Do subcontractors need CMMC Level 2?

Yes, if they receive CUI from a prime. CMMC requirements flow down every tier of the supply chain, so a subcontractor handling technical drawings, specifications, or test data carries the same Level 2 obligation as the prime, and cannot rely on the prime's certification to cover its own systems.

Can I use a POA&M for CMMC Level 2 gaps?

Yes, with conditions. You must meet a minimum score threshold before a POA&M is permitted, so you cannot defer every gap. Submitting with open POA&M items makes your status conditional, and you must resolve those items and close the POA&M within 180 days or the conditional status lapses.

How many contractors are affected by CMMC Phase 2?

The DoD final rule estimates roughly 66,000 organizations handle CUI and will need CMMC Level 2. That includes subcontractors who receive CUI, not just prime contractors. If your company touches CUI on DoD work at any tier, assume you are in that group and verify with your contracting officer or prime.

What happens if I misrepresent my SPRS score?

Misrepresenting your compliance posture in SPRS carries real legal exposure under the Department of Justice Civil Cyber-Fraud Initiative. An honest score with a credible POA&M is far safer than an inflated score you cannot defend, and it still shows contracting officers you are an engaged supplier.

Does CMMC Level 1 compliance cover CUI contracts?

No. Level 1 covers Federal Contract Information only and does nothing for a Phase 2 obligation. If your company handles CUI, Level 2 applies: a separate, much larger requirement built on all 110 NIST SP 800-171 practices, with its own SPRS score submission and annual affirmation.

CMMC Phase 2 Enforcement 2026: Key Deadlines

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}CMMC Phase 2 Enforcement 2026: Key DeadlinesPrepare for CMMC Phase 2 enforcement in November 2026. Learn which contractors are affected, what certifications are required, and what to do now.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.