What CMMC Is

CMMC is the defense contracting framework for assessing protection of FCI/CUI. Required level is tied to applicable solicitations/contracts rather than one universal level for every contractor.

The model is codified in 32 CFR Part 170 and acquisition implementation is reflected in DFARS provisions/clauses.

Current CMMC Status in 2026

Do not rely on the original phase calendar. On July 13, 2026, the Department announced immediate suspension of Phase II requirements that had been scheduled for November 10, 2026. Implementation remains paused in Phase 1 while reform is reviewed.

Current official guidance says Phase I self-assessment requirements remain in place. Contract/solicitation language remains authoritative for each procurement.

CMMC Levels

Current CMMC materials retain NIST SP 800-171 Revision 2 for Level 2. Incorporating Revision 3 requires future rulemaking.

FCI vs CUI and Scope

FCI is non-public information provided/generated for the Government under a contract, excluding public/basic transactional information. CUI requires safeguarding/dissemination controls under law/regulation/government-wide policy.

Scope systems that store, process or transmit FCI/CUI plus security-protection assets and relevant providers. Include cloud, identity, APIs, endpoints and administrative paths.

Assessment Types

Level 1 uses annual self-assessment. The codified Level 2 model contains self-assessment and certification assessment paths depending on contract requirement; Level 3 uses government assessment. Because Phase II is suspended, do not assume the original 2026 C3PAO rollout schedule still applies.

POA&Ms and Affirmations

Level 1 does not permit POA&Ms. Level 2 permits limited conditional status/POA&M under defined restrictions and closure timelines. Senior-official affirmations should be supported by evidence rather than informal assurance.

SPRS, SSP and Evidence

• Keep the SSP aligned with the actual environment.
• Record required assessment results/affirmations in SPRS as applicable.
• Maintain objective evidence for each requirement.
• Track cloud/shared responsibility explicitly.
• Maintain asset/user/network/data-flow/provider inventories.
• Preserve remediation evidence for gaps/POA&M closure.

How to Prepare

1. Identify contracts and FCI/CUI.
2. Define the assessment boundary.
3. Use the current CMMC requirement baseline.
4. Perform a requirement-by-requirement gap assessment.
5. Implement technical/organizational controls and evidence.
6. Update the SSP.
7. Resolve non-allowable gaps.
8. Run mock assessment.
9. Monitor official Phase II/reform status.
10. Revalidate scope after architecture changes.

APIs and CUI

CUI often crosses APIs: portals, supplier integrations, microservices and cloud workloads. API gateways, auth services, tokens, logs, queues and backends belong in scope when they handle/protect CUI.

Related Ammune reading: NIST SP 800-228 API security guidelines and Internal API security best practices.

Cloud Services, External Providers and CMMC Scope

Cloud and external service providers can reduce operational burden, but they do not make CMMC scoping disappear. If a cloud service stores, processes or transmits CUI—or provides a security capability protecting an in-scope environment—document the responsibility boundary, contract/service commitments and evidence relied upon by the contractor.

Map data flows before selecting compliance architecture. A user may reach CUI through an identity provider, SaaS portal, API gateway, logging platform and backup service even when the primary application is hosted in one enclave. The assessment boundary should tell a coherent story about which components are CUI assets, security-protection assets or out of scope under current scoping guidance.

Do not assume a provider’s government authorization or certification automatically satisfies every contractor requirement. Shared-responsibility controls still need evidence on the customer side: tenant configuration, identities, access, endpoint protection, incident response and how the service is actually used.

What Contractors Should Do During the 2026 Phase I Pause

The Phase II suspension is not a reason to stop improving CUI protection. Official CMMC guidance says Phase I self-assessment requirements remain in place and NIST SP 800-171 Rev. 2 compliance continues to be enforced through self-assessments and selected government-led assessments.

• Keep the SSP and assessment boundary current.
• Continue closing NIST SP 800-171 Rev. 2 gaps.
• Maintain SPRS and self-assessment evidence required by applicable contracts.
• Do not plan a future C3PAO outcome solely from the superseded Phase II calendar.
• Review every new solicitation for contract-specific CMMC clauses and assessment status.

Organizations with clean scope, current evidence and implemented requirements will adapt more easily to future reform than organizations that treat the pause as a compliance holiday.

CMMC Evidence Map: From Requirement to Objective Evidence

Readiness improves when every applicable requirement has a small evidence map: who owns it, where it is implemented, which configuration or record proves operation, and how often that evidence changes. This keeps the SSP from becoming a narrative disconnected from the environment.

The exact assessor evidence expectations depend on the requirement and assessment method, but an internally consistent map reduces the risk that the SSP claims one control while the technical environment demonstrates another.

CMMC 2026 Checklist

• Confirm current implementation status.
• Identify contracts/FCI/CUI.
• Define assessment boundary/providers.
• Use current NIST Rev. 2 Level 2 baseline.
• Maintain SSP.
• Collect objective evidence.
• Understand POA&M limits.
• Complete required self-assessments/affirmations.
• Record required SPRS data.
• Monitor Phase II suspension/reform updates.

Frequently Asked Questions

Primary References