What CMMC Readiness Really Means for Small Defense Subcontractors

Where things stand (as of October 4, 2026)

The Cybersecurity Maturity Model Certification (CMMC) program is set out in 32 CFR Part 170, which took effect on December 16, 2024. A companion DFARS rule took effect on November 10, 2025, which started the first implementation phase. Phase 1 centers on self-assessment: applicable solicitations call for CMMC Level 1 (Self) or Level 2 (Self).

On July 13, 2026, the Department of War (the secondary name the Department of Defense now uses under Executive Order 14347) announced the immediate suspension of the CMMC Phase 2 requirements. Phase 2 had been scheduled to take effect on November 10, 2026 and would have required third-party (C3PAO) Level 2 assessments as a condition of award for many contracts involving CUI. The department also set up a CMMC Reform Task Force to review the program. The task force’s report was due to the department’s Chief Information Officer in September, but as of late September 2026 it had not been made public.

During the suspension, solicitations may call only for CMMC Level 1 (Self) or Level 2 (Self), and all Phase 1 self-assessment requirements remain in place. A September 3, 2026 class deviation directs contracting officers to remove third-party assessment requirements from active solicitations and existing contracts. The department has stated that contractors and subcontractors remain obligated to safeguard covered defense information under DFARS 252.204-7012, and that it will enforce NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments.

The practical takeaway: the timeline for third-party certification has moved, but the underlying safeguarding obligations haven’t. Neither has the need to back up what you affirm.

Readiness question 1: What information do you actually receive?

Everything starts with scoping. Federal Contract Information (FCI) is generally covered by CMMC Level 1, which maps to the 15 basic safeguarding requirements in FAR 52.204-21. Controlled Unclassified Information (CUI) brings in Level 2, which aligns with the 110 security requirements of NIST SP 800-171 Rev. 2.

Many small subcontractors aren’t sure which category they’re in. Ask your prime directly what information the subcontract will involve and what CMMC level it will flow down. The prime or the next higher-tier contractor determines the level for the subcontract. Keep their answer in writing.

Readiness question 2: Where does that information live?

You can’t protect a boundary you haven’t drawn. List the systems, accounts, devices, cloud services, and people that touch FCI or CUI. That includes the shared drive, the email account where drawings arrive, and the laptop an engineer takes home. A smaller, well-defined environment is easier to secure and to document than “the whole company.” Scoping decisions should be deliberate and recorded.

Readiness question 3: Can you show each safeguard operating?

This is the difference between a policy binder and actual readiness. For each requirement in scope, ask three things:

• What do we do? The practice in plain language.
• Who owns it? A named person, not “IT.”
• What evidence shows it ran? Access reviews, configuration screenshots, training records, logs, and dates.

At Level 2, a System Security Plan describes how each requirement is met. The plan only has value if it matches what’s really happening. A practice described in the SSP but missing in operation is a finding waiting to be discovered, and it’s worse when someone has already affirmed it.

Readiness question 4: Who is affirming, and on what basis?

CMMC requires a senior official of the company to affirm compliance in the Supplier Performance Risk System (SPRS). Commentators have widely noted that these affirmations can carry False Claims Act exposure. That’s why I treat every affirmation as a claim that needs supporting evidence. Before anyone signs, the affirming official should be able to trace each material statement back to a record. If a requirement isn’t met, say so and track it as an open item. Don’t round it up to “met.”

Readiness question 5: What do your open items look like?

Gaps are normal, and an honest gap list is a sign of maturity, not failure. A useful plan of action names each open requirement, explains why it’s open, and assigns an owner, a target date, and the evidence that will close it. Check the current rules on which items may remain open and for how long before you rely on a conditional status.

What readiness is not

Readiness isn’t buying a tool, downloading a template, or a vendor’s assurance that their platform is “CMMC compliant.” Those can help. None of them replaces knowing your own scope and holding your own evidence.

Readiness work is also different from certification. ARE Global Consulting LLC isn’t a C3PAO and doesn’t issue CMMC certifications. My role in readiness work is to organize the claims, records, and open items so that the company and its prime can see clearly what is supported and what isn’t.

A practical first step

Write a one-page summary covering the information you receive from each prime, where it’s stored, the CMMC level each prime says will flow down, and who in your company owns the answer. If you can’t complete that page, that’s your starting point.

See also: Patch Check for Small Defense Contractors, a five-point inventory and patch review for NIST SP 800-171 evidence.

This article is general information, not legal advice. Confirm current CMMC requirements with your contracting officer, your prime, and qualified counsel.

About the author

Alfonso Ramon Evans is the founder and principal consultant of ARE Global Consulting LLC, an independent risk-advisory firm in Pittsburgh, Pennsylvania, registered in SAM.gov (UEI JHYYJCLHLWB6, CAGE 22QZ0). He advises small businesses and federal vendors on vendor readiness, CMMC readiness documentation, fraud risk, and identity verification. Read Alfonso Ramon Evans’s founder profile.

This is public advisory analysis. Hypothetical examples are not client results. Service boundaries and information-handling requirements remain applicable.