CMMC Compliance for Defense Contractors
Cybersecurity Maturity Model Certification for defense contractors
The Cybersecurity Maturity Model Certification establishes cybersecurity requirements for defense contractors handling Controlled Unclassified Information. Thalorin provides comprehensive CMMC support from initial assessment through certification, with continuous compliance monitoring that maintains certification readiness.
CMMC stopped being a planning exercise on 10 November 2025, when the 48 CFR acquisition rule took effect and DFARS 252.204-7021 became a clause that can appear in a live solicitation. The question for a defense contractor is no longer whether CMMC applies but which phase of the rollout catches which contract vehicle, and whether the certification you hold matches the level the clause names.
The schedule then stopped. Phase 1 opened with Level 1 and Level 2 self-assessment appearing in applicable solicitations, with the Department retaining discretion to require a C3PAO assessment earlier. Phase 2 was to bring Level 2 third-party certification into solicitations as a matter of course from 10 November 2026; on 13 July 2026 the Department’s Chief Information Officer suspended it, along with the implementation milestones behind it, and stood up a task force to review the programme. Recommendations are due on or about 13 September 2026.
A suspension is not a repeal, and reading it as one is the expensive mistake available in 2026. Phase 1 stands. DFARS 252.204-7012 stands. NIST SP 800-171 Rev 2, the SPRS score and the annual affirmation all stand, and a CMMC clause already inside an awarded contract binds until a contracting officer modifies it. What is deferred is the date by which a third party has to agree with you.
The practical trap is scope. CMMC assessments are scoped to the environment that stores, processes, or transmits Controlled Unclassified Information, and most organisations discover during assessment that this boundary is wider than the one they documented — a file share, a helpdesk tool, a subcontractor's portal. Scope drift is the most common reason an assessment that was expected to pass does not.
Thalorin treats the CUI boundary as the primary object rather than the control list. Assets are classified against the boundary, evidence is bound to the asset that produced it, and a change that widens the boundary raises the affected controls rather than silently invalidating an assessment nobody re-ran.
The phase you plan for is not the phase you will bid in
Planning against a schedule that moved
Phase 2 was suspended on 13 July 2026 and the phase dates behind it went with it. A programme that budgeted a C3PAO assessment for November 2026 now holds a slot against no deadline, and one that read the suspension as relief has stopped work on requirements that never lapsed.
CUI boundary scope drift
Assessment scope follows CUI, not the org chart. Enclaves expand through ordinary operational decisions — a new collaboration tool, a support contract — and the documented boundary stops matching the real one.
C3PAO capacity and lead time
There are far fewer authorised C3PAOs than there are organisations requiring Level 2 certification. Assessment slots are booked well ahead, so a failed assessment costs a queue position, not just a remediation cycle.
Flow-down to subcontractors
Primes must flow CMMC requirements down, and a supplier that cannot certify at the required level becomes a sourcing problem. Verifying supplier status is now part of managing the bid, not the contract.
How Thalorin scopes and evidences a CUI boundary
CMMC 2.0 level assessment
Assess against the 110 NIST SP 800-171 Rev 2 requirements the Department currently scores, with each requirement bound to the assets in the CUI boundary that satisfy it.
Practice implementation guidance
Work each practice down to its assessment objectives, so implementation is judged the way a C3PAO judges it rather than at the level of the practice statement.
Gap analysis and remediation
Track POA&M items against the closeout clock, since a conditional certification converts to final only when the plan is closed within the permitted window, with each item bound to the requirement it closes.
Certification preparation
Generate and version the System Security Plan from the same control state the assessment reads, so the SSP cannot drift from the environment it describes.
Continuous compliance monitoring
Model the boundary explicitly — in scope, out of scope, specialised asset, contractor risk managed asset — and maintain the SPRS submission trail, including the score basis and the date, so the figure the Department sees is reproducible from evidence.
Supply chain CMMC management
Carry supplier certification status alongside your own, so flow-down obligations are visible before award rather than at audit.
CMMC: common questions
When does CMMC actually apply to my contract?
It already can. The 48 CFR acquisition rule took effect on 10 November 2025, which allows DFARS 252.204-7021 to appear in a solicitation; whether it appears in yours depends on whether the work involves Federal Contract Information or Controlled Unclassified Information. Phase 2, which would have made Level 2 C3PAO certification standard from 10 November 2026, was suspended on 13 July 2026 along with the milestones behind it, and the review of the programme reports in September 2026. A clause already written into an award remains binding until a contracting officer modifies it.
Can I still self-assess at Level 2?
Yes, as of August 2026. Phase 1 permits self-assessment for many Level 2 awards, and the suspension of Phase 2 on 13 July 2026 removed the date on which that stopped being true. The Department retains discretion to require a C3PAO assessment on a specific acquisition, and the suspension carries no commitment about what replaces it. The posture that survives either outcome is one assessed against all 110 requirements with evidence already bound to the assets — the same work either way, minus the assessor.
Is CMMC assessed against NIST 800-171 Rev 2 or Rev 3?
Rev 2, as of August 2026. NIST published Rev 3 in May 2024, but the Department has not completed the rulemaking to adopt it for CMMC assessment, SPRS scoring, or DFARS 7012. Rev 3 reorganises the requirements from 110 to 97, so adoption will require a fresh self-assessment and a new SPRS score rather than a mapping exercise.
What happens if I fail a C3PAO assessment?
Depending on the findings, you may receive a conditional certification with a POA&M that must be closed inside the permitted window, or no certification at all. The operational cost is usually the calendar: C3PAO capacity is limited, so re-assessment means re-entering a queue, and an award that required certification will not wait.
Do subcontractors need their own certification?
Requirements flow down, and the level required depends on what the subcontractor handles. A supplier touching only Federal Contract Information faces a lower bar than one processing CUI. Primes are increasingly verifying supplier status during sourcing, because discovering a supplier cannot certify after award is a schedule problem with no clean remedy.
Regulatory state described as of August 2026. Requirements change; verify against the current rule before relying on any date above.