Do subcontractors need CMMC Level 2?

Yes, if they receive CUI from a prime. CMMC requirements flow down every tier of the supply chain, so a subcontractor handling technical drawings, specifications, or test data carries the same Level 2 obligation as the prime, and cannot rely on the prime's certification to cover its own systems.

Can I use a POA&M for CMMC Level 2 gaps?

Yes, with conditions. You must meet a minimum score threshold before a POA&M is permitted, so you cannot defer every gap. Submitting with open POA&M items makes your status conditional, and you must resolve those items and close the POA&M within 180 days or the conditional status lapses.

How many contractors are affected by CMMC Phase 2?

The DoD final rule estimated that roughly 66,000 organizations would need CMMC Level 2. The planned Phase II transition is now suspended, so contractors should verify current requirements with their contracting officer or prime and wait for official guidance on the revised rollout.

What happens if I misrepresent my SPRS score?

Misrepresenting your compliance posture in SPRS carries real legal exposure under the Department of Justice Civil Cyber-Fraud Initiative. An honest score with a credible POA&M is far safer than an inflated score you cannot defend, and it still shows contracting officers you are an engaged supplier.

Does CMMC Level 1 compliance cover CUI contracts?

No. Level 1 covers Federal Contract Information only and does not satisfy a Level 2 requirement. If your company handles CUI, review the applicable Level 2 contract requirements, which are built on all 110 NIST SP 800-171 requirements and use SPRS scoring and annual affirmation.

CMMC Phase 2 Enforcement 2026: Timeline Update

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}CMMC Phase 2 Enforcement 2026: Timeline UpdateThe planned November 2026 transition to CMMC Phase II was suspended in July 2026. Review the original timeline and what contractors should do now.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.