Resources / Do subcontractors need CMMC
Do SubcontractorsNeed CMMC?
Last reviewed: October 15, 2026
Yes, if you handle federal contract information or CUI under a defense contract at any tier. The CMMC rule requires prime contractors to flow CMMC requirements down to their subcontractors, “such that compliance will be required throughout the supply chain at all tiers” (32 CFR 170.23). The level you need depends on the information you handle and on what your prime’s contract requires.
Which level applies to you?
| What you handle | Minimum level for you |
|---|---|
| Federal contract information only | Level 1 (self-assessment) |
| CUI, and the prime’s contract requires Level 2 (self-assessment) | Level 2 (self-assessment) |
| CUI, and the prime’s contract requires Level 2 (third-party) | Level 2 (third-party, by a C3PAO) |
| CUI, and the prime’s contract requires Level 3 | Level 3 (government assessment by DIBCAC), which requires a current Level 2 C3PAO certification first |
The prime contract sets the floor, and DoD may issue specific flow-down guidance for particular contracts. Your prime will tell you what applies, so ask early.
Why timing matters now
Status as of October 15, 2026. DoD is phasing CMMC into contracts. Phase 1 began on November 10, 2025, and put Level 1 and Level 2 self-assessment requirements into new contracts. Phase 2 was scheduled for November 10, 2026 and would have added Level 2 third-party (C3PAO) certification to most applicable solicitations. On July 13, 2026, DoD suspended Phase 2 and started a Reform Task Force review of the program. Contracting officers have been directed to remove third-party assessment requirements from solicitations and contracts, and the task force’s recommendations had not been published when we last checked (law firm summary, running timeline).
What the pause does not change:
- Level 1 and Level 2 self-assessments, SPRS scores and annual affirmations are still required, and inaccurate statements carry legal risk.
- DFARS 252.204-7012 and NIST SP 800-171 still apply wherever you handle CUI.
- Voluntary C3PAO assessments are still available, and some primes are still asking their suppliers for third-party certification.
The rules can change again when the review concludes. Preparation takes time, so subcontractors who handle CUI should not wait for a prime to ask. Confirm what applies to your contract with your prime or contracting officer.
What your prime will probably ask for
- The CMMC level required for your work
- Your current score and status in SPRS, DoD’s reporting system, for self-assessments
- A system security plan describing your environment
- An affirmation from a senior company official that you meet the requirements
- Confirmation that you pass the requirements down to your own subcontractors
Your first 30 days
- Ask each customer in writing what CMMC level your work requires and whether you receive CUI.
- List every system, person and vendor that touches that information.
- Check whether you hold a current NIST SP 800-171 assessment score and, if so, where it is recorded.
- Look for the largest gaps first, such as multi-factor authentication, logging, and a written system security plan.
- Decide whether to shrink your scope, for example by limiting CUI to a small, controlled environment. See CUI scoping and enclave design.
Frequently asked questions
I have no contract with DoD. Do I still need CMMC?
If you work for a company that does and you handle their federal contract information or CUI, yes. The requirement reaches you through your customer’s contract.
Do my own suppliers need CMMC?
If you pass them federal contract information or CUI, the rule requires you to flow the requirement down to them.
I only handle federal contract information. Which level applies?
Level 1 (self-assessment) is the minimum for subcontractors that handle only federal contract information, under the flow-down rule.
Not sure whether CMMC applies to you?
Call 877-855-CMMC or email [email protected]. Related: CMMC for subcontractors, CMMC Level 2.