CMMC and NIST 800-171
Level 1 and Level 2 self-assessment, SPRS, DFARS 7012
Explore CMMC →CMMC and DFARS 7012 evidence for defense contractors
Defense solicitations can require a CMMC status as a condition of award, and while the Department of War (DoD) reviews the program that status is Level 1 (Self) or Level 2 (Self). DFARS 252.204-7012 still applies to covered defense information. NISTcompliance.ai keeps your SSP, POA&M and evidence in one record you can affirm, and runs inside a FedRAMP Certified boundary.
Phase 2 paused: Level 1 (Self) and Level 2 (Self) onlyRuns inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
Your frameworks
What defense work requires
DoW Impact Levels
IL2 to IL6 and DISA Provisional Authorization
Explore Impact Levels →Your path
From first SSP to annual affirmation
Scope
Identify where Federal Contract Information and CUI live, and which level your contracts name.
Implement
Close gaps against NIST SP 800-171 Rev. 2, with evidence attached to each requirement.
Assess
Self-assess against every requirement, inside the POA&M limits, and stay ready for a Government-led assessment.
Affirm
Report to SPRS and affirm every year so your status never lapses.
Sources: DoW CIO memo implementing the Phase 2 suspension, 32 CFR Part 170, DoW CIO, About CMMC, DFARS 252.204-7012. Sources checked Oct 23, 2026. Not a substitute for the official text.
Go deeper
Related guides
CMMC Compliance Hub
Levels, scoping and the program rules in one place.
Read the guide →NIST SP 800-171 Compliance Guide
The 110 requirements behind CMMC Level 2.
Read the guide →Book a demo
Get CMMC ready
We will map your contracts, data and evidence to the level you need.