What is CMMC? A plain-English guide for defense contractors

Why CMMC matters to a contractor

A cybersecurity requirement becomes a business planning issue when a solicitation, contract, or subcontract makes a particular CMMC status necessary. Owners need to understand the requirement early enough to define the affected environment, assign work, and resolve gaps before the relevant contract milestone.

The program connects safeguards with an assessment and continuing accountability. A well-organized team should be able to explain what information it handles, how the relevant systems are protected, and what supports its assessment conclusions. Start with the CMMC applicability decision guide if the requirement itself is unclear.

FCI and CUI: identify the information first

Federal Contract Information (FCI) means nonpublic information provided by or generated for government under a contract for a product or service. Public government information and basic payment-processing information are excluded by FAR 52.204-21.

Controlled Unclassified Information (CUI) has a specific basis in law, regulation, or government-wide policy for safeguarding or dissemination controls. It excludes classified information. A confidential business file is not automatically CUI. Use the customer's direction and the official definition to resolve uncertainty before choosing a compliance path.

How the three CMMC levels fit together

The regulatory model contains three levels. Keep this structure separate from the current rollout of contract requirements:

• Level 1: basic protection of FCI, using 15 FAR safeguards and annual self-assessment. See our CMMC Level 1 guide for the workflow.
• Level 2: protection of CUI using 110 requirements in NIST SP 800-171 Revision 2. The framework provides self-assessment and independent third-party assessment paths.
• Level 3: enhanced protection using 24 selected NIST SP 800-172 requirements, with a government assessment and a prerequisite Level 2 third-party status for the relevant scope.

These are different assessment obligations, not subscription tiers. Read the CMMC model and the procurement requirement together.

The rollout position as of October 25, 2026

The official CMMC program guidance reports that Phase II was suspended on July 13, 2026. Implementation remains in Phase I, with Level 1 and Level 2 self-assessment requirements continuing. The previously announced November 10, 2026 Phase II date should not be treated as an active deadline.

Underlying safeguarding duties continue. Review current contract documents and amendments, and seek procurement-specific clarification if they appear inconsistent with general guidance. Keep monitoring official updates when planning future work.

Four useful first steps

1. Read the documents. Gather the current solicitation or subcontract, modifications, and customer cybersecurity instructions. Record the stated level, assessment type, and timing.
2. Trace the information. Identify where relevant data enters, who uses it, where it is stored, and which providers touch it. Define assessment scope before assessing.
3. Compare practice with requirements. Ask the people operating the systems to show what actually happens. Record uncertainties and assign gap-resolution work.
4. Plan ownership and upkeep. Name an accountable project owner, involve IT and management, and schedule assessment, reporting, and ongoing reviews.

These are planning suggestions. The official scoping rules determine the assessment boundary. Our cost and timeline guide explains how to budget around identified work.

An example of a better starting conversation

Imagine a small supplier receives a request to become “CMMC compliant.” Before buying anything, its owner asks the customer for the applicable requirement and identifies the information the work will involve. The IT provider then traces that information through email, shared storage, and employee devices.

That conversation produces useful questions: which systems belong in scope, which protections already work, and who can demonstrate them? It also exposes missing information before the team commits to a budget. This is an illustrative scenario, not a classification decision for a particular contract.

Where CMMC Pulsar and FBP fit

CMMC Pulsar is readiness software from Pulsar Technology LLC, a sister company of Federal Bid Partners (FBP). It helps organize readiness tasks and supporting records. FBP provides readiness support for teams working through the planning and preparation process.

Software and assistance support your work; your organization remains responsible for implementing safeguards and making accurate assessments and affirmations. Explore the product workflow or talk with the FBP team about your starting point.

Frequently asked questions

Is CMMC the same as NIST SP 800-171?

No. NIST SP 800-171 supplies the security requirements used for Level 2. CMMC adds the program's assessment, status, and affirmation framework.

Does buying CMMC software make my business certified?

No. A subscription can support preparation and recordkeeping. Your required status follows the applicable assessment and affirmation process.