Cybersecurity & Digital
Date DoD suspended CMMC Phase 2 and later milestones
Security practices required for a Level 2 assessment
Maximum POA&M closure window for conditional certification
Regulation Overview
CMMC 2.0 is the Department of Defense's mandatory cybersecurity certification framework and the cornerstone of defense supply chain cybersecurity governance. For supply chain teams, the primary obligation is ensuring that every contractor and subcontractor handling Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) implements verified cybersecurity controls aligned with NIST SP 800-171.
The framework requires 110 security practices organized across 14 domains for Level 2, the level that applies to contractors handling CUI. The DoD published the final DFARS acquisition rule on September 10, 2025, and Phase 1 began on November 10, 2025, making CMMC 2.0 compliance a condition of contract award where a level is specified. Companies placing products or services into the defense supply chain must demonstrate continuous compliance monitoring and audit readiness through self-assessments or third-party C3PAO certification.
CMMC 2.0 compliance requires documented evidence (system security plans, SPRS scores, annual affirmations, and plans of action and milestones) from contractors across the supply chain. Phase 2 is suspended while a DoD reform task force reviews the program, but self-assessment obligations remain, and a self-attestation that cannot be backed by evidence carries False Claims Act exposure.
DoD prime contractors handling FCI or CUI under DFARS 252.204-7021
Subcontractors at every tier receiving CUI flow-down from prime contractors
Manufacturers supplying components for defense programs with CUI markings
IT and managed service providers supporting contractor environments with CUI
Non-U.S. defense industrial base suppliers handling CUI under international contracts
Commercial companies with dual-use products entering defense supply chains
Key Thresholds
During the suspension, new solicitations designate Level 1 (Self) or Level 2 (Self), yet some prime contractors still require C3PAO certification, and your supply chain spans dozens of subcontractors across multiple tiers. Prime contractors must verify each supplier's CMMC status before subcontract award. Supplier 1 claims Level 2 self-assessment is sufficient. Supplier 2 has a conditional status with open POA&M items. Supplier 3 has not posted an SPRS score. Your team spends weeks chasing SPRS scores and certification evidence manually.
Your organization achieves conditional CMMC Level 2 status, but six security practices require remediation. The 180-day POA&M closure window starts immediately. Your IT team is remediating access controls while your compliance team tracks evidence across 14 security domains. Day 170: two items remain open. Day 181: conditional certification expires. You cannot bid on the contract renewal.
CMMC assessors require documented evidence for every implemented practice—not just a policy on paper but proof of execution. Access control logs, configuration baselines, incident response records, and training completion certificates all require centralized compliance data management. Without AI document parsing and certificate validation, your team manually compiles evidence from email attachments, shared drives, and disconnected systems.
CUI protection obligations flow down through every subcontractor tier. A Tier 3 machine shop handling technical drawings with CUI markings triggers the same CMMC obligations as your prime contract. Without multi-tier supply chain transparency, you cannot identify which suppliers handle CUI, which have current certifications, or which create compliance gaps that jeopardize your own contract eligibility.
Certivo In Action
Certivo in Action — CMMC Workflow
Features Tabs
From Manual Evidence Chasing to Exception Management
CORA collects and validates supplier certification evidence automatically through automated supplier data collection and portals. Your team focuses on suppliers that need human judgment—not manual spreadsheet tracking across 14 security domains.
Supply Chain Compliance Acceleration
Generate complete, audit-ready CMMC compliance packages from validated supplier data across subcontractor tiers, without weeks of manual compilation.
Proactive CMMC Compliance Management
When supplier certifications expire, POA&M deadlines approach, or phase requirements change, Certivo alerts your team instantly. Know which subcontractors create compliance risk before contracting officers ask.
Frequently Asked Questions
What companies are subject to CMMC 2.0 certification requirements?
Any organization holding or bidding on DoD contracts that involve Federal Contract Information or Controlled Unclassified Information must comply where the contract specifies a CMMC level. This includes prime contractors, subcontractors at every tier, IT service providers supporting CUI environments, and manufacturers supplying components for defense programs. During the Phase 2 suspension, new DoD solicitations designate Level 1 (Self) or Level 2 (Self), while DFARS 252.204-7012 continues to require NIST SP 800-171 protection of covered defense information. Certivo's automated supplier data collection identifies which suppliers in your network require certification and tracks their compliance status in real time.
What are the consequences of CMMC 2.0 non-compliance?
Non-compliance results in ineligibility for DoD contract awards and options where a CMMC level is required. Under the False Claims Act, organizations that falsely claim CMMC compliance face civil penalties and treble damages, and may also face suspension or debarment from future DoD contracts. The DoJ's Civil Cyber-Fraud Initiative actively pursues whistleblower-driven investigations against inaccurate self-attestations. CORA's continuous compliance monitoring helps your organization maintain verified, defensible evidence to reduce False Claims Act exposure.
Is CMMC Phase 2 still happening?
Not on the original schedule. DoD suspended the Phase 2 transition on July 13, 2026, before its planned November 10, 2026 start, and froze later milestones while a CMMC Reform Task Force reviews the program. A September 3, 2026 class deviation directs contracting officers to remove third-party assessment requirements from contracts, but 32 CFR Part 170 and DFARS 252.204-7021 remain in force and no new Phase 2 date has been published. Certivo tracks DoD CMMC announcements and maps any reinstated requirement against each contract and supplier, so affected subcontractors can be identified and contacted when the program changes.
What evidence formats does Certivo accept from defense suppliers?
Certivo accepts any format: SPRS score screenshots, System Security Plans, POA&M exports, C3PAO certification letters, PDF compliance attestations, Excel evidence matrices, and freeform responses. CORA extracts certification data regardless of format or language, eliminating the need to standardize evidence inputs across your defense supply chain through AI document parsing and certificate validation.
Does Certivo support CMMC alongside DFARS, NIST 800-171, ITAR, and related defense frameworks?
Yes. Certivo validates against CMMC levels, NIST SP 800-171 controls, DFARS 252.204-7012 requirements, and export control frameworks simultaneously. The same supplier submission is validated across multiple cybersecurity and defense compliance requirements—eliminating duplicate collection campaigns and providing a centralized compliance data backbone for multi-framework defense supply chain governance.