CMMC/NIST 800-171

Who has to comply

Defense contractors and subcontractors that process, store or transmit Federal Contract Information (Level 1) or Controlled Unclassified Information (Levels 2 and 3) under contracts containing DFARS 252.204-7021. The required level is set in each solicitation and flows down the supply chain.

What you have to write

Documents on this site that CMMC/NIST 800-171 requires or expects, each with who must have it, the review cycle and the obligations that cite it.

• Incident Response Plan Information security

What the assessor asks to see

System Security Plan with boundary and data flows; CUI inventory and data classification; policies and procedures for each NIST 800-171 family; SPRS score and prior self-assessment; access control, MFA and account management records; configuration baselines; audit log samples; vulnerability scans and patching records; incident response plan and records; awareness training completion; POA&M; external service provider and cloud FedRAMP evidence; the senior official affirmation.

Where the requirement sits: 800-171 3.2.1-3.2.3 awareness and training; 3.12.4 SSP; 800-171A assessment objectives '[a]... is defined'; 3.3 audit and accountability, 3.14 system monitoring are technical

Levels

Level 1 (FCI): 15 requirements from FAR 52.204-21, annual self-assessment. Level 2 (CUI): 110 requirements from NIST SP 800-171 Rev 2, self-assessment or C3PAO certification as specified in the solicitation, valid three years. Level 3 (highest-risk CUI): Level 2 certification plus 24 NIST SP 800-172 (February 2021) requirements assessed by DIBCAC.

Phase-in and the 2026 suspension

Phase 1 began November 10, 2025 (self-assessments). Phase 2 was scheduled for November 10, 2026 and would have expanded C3PAO Level 2 certification as a condition of award; Phases 3 and 4 were scheduled for November 10, 2027 and November 10, 2028 (32 CFR 170.3(e)).

On July 13, 2026 the Department suspended Phase 2 and later phases pending a 60-day CMMC Reform Task Force review reporting around mid-September 2026.

Contracting officers were told to remove CMMC Level 2 (C3PAO) and Level 3 (DIBCAC) requirements from existing contracts by modification, before the next option period or at the next scheduled administrative modification, and Class Deviation 2026-O0025, Revision 3 (September 3, 2026) made that binding. As of September 29, 2026 the task force's findings had not been published.