes. On July 13, 2026 the DoD suspended the CMMC Phase 2 requirements — the third-party
assessment rollout originally set for November 10, 2026 — pending a 60-day program review.
Phase 1 self-assessment requirements remain firmly in place, DFARS 252.204-7012 still
requires NIST SP 800-171, and the department is enforcing it through self-assessments and
select government-led assessments in the interim.
Read the full breakdown of what changed.
What is CMMC 2.0 and who needs it?
CMMC 2.0 (Cybersecurity Maturity Model Certification) is the Department of Defense's framework
for verifying that contractors protect Federal Contract Information (FCI) and Controlled
Unclassified Information (CUI). Phase 1 self-assessment requirements are appearing in new DoD
solicitations now; the Phase 2 third-party assessment rollout was suspended in July 2026
pending a program review. Companies in the defense supply chain — primes and subcontractors
alike — still need to meet the CMMC level specified in their contracts.
What is the difference between CMMC Level 1 and Level 2?
Level 1 covers 17 basic safeguarding practices for FCI and allows annual self-assessment. Level 2
requires all 110 NIST SP 800-171 controls for handling CUI. The planned triennial C3PAO
assessment requirement for most CUI contracts was suspended in July 2026 — in the interim,
Level 2 is verified through self-assessment and select government-led assessments.
How long does it take to prepare for a CMMC assessment?
Most small and mid-sized contractors need 6 to 18 months to reach Level 2 readiness, depending on
their starting posture. A gap analysis early in the process gives you a realistic timeline and
a prioritized remediation roadmap.
What is an SPRS score?
Your SPRS (Supplier Performance Risk System) score reflects your self-assessed implementation of
NIST SP 800-171, ranging from -203 to a perfect 110. DoD contracting officers can view it, and
an accurate score is required under DFARS 252.204-7019/7020.
Does GetCMMC perform official CMMC certification assessments?
No — official Level 2 certification assessments are conducted by authorized C3PAOs. GetCMMC
provides
consulting, gap analysis, remediation support, and mock assessments led by a Lead Certified
CMMC Assessor so you walk into your C3PAO assessment fully prepared.
Why hire a readiness consultant instead of a C3PAO?
Conflict-of-interest rules prohibit a C3PAO from conducting your certification assessment if it
helped you prepare for it — so prepping with a C3PAO takes that firm off your list of potential
assessors. GetCMMC is readiness-only: assessor-grade preparation from a Lead Certified CMMC
Assessor, with every C3PAO still available to conduct your official assessment.
