DoW CIO MEMOMUST
Self-assessment only
Requirements may designate only CMMC Level 1 (Self) or CMMC Level 2 (Self) during the review.
- Home
- CMMC and NIST 800-171
CMMC Level 1 and Level 2 self-assessments you can affirm
While the Department of War (DoD) reviews the CMMC program, solicitations may require only Level 1 (Self) or Level 2 (Self), and the Department checks with select Government-led assessments. NISTcompliance.ai keeps your system security plan, evidence and POA&M against the 110 requirements of NIST SP 800-171 Rev. 2 in one record you can affirm.
Phase 2 paused: Level 1 (Self) and Level 2 (Self) onlyRuns inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
Phase 2 status
What the July 13, 2026 suspension changed
Phase 2 would have required Level 2 (C3PAO) at award from November 10, 2026. On July 13, 2026 the Department of War suspended that transition while the DoW CIO reviews the program.
DoW CIO MEMOMUST
No C3PAO or DIBCAC designations
Program managers and requiring activities may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period.
DoW CIO MEMOMUST
Contracts are amended
Active solicitations with those requirements are amended. Existing contracts are modified before the next option period is exercised or at the next scheduled administrative modification.
DoW CIO MEMOFACT
Self-assessment plus Government-led checks
The Department continues to enforce NIST SP 800-171 Rev. 2 through Level 1 and Level 2 self-assessments and select Government-led assessments.
DoW CIO MEMOGUIDANCE
No waivers, more guidance to come
No waivers are granted during the review. The memo set a 60-day review; follow-on guidance had not been published as of mid-October 2026.
STILL IN FORCEMUST
7012 and SPRS still apply
DFARS 252.204-7012 still requires NIST SP 800-171 on covered systems, and self-assessment results and affirmations still go into SPRS.
Sources: DoW CIO memo implementing the Phase 2 suspension, Covington, Sep 21, 2026, 32 CFR 170.3, DFARS 252.204-7012, 32 CFR 170.22. Sources checked Oct 23, 2026. Not a substitute for the official text.
What NISTcompliance.ai does
One record from SSP to affirmation
System security plan
Your SSP kept current against the 110 requirements of NIST SP 800-171 Rev. 2, with evidence attached to each requirement.
Packages →Continuous monitoring
Evidence collected on a schedule, so the record behind your affirmation does not go stale between assessments.
Continuous monitoring →POA&M to closure
Open items tracked with owners and due dates until they close.
Assessor workspace
Evidence and history an assessor can trace, whoever performs the assessment.
Assessor workspace →Managed remediation
Quzara engineers who work the findings queue with you when the date is close.
Managed remediation →How it works
From scope to affirmation
Scope
Record the systems in scope and the level each contract names.
Assess
Work through each requirement with evidence attached.
Close
Gaps become owned tasks with dates.
Affirm
A current record behind the senior official's affirmation in SPRS.
Levels
CMMC Levels 1, 2 and 3, side by side
During the review, solicitations may name only the two self-assessment columns.
Swipe to see every column
| Level 1 (Self) | Level 2 (Self) | Level 2 (C3PAO) | Level 3 (DIBCAC) | |
|---|---|---|---|---|
| Requirements | 15, from FAR 52.204-21 | 110, from NIST SP 800-171 Rev. 2 | 110, from NIST SP 800-171 Rev. 2 | 24 selected from NIST SP 800-172 (Feb 2021) |
| Assessed by | The contractor | The contractor | A C3PAO | DCMA DIBCAC |
| Frequency | Every year | Every 3 years | Every 3 years | Every 3 years |
| Prerequisite | None | None | None | Final Level 2 (C3PAO) status |
| POA&M | Not permitted | Allowed within limits | Allowed within limits | Allowed within limits |
| Affirmation | With each annual self-assessment | At assessment, then annually | At assessment, then annually | At assessment, then annually |
| Results go to | SPRS | SPRS | CMMC eMASS, then SPRS | CMMC eMASS, then SPRS |
Sources: DoW CIO, About CMMC, 32 CFR 170.14, 32 CFR 170.17, 32 CFR 170.18, 32 CFR 170.21. Sources checked Oct 23, 2026. Not a substitute for the official text.
POA&M and SPRS
The POA&M limits and where results go
170.21MUST
The 80 percent floor
Your score divided by the total requirements must be at least 0.8 to reach Conditional status.
170.21MUST
1-point items only
Only 1-point requirements may go on a Level 2 POA&M, with a narrow exception for non-FIPS-validated encryption (SC.L2-3.13.11).
170.21MUST
Never on a POA&M
Requirements such as the system security plan (CA.L2-3.12.4) and AC.L2-3.1.20 can never be deferred.
170.21MUST
180-day closeout
A POA&M closeout assessment must confirm closure within 180 days of the Conditional status date.
170.16MUST
Conditional expires
If the POA&M is not closed in time, the Conditional status expires.
170.22MUST
Affirm in SPRS
A senior Affirming Official enters affirmations electronically in SPRS.
Sources: 32 CFR 170.21, 32 CFR 170.16, 32 CFR 170.22. Sources checked Oct 23, 2026. Not a substitute for the official text.
DFARS 7012
What DFARS 252.204-7012 still requires
(c)MUST
72-hour reporting
Rapidly report cyber incidents to DoD within 72 hours of discovery, through DIBNet.
(c)MUST
Medium assurance certificate
You need a DoD-approved medium assurance certificate to report.
(e)MUST
Keep the images
Preserve images of affected systems and relevant monitoring data for at least 90 days from the report.
(b)(2)(ii)(D)MUST
Cloud equivalency
External cloud services that hold covered defense information must meet requirements equivalent to the FedRAMP Moderate baseline and comply with paragraphs (c) through (g).
DEC 2023 MEMOGUIDANCE
What equivalency means
The Department's December 2023 memo defines FedRAMP Moderate equivalency. The DoW CMMC FAQ still points to it.
SP 800-171MUST
Safeguarding
Covered contractor information systems implement NIST SP 800-171, which the Department reads as Rev. 2 today.
Sources: DFARS 252.204-7012, DoW CMMC FAQ, DoW CIO, About CMMC. Sources checked Oct 23, 2026. Not a substitute for the official text.
Go deeper
CMMC guides
CMMC Compliance Hub
Levels, scoping and the program rules in one place.
Read the guide →NIST SP 800-171 Compliance Guide
The 110 requirements behind CMMC Level 2.
Read the guide →CMMC Level 2 POA&M Template
A POA&M template with SPRS scoring.
Read the guide →NIST SP 800-172 and CMMC Level 3
The 24 enhanced requirements behind Level 3.
Read the guide →Questions
Common questions
Can a solicitation require a C3PAO assessment right now?
Not for new requirements. Under the DoW CIO memo implementing the July 13, 2026 suspension, requirements may designate only CMMC Level 1 (Self) or Level 2 (Self). Active solicitations that include Level 2 (C3PAO) or Level 3 (DIBCAC) are amended to remove them, and existing contracts keep those terms until they are modified. The Department may also conduct select Government-led assessments. Further guidance will follow the CIO's review.
Does the self-assessment still matter while Phase 2 is paused?
Yes. Level 2 (Self) results and the senior official's affirmation go into SPRS, and DFARS 252.204-7012 still requires NIST SP 800-171 on covered contractor systems.
Which revision of NIST SP 800-171 applies?
CMMC Level 2 is defined by the 110 requirements of SP 800-171 Rev. 2. NIST published Rev. 3 on May 14, 2024, and a rule to move CMMC to Rev. 3 is on the regulatory agenda but has not been published.
Why does this site say Department of War?
Executive Order 14347 of September 5, 2025 authorized Department of War as a secondary name. Statutes and regulations, including 32 CFR Part 170 and DFARS, still use Department of Defense.
Book a demo
Know your CMMC position
We will map your SSP and evidence to the level your contracts name.