CMMC is the Defense Department's program for verifying that contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). As of late September 2026, CMMC is paused in Phase 1: the Phase II requirements that were scheduled for November 10, 2026 were suspended on July 13, 2026, but the Phase 1 self-assessment requirements remain in place (DoD CIO, About CMMC). For most small parts suppliers, that means a CMMC Level 1 self-assessment against the 15 requirements in FAR 52.204-21, results in SPRS with an annual affirmation, and knowing when an RFQ calls for Level 2 instead.

What CMMC protects: FCI vs. CUI

Everything in CMMC hangs on the type of information you handle (DoD CIO):

• Federal Contract Information (FCI), as defined in FAR 4.1901, is information not intended for public release that's provided by or generated for the government under a contract to develop or deliver a product or service. It excludes information the government gives the public and simple transactional information, such as what's needed to process payments.
• Controlled Unclassified Information (CUI), per 32 CFR 2002.4(h), is information that a law, regulation or government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls.

For a machine shop, the question is what comes with the job. Drawings and technical data marked as CUI put you in Level 2 territory. Contract information that's just FCI is Level 1.

CMMC Level 1 self-assessment vs. CMMC Level 2 (Self)

The DoD CIO page says that with the program paused in Phase 1, it may only require self-assessments at two levels (DoD CIO):

• Level 1 (Self): basic safeguarding of FCI. An annual self-assessment and annual affirmation of compliance with the 15 security requirements in FAR 52.204-21. Results go into the Supplier Performance Risk System (SPRS). Plans of Action and Milestones (POA&Ms) aren't permitted, so you have to meet all of them.
• Level 2 (Self): broad protection of CUI. A self-assessment every three years against the 110 security requirements in NIST SP 800-171 Revision 2 (required by DFARS 252.204-7012), with an annual affirmation. Results go into SPRS. POA&Ms are permitted as defined in 32 CFR 170.21(a)(2) and must be closed out within 180 days. The assessment lapses if you fail to affirm annually.

What the CMMC Phase II suspension changed

During the pause, DoD says it will enforce NIST 800-171 Rev 2 compliance through self-assessments and select government-led assessments. It also says the pause doesn't remove the requirement to protect information under DFARS 252.204-7012.

What DFARS 252.204-7021 asks of you

When CMMC applies, the solicitation carries DFARS 252.204-7021 (NOV 2025), with the required level filled in by the contracting officer. Among other things, the clause requires the contractor to:

• have and maintain, for the duration of the contract, a current CMMC status at the stated level or higher for every information system that processes, stores or transmits FCI or CUI in performance of the contract;
• only process, store or transmit FCI or CUI on systems that have that status;
• complete and keep current an annual affirmation of continuous compliance in SPRS, made by an affirming official;
• give the contracting officer the CMMC unique identifier(s) (CMMC UIDs) that SPRS issues for those systems; and
• flow the right CMMC level down to subcontractors who will handle FCI or CUI.

The clause defines "current" precisely. For example, a Final Level 1 (Self) status is current for up to one year, and a Final Level 2 (Self) status for up to three years, each with an affirmation no older than one year.

A practical CMMC Level 1 routine and SPRS affirmation checklist

1. Know what you hold. List where contract documents, drawings and technical data live: shop PCs, email, file shares, CAM stations. That's your scope.
2. Do the CMMC Level 1 self-assessment. Work through the 15 requirements in FAR 52.204-21, since Level 1 doesn't allow POA&Ms.
3. Decide on CUI work honestly. If you want jobs that come with CUI, plan for the 110 NIST SP 800-171 Rev 2 requirements. If not, screen those RFQs out rather than bidding and scrambling after award.
4. Keep SPRS current. Enter results and set a calendar reminder for the annual affirmation.
5. Use free help. SBA points small businesses to Project Spectrum, a free DoD platform with cybersecurity tools, training and a readiness self-assessment (SBA).
6. Re-check the DoD CIO page. DoD has set up a CMMC reform task force, so the requirements may change. Watch the official page rather than secondhand summaries.

CMMC sits alongside set-aside, packaging and first article as a quote gate. See Small Business Set-Asides on SAM.gov for Machine Shops for the set-aside side.

New to DLA work? Our DIBBS guide for new suppliers and How to Bid on DIBBS cover the registration and quoting side.

Where FedOpp fits

CMMC is one of the gates FedOpp reads before you quote. Your Match Profile records your CMMC status, and Fit Check shows CMMC among the reasons behind each Pursue, Review or Skip. On DIBBS, the CMMC flag is one click away in Columns, and there's a one-click "No CMMC L2" shortcut. The AI Contract Reader also calls out CMMC in its plain-English brief of an uploaded RFQ. FedOpp doesn't assess or certify your cybersecurity, and it's assistive research, not legal advice. If you want to see which RFQs you can quote at your current level, start a 7-day free trial.

Frequently asked questions

Is CMMC still required after the July 2026 Phase II suspension?

Phase II was suspended, but DoD says all Phase 1 self-assessment requirements remain in place, and the DFARS 252.204-7012 obligation to protect information hasn't gone away (DoD CIO).

Can I use a POA&M on a CMMC Level 1 self-assessment?

No. POA&Ms aren't permitted at Level 1. At Level 2 (Self), POA&Ms are allowed within the limits of 32 CFR 170.21 and must be closed out within 180 days.

Where do CMMC results and the SPRS affirmation go?

Into SPRS. DFARS 252.204-7021 also requires an annual affirmation of continuous compliance in SPRS and giving the contracting officer your CMMC UIDs.

Sources

• DoD CIO, About CMMC (checked September 2026)
• DFARS 252.204-7021, Contractor Compliance With the CMMC Level Requirements (NOV 2025), acquisition.gov
• SBA, Get started with contracting (Project Spectrum)

Practical background for small suppliers, not legal advice. The solicitation and DoD's current CMMC guidance control.