The Two-Part CMMC Series Opens — Why This Briefing Exists
80,000 DoD contractors need CMMC Level 2 certification before Phase 2 begins November 10, 2026. As of March of this year, fewer than 2 percent had completed it. This transmission is for the 98 percent — the foundational briefing on what CMMC is, where it came from, who it applies to, and what it actually requires.
The Origin Story — Why the DoD Built CMMC
The Defense Industrial Base was bleeding intellectual property to nation-state threat actors at a catastrophic rate. F-35 Joint Strike Fighter design, naval submarine specifications, hypersonic weapon research — much of it exfiltrated through Tier 2 and Tier 3 subcontractors operating under self-attested compliance. CMMC is the DoD’s answer: the move from “trust but verify” to “independently verified.”
The Three CMMC Levels — Foundational, Advanced, Expert
Level 1 (Foundational) for Federal Contract Information — 15 controls, self-assessment permitted permanently. Level 2 (Advanced) for Controlled Unclassified Information — 110 NIST 800-171 controls, 320 assessment objectives, mandatory C3PAO certification starting Phase 2. Level 3 (Expert) for the DoD’s most sensitive programs — Level 2 plus 24 controls from NIST 800-172, assessed by the DoD itself starting Phase 3 in 2027.
The Assessment Process — What the C3PAO Actually Looks At
The Certified Third-Party Assessor reviews the System Security Plan, the POA&M, the policy documentation for each of the 14 control families, and the technical evidence demonstrating each of the 320 assessment objectives. They interview your people, observe your environment, and sample your logs. Conditional certification carries a 180-day remediation window. Final certification is good for three years.
The Supply Chain Reality — DFARS Flowdown and Prime Enforcement
DFARS 252.204-7021 — enforceable since November 10, 2025 — requires prime contractors to flow CMMC requirements down to subcontractors handling CUI. Lockheed Martin, Boeing, Northrop Grumman, Raytheon, and General Dynamics are already requiring CMMC compliance documentation in supplier procurement processes. They are not waiting until the November 2026 deadline to enforce.
CMMC as a Business Investment — Not an Expense
The contractors who certify ahead of the curve gain a structural competitive advantage. Subs who certify early become high-demand suppliers commanding premium pricing as primes scramble to replace non-certified vendors. The window between now and broad certification saturation is the leverage window — for both winning new business and renegotiating existing rates.
The Three Marching Orders Every Contractor Must Execute This Week
Determine your required level by reviewing current contracts and the 24-month pipeline for CUI exposure. Pull your current SPRS score — every contractor should know it off the top of their head. Identify where CUI actually lives in your environment — if you cannot draw the boundary on a whiteboard in five minutes, the assessment will fail.
// INCOMING SITREP
The operational playbook for building the System Security Plan — the document the C3PAO reads first. The eight-section build guide, the 90-day sprint, and the three failure modes that derail most assessments. Read the SITREP dossier.
ACCESS THE BRIEF »The Compliance Program That Will Decide Who Bids on Defense Contracts for the Next Decade
There are 80,000 contractors in the Defense Industrial Base who will need CMMC Level 2 certification before Phase 2 takes effect on November 10, 2026. As of March of this year, fewer than 2 percent of them had completed certification. The math from here is the entire story of the next six months.
This episode is Part 1 of a two-part briefing on the Cybersecurity Maturity Model Certification — the single most consequential compliance program in the Defense Industrial Base. Part 2, next week, will cover the Phase 2 deadline reckoning. Today’s transmission is the foundation: what CMMC is, where it came from, who it applies to, and what it actually requires.
Why the DoD Built CMMC in the First Place
The DoD did not create CMMC because they needed another framework. The NIST publications and ISO standards already existed. CMMC exists because the Defense Industrial Base was bleeding intellectual property at a catastrophic rate.
Nation-state threat actors have systematically targeted the most sensitive programs in the U.S. defense ecosystem. F-35 Joint Strike Fighter design data. Naval submarine specifications. Hypersonic weapon research. Much of that intellectual property has been exfiltrated — not through breaches of the prime contractors, but through breaches of the Tier 2 and Tier 3 subcontractors operating under self-attested NIST 800-171 compliance that was never independently verified.
For years, the DoD ran on the honor system. Contractors self-attested that they had implemented the required security controls. The enforcement mechanism was after-the-fact audit. The problem with that model — as the CISO put it on this transmission — is that by the time the breach is discovered, the intellectual property is already in Beijing or Moscow.
CMMC is the structural answer. It moves the entire Defense Industrial Base from self-attestation to third-party verification. From “we promise we did the work” to “an independent C3PAO confirmed we did the work, and the certification is on file with the government.” That change is the entire program. And that change is the difference between eligible to bid and ineligible to bid for the next decade of defense contracts.
The Three CMMC Levels — And Why Level 2 Is the One That Matters
CMMC has three certification levels, each tied to a specific category of information the contractor handles.
Level 1 (Foundational)
Applies to contractors handling Federal Contract Information — information the government provides or generates in the course of a contract that is not intended for public release. Level 1 requires 15 basic security practices from NIST SP 800-171 Rev. 2. Self-assessment is permitted permanently for Level 1, with annual affirmation required.
Level 2 (Advanced)
Is the level that matters for the majority of the Defense Industrial Base. It applies to contractors handling Controlled Unclassified Information — CUI. Level 2 requires implementation of all 110 controls in NIST SP 800-171 Rev. 2, with 320 assessment objectives. Phase 1 allowed self-assessment for most Level 2 contracts. Phase 2, beginning November 10, 2026, requires C3PAO certification for the majority of Level 2 contracts. This is the change every contractor in the DIB is preparing for.
Level 3 (Expert)
Applies to contractors working on the DoD’s most sensitive programs — classified or near-classified work. Level 3 requires Level 2 plus 24 additional controls from NIST SP 800-172. Assessment is conducted by the DoD itself, not a third party. Phase 3 begins November 10, 2027.
The underlying framework is NIST SP 800-171 Rev. 2 — 110 controls organized into 14 control families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity. The control families are the architecture. The 110 controls are the bricks. The 320 assessment objectives are the inspection points.
FCI vs. CUI — The Distinction Most Contractors Get Wrong
Most contractors think they only handle Federal Contract Information. Most contractors are wrong.
CUI includes technical drawings, system specifications, contract performance data, financial information related to federal contracts, export-controlled technical data, and any information marked as CUI by a federal agency. If you have ever opened a Statement of Work for a DoD contract and it mentioned export controls, ITAR, EAR, or technical data — you are handling CUI. Level 2 applies.
The CISO’s working recommendation on this transmission was direct: if you are working with the DoD in any capacity, default to assuming Level 2. The cost of building Level 2 controls when only Level 1 is required is meaningfully lower than the cost of being unprepared when CUI shows up in your next contract.
The C3PAO Assessment — What Actually Happens
A Certified Third-Party Assessor Organization — a C3PAO — is an outside firm authorized by the Cyber AB to conduct CMMC Level 2 certification assessments. There are currently fewer than 80 authorized C3PAOs in the country and only about 800 Certified CMMC Assessors. The DoD estimates the Defense Industrial Base needs 2,000 to 3,000 assessors to clear the certification backlog. That gap is the entire reason the November 2026 deadline is going to hit so hard — and Part 2 of this series will unpack that math in operational detail.
When the C3PAO arrives, they review the System Security Plan, the Plan of Action and Milestones, the policy documentation for each of the 14 control families, and the technical evidence demonstrating each of the 320 assessment objectives. They interview your people. They observe your environment. They sample your logs. They do everything a real audit does, because that is what they are.
If a contractor passes the assessment with minor gaps, the C3PAO can issue a Conditional Level 2 certification with an accepted POA&M and a 180-day remediation window. If the gaps are not closed within 180 days, the conditional certification expires and the contractor is back to ineligible. Final certification is good for three years.
The Supply Chain Reality — Why “We Just Sub to a Prime” Is Not a Safe Position
DFARS 252.204-7021, which became enforceable on November 10, 2025, requires prime contractors to flow CMMC requirements down to subcontractors that handle CUI in the course of contract performance. If the prime needs Level 2, the subs touching CUI need Level 2 — as a condition of receiving work, not at some future date.
Lockheed Martin, Boeing, Northrop Grumman, Raytheon, General Dynamics — the major primes have already issued supplier directives demanding CMMC compliance documentation. They are not waiting until the November deadline to enforce. They are already filtering supplier selection on CMMC certification status. Subs without certification are being deprioritized in procurement rationalizations happening right now.
The DoD estimates that approximately 65 percent of the Defense Industrial Base is affected by Phase 1. Approximately 80,000 contractors will need Level 2 certification before Phase 2 takes effect. The DoD’s own modeling assumes a meaningful number of contractors will simply exit the DIB rather than complete certification.
The strategic implication runs both directions. For a sub, getting certified early creates leverage — there will be high demand for certified suppliers as primes scramble to fill compliance gaps in their supply chains. For a prime, identifying which subs are on track to certification is now a procurement decision that affects program delivery. The certified sub commands premium pricing. The non-certified sub commands a polite exit from the supplier list.
CMMC as Business Investment — Not Business Expense
The most important reframe from this transmission was the business framing. CMMC certification, right now, is not a cost. It is an investment. Specifically, an investment in winning more deal flow during the window before market saturation.
The pattern mirrors what happens in every regulated B2B sector. SOC 2 used to be a competitive differentiator for SaaS companies — now it is the cost of doing enterprise business. HIPAA used to be a healthcare-tech advantage — now it is table stakes. CMMC is currently in the differentiator window. Contractors who certify before broad saturation gain a structural competitive advantage that materially affects revenue for the next 12 to 24 months.
The contractors who wait until certification is universal will be playing catch-up against competitors who used the window to lock in new contracts at premium positioning.
The Three Marching Orders Every GovCon Executive Must Execute This Week
The CISO closed with three concrete actions to execute starting tomorrow morning.
1. Determine your required level.
Pull every active DoD contract, every active subcontract under a DoD prime, and every contract pipeline opportunity for the next 24 months. For each one, determine whether the work involves FCI only or CUI. If any contract or pipeline opportunity involves CUI, your organization needs Level 2. Document the determination in writing.
2. Pull your current SPRS score.
Every DoD contractor is required to have a current Basic Assessment score in the Supplier Performance Risk System. The score is public-facing to primes. If you do not know your SPRS score off the top of your head, that is the first finding any prime contractor reviewing your supplier file will identify.
3. Identify where CUI lives in your environment.
Your System Security Plan. Your file shares. Your email systems. Your endpoints. Your cloud environments. If you cannot draw the boundary around CUI on a whiteboard in five minutes, the assessment will fail before the assessor finishes their first day.
The Operational Playbook for the System Security Plan Is Here
Marching Order 3 — identifying where CUI lives and building the System Security Plan that documents it — is the single highest-leverage piece of preparation any contractor can complete this quarter. The SSP is the first document the C3PAO opens. It is the document that bounds the assessment. It is the document that gives the contractor control over the narrative or hands that control to the assessor.
The operational build guide — the eight sections every CMMC SSP must contain, the 90-day build sprint, and the three failure modes that derail most assessments — is laid out in this week’s Sitrep companion: The CMMC System Security Plan: A Step-by-Step Build Guide for DoD Contractors.
CMMC is not a checkbox. It is the new floor of eligibility to do business with the Department of Defense. The floor goes up on November 10, 2026. Part 2 of this series next week unpacks exactly what happens on that day — and the 30/60/90 day sprint every contractor must execute between now and then.Execute the standard.
// DECODED TRANSCRIPT
Access the full text logs of this transmission for compliance and review purposes.