Skip to content
ComplianceOfficer
§ 01

CMMC 2.0

CMMC compliance software, the 110 controls and the rule changes

Run the free scan

Work email and a 6 digit code. No card, nothing charged. Starter plan $149 a month when you want the daily watch.

CMMC compliance software helps a defense contractor prove it protects Controlled Unclassified Information: it maps the 110 NIST SP 800-171 controls to what you already run, tracks the evidence for a Level 2 self-assessment or a C3PAO audit, and keeps your System Security Plan and SPRS score current. ComplianceOfficer does not do this job, and CMMC and NIST SP 800-171 are not among the frameworks its scan and daily watch use today (SOC 2, ISO 27001, GDPR, HIPAA, AML/KYC, SOX and PCI DSS). What it can do for a contractor is keep a register of the frameworks that overlap with 800-171, such as ISO 27001 and SOC 2, and check those sources once a day. This page tracks the CMMC rule itself, read from the primary sources.

Scan the frameworks that overlap with CMMC

Pick your sector and the frameworks you also answer to below; ISO 27001 and SOC 2 overlap most with NIST 800-171. The scan returns the obligation register with the last 12 months of regulatory movement, sources linked. It has no CMMC lines. No signup, nothing stored.

§ Live · Compliance scan

One free run. Nothing you pick is stored.

Frameworks you answer to

Fintech, US · first rows of a real scan

  • § 01 Control environment and governance
  • § 02 Risk assessment and monitoring of controls
  • § 03 Logical access controls
  • § 04 System monitoring and incident response
§ 02 What actually changed

CMMC Phase 2 was suspended on 13 July 2026

Here is the state of play, because most vendor pages still say third-party certification becomes mandatory in November 2026. It does not, at least not on that date.

On 13 July 2026 the Department of War announced the immediate suspension of CMMC Phase 2, the rollout that would have required most contractors handling Controlled Unclassified Information to pass a third-party assessment by an authorized C3PAO starting 10 November 2026. The Pentagon opened a 60-day review of the program and issued a Request for Information on cost and burden, with responses due 14 August 2026. Reporting from WilmerHale, Morgan Lewis and Federal News Network all confirm the same scope. We tracked the announcement, the review window and the contractor impact in our full breakdown of the CMMC Phase 2 suspension.

What did not change is the important part. Phase 1, which took effect on 10 November 2025 and requires a Level 1 or Level 2 self-assessment in applicable solicitations, stays in force. Every contractor's existing duty under DFARS 252.204-7012 to implement the 110 NIST SP 800-171 controls and report incidents within 72 hours is untouched. The 110 controls and the 320 assessment objectives did not move. Only the mandatory third-party verification method is paused. This is exactly the kind of fast-moving change a regulatory change management engine is meant to surface quickly.

The 110 controls, across 14 NIST 800-171 families

CMMC Level 2 is NIST SP 800-171 Rev. 2 in full: 110 requirements grouped into 14 control families and checked against 320 assessment objectives. The list below is the 14 families as the standard groups them. It is not something our scan builds, because CMMC is not in it.

  • § 01 Access control across systems and CUI AC
  • § 02 Awareness and training for staff AT
  • § 03 Audit and accountability, log review AU
  • § 04 Configuration management and baselines CM
  • § 05 Identification and authentication, including MFA IA
  • § 06 Incident response and 72-hour reporting IR
  • § 07 Maintenance of systems and tools MA
  • § 08 Media protection and sanitization MP
  • § 09 Personnel security and screening PS
  • § 10 Physical protection of facilities PE
  • § 11 Risk assessment and vulnerability scanning RA
  • § 12 Security assessment and the SSP CA
  • § 13 System and communications protection, encryption SC
  • § 14 System and information integrity, flaw remediation SI

Each family maps to policies, technical controls and the evidence an assessor samples, and it rolls up into the SPRS score you self-report. A CMMC platform tracks that mapping and the score; ComplianceOfficer does not. How our daily check works for the frameworks we do cover is on how it works.

§ 03 Which level applies

Which CMMC level and path applies to you

Your level depends on the data you handle. The verification method reflects the July 2026 suspension: the self-assessment path is fully active, the third-party path is paused.

Level Who it covers How you verify (July 2026)
Level 1 Contractors handling only Federal Contract Information (FCI) Annual self-assessment of 15 FAR 52.204-21 requirements, affirmed in SPRS
Level 2 (Self) Most contractors and subcontractors handling CUI Self-assessment of the 110 NIST 800-171 controls, SPRS score, annual affirmation
Level 2 (C3PAO) CUI contracts a contracting officer designates as higher priority Third-party certification by an authorized C3PAO, suspended since 13 July 2026
Level 3 The most sensitive CUI, against advanced persistent threats The 110 controls plus a subset of NIST SP 800-172, assessed by the government (DIBCAC)

Roughly 80,000 contractors in the defense supply chain fall under Level 2. If you also carry SOC 2 or ISO 27001, the control overlap with NIST 800-171 is large, and our SOC 2 compliance software and ISO 27001 compliance software pages explain how to reuse the same evidence across frameworks.

CMMC compliance software questions, answered

Is CMMC still required in 2026?

Yes, in part. On 13 July 2026 the Department of War suspended CMMC Phase 2, the mandatory third-party certification rollout scheduled for 10 November 2026, and opened a 60-day review. Phase 1 Level 2 self-assessments, in force since 10 November 2025, still apply, and every contractor's duty under DFARS 252.204-7012 to implement the 110 NIST 800-171 controls is untouched. The controls still apply; only mandatory third-party verification is paused.

What are the CMMC Level 2 requirements?

Level 2 requires a contractor handling CUI to implement all 110 security requirements of NIST SP 800-171 Rev. 2, grouped into 14 control families and validated against 320 assessment objectives. You document them in a System Security Plan, track open items in a POA&M, and report a score to SPRS. As of July 2026 you can meet Level 2 by self-assessment with an annual affirmation, because the C3PAO path is suspended pending the review.

What is the difference between CMMC and NIST 800-171?

NIST SP 800-171 is the underlying standard: 110 requirements for protecting CUI in nonfederal systems. CMMC is the Department of War program that verifies a contractor has actually implemented them. NIST 800-171 is the rulebook and CMMC Level 2 is the check that you follow it. The 110 controls are identical either way, which is why the July 2026 suspension changed the verification method but not a single control.

Can CMMC software make me compliant?

No product makes you CMMC compliant on its own, and no vendor can sell you a certification the DoW recognizes. Compliance comes from actually implementing the 110 controls and then either self-affirming in SPRS or passing an authorized assessment. What software does is cut the labor: it scopes your CUI environment, maps the controls, collects evidence, calculates the SPRS score, and keeps the SSP and POA&M current so verification is faster.

What is a C3PAO and do I still need one?

A C3PAO is a CMMC Third-Party Assessment Organization authorized by the Cyber AB to perform CMMC Level 2 certification assessments. Because Phase 2 was suspended on 13 July 2026, a contracting officer cannot currently mandate a C3PAO certification for most CUI contracts, and the self-assessment path is the active route. Contractors already in a C3PAO assessment can finish, but the requirement to obtain one is paused during the review.

General regulatory information, not legal advice.

Run the compliance scan
§ 90

Related registers

§ 99 · Final entry

Create your account

Leave your work email, confirm the 6-digit code, and your account is ready. Nothing is charged to create it.

Buy the plan