Phase 2 of the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) program begins on November 10, 2026. From that date, DoD contracting officers can make a third-party Level 2 certification a condition of award on contracts that involve Controlled Unclassified Information (CUI). The enabling contract clause, DFARS 252.204-7021, has been in effect since November 10, 2025, so Phase 1 solicitations already carry the requirement in some form. For a buyer at a prime contractor, the practical change is that a supplier’s self-reported cybersecurity score is no longer always enough to place a CUI-related order.

This guide covers what to verify, in what order, and where the evidence tends to be thin.

What Changes on November 10

Phase 1 centered on Level 1 and Level 2 self-assessments. Phase 2 adds the possibility that a solicitation requires a Level 2 certification assessment performed by a Certified Third-Party Assessor Organization (C3PAO). Whether a given contract requires it is stated in the solicitation, not assumed from the program calendar, so the first verification step is to read the contract and identify which level and which assessment type it demands.

Level 2 maps to the 110 security requirements of NIST SP 800-171 Rev 2. A C3PAO certification is valid for three years, with an annual affirmation of continued compliance filed by the contractor. A self-assessment path also exists for some Level 2 contracts, with results posted to the Supplier Performance Risk System (SPRS). Which path applies is the contracting officer’s call.

The Pre-Award Verification Checklist

For any supplier that will process, store or transmit CUI, confirm each of the following before issuing a purchase order or subcontract:

  1. Required level for this work. Match the CMMC level in your prime contract to what you flow down. The clause requires flowing down only the level and assessment type that apply to the information the subcontractor will actually receive.
  2. Current status evidence. Ask the supplier for its CMMC status record and, where applicable, its certificate and issue date. Primes generally cannot look up another company’s CMMC information in SPRS, so the supplier has to provide the evidence. Get it in writing and file it with the award package.
  3. Assessment scope. A certificate covers a defined assessment boundary. Confirm the facility, network enclave and systems that will handle your CUI are inside it. A supplier certified for its headquarters enclave may not have certified the plant-floor system that stores your drawings.
  4. Open items. Under DoD’s scoring method, a conditional status can include a limited plan of action and milestones (POA&M), and open items must be closed within 180 days. Ask whether any are outstanding and when they close.
  5. Annual affirmation. Ask for confirmation that the supplier’s affirmation of continuous compliance is current.
  6. Sub-tier exposure. Find out whether the supplier will pass your CUI to its own subcontractors, such as a heat-treat house, a software host or a managed IT provider, and whether the same flow-down applies to them.

Scope Is Where Awards Go Wrong

Many failed supplier reviews are scope failures, not control failures. Common patterns include a supplier that holds a certification but runs engineering files through an unassessed cloud service, a shop that keeps CUI on shared drives outside the enclave, and a company that assumes it is “Level 1 only” while receiving export-controlled drawings marked as CUI.

Ask the supplier to describe, in plain language, where CUI enters, where it lives and who can access it. Compare that answer with the certificate’s stated scope. A mismatch is a finding even when the certificate is valid.

Suppliers that never touch CUI do not take on Level 2 scope. Do not push a Level 2 requirement onto a commodity vendor whose work involves only publicly releasable specifications. Over-flowing the clause shrinks your supplier pool and adds cost without reducing risk.

CMMC does not replace the older cybersecurity clauses. DFARS 252.204-7012 covers safeguarding of covered defense information and incident reporting, and DFARS 252.204-7020 deals with NIST SP 800-171 DoD Assessments. Vendor summaries disagree on which clause carries which pre-award check, so have your contracts team confirm the exact obligations in your own prime contract and flow them down in the supplier agreement. Include incident reporting expectations in that agreement, so a supplier breach reaches you quickly instead of surfacing at audit time.

Build the Timeline Into Sourcing

C3PAO assessments are scheduled work, and small manufacturers that have not started preparing may not hold a certificate by the time your solicitation closes. That has three procurement consequences:

  • Survey early. Ask current CUI-handling suppliers where they stand in readiness and assessment scheduling. A supplier with no scheduled assessment is a risk to your delivery plan.
  • Qualify a second source. If a sole-source supplier cannot show a path to the required status, begin qualifying an alternate before it affects an award.
  • Write status into the contract. Include a requirement to notify you if certification lapses or an affirmation is missed, because contracting officers cannot award, extend or exercise options unless the contractor’s status is current in SPRS.

A Short Takeaway for Buyers

Treat CMMC status like any other qualification you track: required level, evidence on file, scope checked, expiry dated and a named person who reviews it. Before November 10, pull your list of suppliers that touch CUI, confirm which of your open solicitations are likely to ask for third-party certification, and request status evidence now rather than at award. Check final requirements against your contract, the DFARS clause text and 32 CFR Part 170, since vendor summaries of the rule vary.