Do I need CMMC? A decision guide for primes and subcontractors

First, find the requirement in writing

Collect the solicitation, contract or subcontract, relevant attachments, modifications, and customer cybersecurity instructions. Record the clause or provision that states the requirement, any specified level, and the date or event when it must be satisfied.

Ask the contracting officer, or your prime contractor's authorized procurement contact, to clarify ambiguous language in writing. An informal request for a “CMMC certificate” is not enough to identify the correct assessment path. Your company's size, revenue, or preferred software does not select the level.

The CMMC applicability rule connects requirements to defense procurement and information handling, subject to implementation conditions and exceptions. Because implementation instructions and solicitations can change, read amendments alongside the original document.

Then follow the information

Under FAR 52.204-21, FCI is nonpublic information provided by or generated for the government under a contract to develop or deliver a product or service. The definition excludes publicly available government information and simple transactional information needed to process payments.

CUI is a separate information category with safeguarding or dissemination requirements. Use the National Archives CUI Registry and the customer's instructions to understand the category involved. A file's sensitivity to your business alone does not establish that it is government CUI.

Subcontractors need their own contract review

CMMC can reach subcontractors through the contractual supply chain. Do not assume the prime contractor's status covers your systems. Review your subcontract and determine what information the prime will provide or what you will generate in performance.

For basic safeguarding, FAR 52.204-21 includes a flowdown obligation when FCI may reside in or transit a subcontractor's information system, with the clause's stated exceptions. CMMC requirements have their own contractual conditions. Have the procurement contact identify the applicable requirement rather than relying on a blanket statement that every supplier needs the same level.

Hypothetical example: a prime gives a machine shop nonpublic production instructions and schedules. The shop should review that information and its subcontract before declaring itself outside scope. A second supplier selling standard stocked items with only public product data may have a different answer. The examples are starting points for review, not automatic classifications or exemptions.

Account for the current rollout without dropping existing duties

As checked October 25, 2026, the official CMMC program page reports that Phase II requirements were suspended on July 13, 2026 and that Phase I self-assessment requirements remain in place. Do not plan around the previously announced November 2026 Phase II start as an active deadline.

The suspension is not a reason to stop protecting contract information or disregard a current contract requirement. Check the latest official guidance and any applicable solicitation amendments. If your procurement documents and a general rollout announcement appear inconsistent, obtain written clarification specific to that procurement.

Create a one-page decision record

Before buying tools or scheduling work, capture these items in one place:

• The opportunity, contract, or subcontract identifier and current document version.
• The relevant requirement and the person who confirmed any ambiguity.
• Information received, created, stored, or transmitted, with its classification basis.
• The users, devices, locations, providers, and systems involved.
• The required level, assessment type, timing, and responsible organizational owner.
• Open questions and the next review trigger, such as a modification or new data flow.

This record makes future decisions easier. If a customer later introduces CUI, revisit the requirement and environment before assuming the original Level 1 plan remains adequate. Separate a documented answer from an unresolved assumption.

Turn the answer into a readiness plan

Once the requirement is clear, inventory the scoped environment, assign owners, and review the relevant safeguards. CMMC Pulsar is a product of Pulsar Technology LLC for organizing readiness work and supporting records; using it does not confer government status.

Federal Bid Partners (FBP), a sister company of Pulsar Technology LLC, provides readiness support. Take the CMMC Pulsar product tour to see the workflow, or ask about FBP support with organizing scope questions and the work that follows.

Frequently asked questions

Does every federal contractor need CMMC?

No universal answer follows from federal-contractor status alone. CMMC requirements relate to applicable defense procurements and information handling. Other safeguarding requirements may apply independently.

Does being a small subcontractor exempt me?

Do not assume so. Review your subcontract, the applicable flowdown provisions, and the information your systems will handle. Ask the prime’s procurement contact to identify the requirement.

Does the Phase II suspension mean I can ignore CMMC?

No. The official program notice says Phase I self-assessment requirements remain in place. Review your current contract and applicable updates before changing your readiness plan.

Can software tell me which CMMC level my contract requires?

Software can organize the decision and subsequent work. The authoritative answer comes from applicable procurement requirements and clarified information handling, not a product recommendation.