CMMC Level 2 for Buyers: What to Require From Suppliers

Introduction

If you searched for CMMC timelines recently, you probably landed on a date that no longer applies. Most pages online still say third-party certification, called Phase 2, starts 10 November 2026. It doesn't. The Department of War suspended that phase on 13 July 2026, stood up a CMMC Reform Task Force, and on 3 September 2026 directed contracting officers to strip third-party-assessment requirements out of live solicitations and existing contracts. As of this writing, that suspension still stands against the government's own programme page.

That matters if you buy from suppliers who touch defense work. CMMC, the Cybersecurity Maturity Model Certification, is the Department of War's framework for verifying that contractors protect federal information on their own systems. If you're drafting a purchase order today based on a November 2026 certification deadline, you're about to require something of a supplier that the government currently isn't requiring either. This article covers CMMC Level 2 requirements for subcontractors and suppliers as the programme actually stands right now, not as it was designed two years ago, and what that means for the language in your PO.

What CMMC Level 2 covers

CMMC has three levels, and they stack. Level 1 covers 15 basic safeguards drawn from FAR 52.204-21, aimed at protecting Federal Contract Information. Level 2 covers all 110 security requirements in NIST SP 800-171 Revision 2, a much larger control set built to protect a more sensitive category of data. Level 3 adds a further set of enhanced controls on top of Level 2's 110, reserved for the government's highest-sensitivity programs and assessed by the government itself rather than self-assessed or assessed by an outside firm.

Level	What it requires	How it is assessed	Who it applies to
Level 1	15 basic safeguards (FAR 52.204-21) protecting FCI	Self-assessment, annual	Any contractor handling only FCI, no CUI
Level 2	All 110 NIST SP 800-171 Rev 2 requirements, protecting CUI	Currently self-assessment every 3 years (third-party certification suspended as of 13 Jul 2026, reform in progress); affirmed annually either way	Contractors and subs that handle CUI
Level 3	Level 2's 110 requirements plus a further set of enhanced controls, commonly described as around two dozen, from NIST SP 800-172	Government-led assessment	Highest-sensitivity CUI programs, a smaller population

The exact count of Level 3's enhanced controls is how the compliance industry describes it, not a number pulled from the regulation itself, so treat it as approximate. For a typical machine shop or parts supplier, the practical question almost never reaches Level 3. It's whether the work calls for Level 1 or Level 2, and that comes down to one thing: the kind of data involved.

FCI and CUI, and which one your part involves

Two terms do all the work here. Federal Contract Information, FCI, is information provided by or generated for the government under a contract that isn't meant for public release. Controlled Unclassified Information, CUI, is a narrower and more sensitive category: government information that requires safeguarding under a law, regulation, or policy, even though it isn't classified. All CUI counts as FCI, but not all FCI rises to CUI.

This distinction is the whole ballgame. The level a supplier needs is set by the data that supplier will actually touch, not by the supplier's size, how long they've worked with you, or what certification they already happen to hold. A ten-person shop machining a CUI-marked drawing needs Level 2 just as much as a thousand-person prime would. A large, established supplier that only ever sees FCI needs nothing more than Level 1.

In practice, this decision is made upstream of the supplier. The contracting officer designates the required level in the solicitation, and it flows down through markings on the drawings, specs, or technical data the supplier will handle. A buyer's job is to check what's actually marked and passed down the chain, not to guess at a level based on a hunch about how sensitive the part feels. If nothing is marked CUI, Level 1, or nothing at all, may be the right answer — see the final section on when CMMC isn't even the right question to ask.

Where the programme actually stands

Here's the full sequence, because the dates matter more than usual right now. On 10 November 2025, the CMMC acquisition rule took effect and Phase 1 began: Level 1 and Level 2 self-assessment became a live requirement in new solicitations. That part never changed and is still in force today.

What changed is everything after that. Phase 2, the stage that would have required third-party certification through an accredited assessor, was set to begin 10 November 2026. On 13 July 2026, the Department of War issued memoranda suspending it and stood up a CMMC Reform Task Force to reconsider how the programme rolls out. Industry submitted feedback through mid-August. On 3 September 2026, a class deviation memorandum formalized the suspension, directing contracting officers to remove third-party-assessment requirements from solicitations already in progress and from contracts already awarded. A 60-day review window tied to that memo closed on 11 September 2026.

As of today, the programme runs on self-assessment only. Phase 1 obligations are unchanged and active. Third-party certification isn't happening, and there's no announced date for when, or whether, it resumes. If a supplier tells you they "must get third-party certified to quote," they're describing a requirement that is currently suspended, not one that's in force.

Self-assessment against a third-party assessment

Self-assessment means the supplier scores its own systems against the applicable control set, FAR 52.204-21 for Level 1 or the 110 NIST SP 800-171 requirements for Level 2, and posts that score to a DoD system called SPRS, covered next. No outside party reviews the work. Third-party certification, the suspended Phase 2 path, would have a DoD-authorized assessor organization, called a C3PAO, independently verify the controls and issue a formal CMMC Status.

Per the rule as industry describes it, one thing doesn't change based on which path is active: a senior official at the supplier, called the Affirming Official, personally signs an annual affirmation that the required controls are actually implemented. That's true on the self-assessment path and would have been true on the certified path too. Misrepresenting that affirmation carries real exposure for the person who signs it, which is part of why it's worth asking who that person is, not just whether the box got checked.

SPRS scores and what a buyer can see

SPRS, the Supplier Performance Risk System, is the DoD database where contractors post their NIST SP 800-171 self-assessment score ahead of contract award. Scores run from 110 down to as low as -203, starting at 110 and losing points for each unmet control, weighted by how serious that control is. It's a real, defined number, and it's the thing most buyers assume they can just look up.

That assumption is where it gets murky. Whether a prime or buyer can see a supplier's actual SPRS score is genuinely disputed across the sources available, and nothing published settles it cleanly. What is certain: SPRS is a government system, and a current entry at the required level is something DoD checks before award. What's commonly reported, though not verified against a primary SPRS access policy, is that primes typically don't get portal access to the raw number and instead rely on the supplier handing over a printout or screenshot of their own score on request. If you need the actual figure for your own risk assessment, the reliable path is to ask the supplier for it directly rather than assume you can pull it yourself. Don't tell a supplier you'll "check their SPRS score" as a substitute for asking; you may not be able to.

What flows down to a subcontractor

A handful of DFARS clauses carry these obligations down a supply chain, and they stack rather than replace one another. DFARS 252.204-7012 requires NIST SP 800-171 implementation for covered defense information and 72-hour cyber incident reporting, and it's still in force. DFARS 252.204-7019 requires a current self-assessment score posted to SPRS before award. DFARS 252.204-7020 enables government-led assessments and carries 7012's obligations further down the chain, applying to nearly every subcontract except commercial-off-the-shelf purchases. DFARS 252.204-7021 is the CMMC clause itself: it requires the contractor to hold the required CMMC Status, post it to SPRS, affirm annually, and flow the CMMC requirement down to every subcontractor handling FCI or CUI. That's industry's read of how the clauses function together, not a verbatim quote of the regulatory text, but it's consistent across sources.

The level that flows down isn't automatically the prime's own level. It's set, again, by what each tier in the chain actually touches. A second-tier sub that only ever sees FCI needs Level 1, even if the prime holds Level 2. A sub several tiers down that receives a CUI-marked drawing needs Level 2, regardless of how far removed they are from the prime. The obligation on the party above them in the chain is to figure out who's getting CUI and flow the matching requirement to exactly those suppliers, not to apply one level uniformly because it's simpler to write into every PO.

What a purchase order should require

A PO that handles this well does a few specific things, and none of them require legal language you can't write yourself.

State the level plainly rather than leaving it implied, and base it on whether the work involves FCI only or CUI. If CUI is involved, say exactly what data, drawings, or specs carry that marking so the supplier isn't guessing at scope. Require a current SPRS entry at the required level before award, not a verbal claim of compliance, and if you need the actual score, ask the supplier to provide it rather than assuming you can look it up. Require the relevant DFARS clauses to flow down intact: 7012 if covered defense information is involved, 7019 and 7020 for assessment and reporting cooperation, and 7021 if a CMMC Status is contractually required, including the supplier's obligation to pass that requirement further down their own chain. Require annual affirmation by a named Affirming Official rather than a one-time sign-off at onboarding.

Industry describes the rules around partial compliance this way: a Plan of Action and Milestones, or POA&M, lets a supplier close small gaps after the fact rather than before award, but only under conditions. At Level 1 a POA&M isn't allowed at all. At Level 2 it's allowed only when the overall score is 88 or higher and the open items are minor and not on a list of controls that can never be deferred. A supplier operating under a POA&M holds a Conditional status, not a final one, and it has to close the open items within 180 days of that conditional date or the status lapses. If a supplier tells you they're working from a POA&M, ask what's on it and when the 180-day clock started, because that's your actual exposure. Finally, note the 2026 reform status explicitly in supplier conversations, so nobody on either side is quoting a 2026 Phase 2 deadline that isn't currently operative, and build in a point to re-check status at renewal, since affirmations and scores aren't permanent.

When CMMC is the wrong question

Not every purchase order needs any of this. If the work genuinely never touches federal contract information or controlled unclassified information, CMMC doesn't apply, and asking a supplier to certify to a level they don't need adds cost and friction without protecting anything. This happens more often than buyers expect: commercial parts built to a spec that happens to originate from a defense program aren't automatically in scope just because the end customer is the government somewhere upstream.

The test is still the data, not the industry. Before writing a CMMC requirement into a PO, check whether the supplier will actually receive or generate FCI or CUI in the course of that specific work. If the answer is no, the right move is to say so and skip the requirement, not to require a level as a precaution.

Conclusion

The headline fact is the one most guidance online still gets wrong: third-party CMMC certification isn't currently required, and hasn't been since July 2026, even though Phase 1 self-assessment remains fully in force. The level a supplier needs is set by the data flowing to them, FCI or CUI, not by their size or what they already hold. SPRS visibility is murkier than most buyers assume, so ask the supplier for their score rather than assuming you can look it up yourself. Write the level, the data in scope, and the clause flow-down into the PO explicitly, and check back in as the Reform Task Force's outcome lands, because this is a programme that's still actively moving.