CMMC Compliance Software

CMMC (Cybersecurity Maturity Model Certification) is the Department of War program that sets cybersecurity requirements for defense contractors and their subcontractors. Today it runs in Phase 1 only. The Department suspended Phase II, which was due to start November 10, 2026, in an announcement on July 13, 2026, and it has not set a new date. Phase 1 self-assessment requirements, in force since November 10, 2025, remain the active standard. DFARS 252.204-7012 still governs how covered defense information gets safeguarded and reported. For a contractor today, the job is a self-assessment that holds up and a current score in the Supplier Performance Risk System (SPRS).

Who CMMC covers

CMMC protects two categories of information. Federal Contract Information (FCI) is the baseline data a contractor generates or receives under a government contract, excluding anything already public or purely transactional. Controlled Unclassified Information (CUI) is the more sensitive category that a law, regulation or government-wide policy requires an agency to protect.

The requirement flows down the supply chain. A subcontractor handling FCI or CUI on a prime’s behalf needs its own CMMC status before the prime can award it work. A prime handling only FCI needs at minimum a Level 1 self-assessment of its own.

The three levels

Level 1 covers basic safeguarding of FCI: an annual self-assessment and affirmation against a requirement count the Department of War puts at 15, drawn from FAR 52.204-21.

Level 2 covers broader protection of CUI against the 110 requirements in NIST SP 800-171 Revision 2. It is assessed either by self-assessment every three years or by a CMMC Third-Party Assessment Organization (C3PAO), depending on what a given solicitation calls for.

Level 3 adds the enhanced requirements in NIST SP 800-172 on top of Level 2’s 110. Only the government, through DIBCAC, performs that assessment.

Scores, POA&Ms and affirmations

A Conditional CMMC status at Level 2 or Level 3 requires a minimum score of 80 percent of the maximum. Only the requirements the rule allows can land on a Plan of Action and Milestones (POA&M). Every item on that POA&M has to close within 180 days of the Conditional status, verified by a POA&M closeout assessment.

Level 1 permits no POA&M at all, so its 15 requirements have to be fully met from the start. A Final CMMC status holds for three years, counted from the original Conditional status date. Every contractor has to affirm compliance annually, or the status lapses.

The two rules

The CMMC Program rule at 32 CFR Part 170 took effect December 16, 2024. It sets the levels, the scoring and the POA&M mechanics. The DFARS acquisition rule carrying clause 252.204-7021 took effect November 10, 2025. That rule puts a CMMC status requirement into a solicitation, and its effective date started the Phase 1 clock.

Assessors and the Cyber AB

A C3PAO conducts the certified Level 2 assessment through the certified professionals and assessors it employs (CCPs and CCAs). Level 3 assessments stay with DIBCAC. ISACA now certifies and trains those assessors on the program’s behalf. The Cyber AB accredits the C3PAOs themselves and runs the Marketplace contractors use to find one. A Registered Practitioner Organization (RPO) gives advisory help getting ready for an assessment and cannot perform one.

What CMMC costs

The Department of War’s own regulatory impact analysis, published in the Federal Register alongside the CMMC Program rule, puts a dollar figure on the most common paths. Sellers quote a full first Level 2 cycle at $50,000 to $300,000 or more.

Assessment	Entity size	Assessment and affirmation	Annual reaffirmation
Level 1 self-assessment	Small	$5,977	$560
Level 1 self-assessment	Other than small	$4,042	$584
Level 2 self-assessment	Small	$34,277	$1,459
Level 2 self-assessment	Other than small	$43,403	$2,712
Level 2 C3PAO certification	Small	$101,752	$1,459
Level 2 C3PAO certification	Other than small	$112,345	$2,712

Which platforms cover CMMC

All seven platforms rated on The Audit Trail list CMMC in their framework coverage. Sprinto ranks first overall at 84, Vanta second at 82, Drata third at 76, Secureframe fourth at 75, Scrut fifth at 72, OneTrust sixth at 64, and Thoropass seventh at 52. The CMMC compliance software ranking scores what each one does for CMMC specifically.