CMMC

Only when it meets the clause's cloud requirement and sits inside your security boundary. DFARS 252.204-7012 requires cloud services that store, process or transmit covered defense information to meet security equivalent to the FedRAMP Moderate baseline. The tool also has to be covered by your system security plan and the NIST SP 800-171 controls that apply to the rest of the system.

Yes, where they affect the boundary. Requirement 3.12.4 calls for a system security plan describing the system boundary and how each requirement is met. AI tools approved for CUI belong inside it, and tools barred from CUI should be noted along with the controls that keep CUI out, such as web filtering and data loss prevention rules.

Yes, if the cloud service meets the FedRAMP Moderate baseline or FedRAMP Moderate equivalency. DFARS 252.204-7012(b)(2)(ii)(D) sets that bar for any external cloud service that stores, processes or transmits covered defense information, and the provider must also support the clause's incident reporting, media preservation and forensic access requirements.

Only in an edition that meets the DFARS 252.204-7012 cloud requirement. Any cloud service that stores, processes or transmits covered defense information must meet security equivalent to the FedRAMP Moderate baseline. Check the FedRAMP Marketplace listing for the exact service and edition, and record the decision in your system security plan before allowing CUI in it.

Under 32 CFR 170.22, the affirmation comes from a senior level representative of the contractor who is responsible for ensuring compliance with CMMC requirements and has the authority to affirm it. The official's name, title and contact information are entered in SPRS, and the affirmation states the firm has implemented and will maintain the applicable security requirements.

Three, drawn from NIST SP 800-171A: examine, interview and test. Examining means reviewing documents, configurations and diagrams. Interviewing means talking with staff about how controls work. Testing means exercising mechanisms or activities to compare actual with expected behavior. DoD's Level 2 Assessment Guide expects most assessment objectives to require testing, so documentation alone is rarely enough.

Yes. The July 2026 suspension stopped DoD from designating Level 2 (C3PAO) assessments in solicitations during the program review, but the Cyber AB stated that C3PAO Level 2 certification assessments remain available. Whether to pursue one voluntarily is a business decision, often driven by what primes ask of their subcontractors.

Under 32 CFR 170.17, a new Level 2 certification assessment is required within three years, and an affirming official must affirm continuing compliance at each assessment and annually thereafter. A Conditional status based on a POA&M expires unless open items are closed out by a C3PAO within 180 days of the CMMC Status Date.

Not for commercially available off-the-shelf (COTS) items. DFARS 252.204-7021(f)(1) requires the prime to insert the substance of the clause in subcontracts that will involve processing, storing or transmitting FCI or CUI, including subcontracts for commercial products and services, but it excludes COTS items. A subcontract limited to COTS items does not carry the clause.

Yes. The implementing memo for the Phase 2 suspension states that the cybersecurity requirements of DFARS 252.204-7012 remain in effect. That includes protecting covered defense information under NIST SP 800-171 and reporting cyber incidents to DoD within 72 hours of discovery.

No. There is no third-party certificate at Level 1. Under 32 CFR 170.15, a contractor reaches Level 1 (Self) status by assessing itself against the 15 FAR 52.204-21 requirements, entering the results in SPRS and submitting an affirmation from a senior official. A "Level 1 certificate" sold by a vendor is not a DoD credential.

Every year. 32 CFR 170.15 requires a Level 1 self-assessment on an annual basis to keep the status, and 32 CFR 170.22 requires the affirming official to submit an affirmation in SPRS at the completion of each Level 1 self-assessment and annually thereafter. Level 2 self-assessments, by contrast, run on a three-year cycle with annual affirmations.

No. Under 32 CFR 170.15, a Final Level 1 (Self) status requires a MET result on every one of the 15 FAR 52.204-21 safeguarding requirements, and the rule states that no POA&Ms are permitted for Level 1. Any gap has to be closed before the self-assessment is entered in SPRS and affirmed.

Level 1 protects Federal contract information with the 15 FAR 52.204-21 requirements, is self-assessed every year and allows no POA&M. Level 2 protects controlled unclassified information with the 110 requirements of NIST SP 800-171 Rev 2, runs on a three-year cycle as a self-assessment or C3PAO assessment, and allows certain gaps on a POA&M closed within 180 days.

For Final Level 2 (C3PAO) status, every applicable requirement must be MET, which is a score of 110. Under 32 CFR 170.21, a score of at least 88 with the remaining gaps on a qualifying POA&M earns Conditional status, and a C3PAO must close out that POA&M within 180 days or the status expires. A lower score, or a NOT MET on one of the six non-deferrable requirements, yields no Level 2 (C3PAO) status from that assessment.

Yes, where a solicitation or contract calls for it. The Department of War said all Phase 1 self-assessment requirements remain in place. Under 32 CFR 170.16, a Level 2 self-assessment is repeated every three years with results in SPRS, and an affirming official must affirm compliance annually.

Sometimes. Under 32 CFR 170.17(c)(2), a NOT MET requirement can be re-evaluated during the assessment and for 10 business days after the active assessment period, but only if new evidence shows it is met, the change does not affect other requirements already scored MET, and the C3PAO has not yet delivered the findings report.

No. On July 13, 2026, the Department of War suspended CMMC Phase 2, which would have added Level 2 (C3PAO) certification as a condition of award starting November 10, 2026. Contracting officers were told to remove C3PAO and DIBCAC requirements from active solicitations and contracts. Further guidance is expected after the CIO's program review.

No. NIST SP 800-171 Rev 2 requirement 3.5.3, which CMMC Level 2 assesses, requires multifactor authentication for privileged accounts and for network access to all accounts, without naming a method. Requirement 3.5.4 adds replay resistance. Phishing-resistant methods such as FIDO2 keys, Windows Hello for Business, and smart cards meet the requirement and reduce the risk of credentials being relayed through a fake login page.

It depends on the original assessment. Under 32 CFR 170.21(b), the contractor performs its own closeout for Level 2 (Self), using the same method as the initial self-assessment. An authorized or accredited C3PAO performs it for Level 2 (C3PAO), and DCMA DIBCAC performs it for Level 3. The closeout covers only the requirements listed on the POA&M.

POA&M stands for plan of action and milestones. In CMMC, it lists each Level 2 security requirement still NOT MET after an assessment, with the tasks, resources and milestones to fix it. 32 CFR 170.21 limits which requirements it may include and requires a closeout assessment within 180 days.

The Conditional CMMC status expires. For Level 2 (Self), 32 CFR 170.16 says standard contractual remedies apply if this happens during a contract's period of performance, and the contractor cannot receive new awards requiring Level 2 (Self) or higher for the affected systems until it achieves a new status. The rule does not provide for an extension.

No. Under 32 CFR 170.24, a POA&M is not a substitute for a completed requirement, so an item on the POA&M is scored NOT MET until it is fixed and confirmed in a closeout assessment. The score with those items counted as NOT MET must still be at least 88 of 110 to qualify for Conditional Level 2 status.

Yes. DFARS 252.204-7021 requires the prime, before awarding a subcontract, to ensure the subcontractor has a current CMMC certificate or status at the level appropriate for the information flowed down. The prime must also ensure the subcontractor's affirming official completes an affirmation before award and maintains it annually. The clause does not prescribe how proof is collected.

Under 32 CFR 170.23, a subcontractor that handles only Federal Contract Information needs Level 1 (Self). One that handles CUI needs at least Level 2 (Self), or Level 2 (C3PAO) when the prime's contract requires a C3PAO or DIBCAC assessment. With CMMC Phase 2 suspended, C3PAO requirements are being removed from contracts, so most flowdowns are Level 1 or Level 2 (Self).

It may be a reportable cyber incident. DFARS 252.204-7012 defines compromise to include unintentional disclosure to unauthorized persons and requires reporting to DoD at dibnet.dod.mil within 72 hours of discovery, using a medium assurance certificate. Whether a specific upload meets the threshold is a judgment for the firm and its counsel, so start the assessment as soon as it is discovered.

Firms handling Controlled Unclassified Information under DFARS 7012 must meet NIST SP 800-171, and requirement 3.1.22 requires them to control CUI posted or processed on publicly accessible systems. A public AI service is a publicly accessible system, so CUI, including technical drawings, should stay out of public AI tools. Check your contract for any approved environments.

At least 90 days. Paragraph (e) of DFARS 252.204-7012 requires contractors to preserve and protect images of all known affected information systems and relevant monitoring or packet capture data for at least 90 days from submitting the cyber incident report, so DoD can request them for forensic analysis. For an AI spill, that can include the user's workstation and AI account records.

It is a DoD-approved digital certificate a contractor needs to submit a cyber incident report under DFARS 252.204-7012. Paragraph (c)(3) of the clause requires contractors to have or acquire one. DoD's Cyber Crime Center says a firm without one should contact its DCISE team by email or at (410) 981-0104. Obtain the certificate before an incident, since the report is due within 72 hours of discovery.

Under DFARS 252.204-7019 and 252.204-7020, a NIST SP 800-171 DoD Assessment is current if it is not more than three years old, unless a solicitation sets a shorter period. Separately, CMMC Level 2 (Self) requires a new self-assessment every three years under 32 CFR 170.16, with an affirmation entered in SPRS at each assessment and annually in between.

Under 32 CFR 170.21, only requirements worth 1 point may be on a POA&M, plus 3.13.11 when encryption is used but not FIPS-validated. The score must be at least 88 of 110. Six requirements, including the system security plan (3.12.4) and three physical access controls, can never be deferred. Open items must be closed within 180 days.

No date has been set. DoD says it will adopt Revision 3 through future rulemaking that amends the CMMC rule at 32 CFR Part 170. A planned interim final rule (RIN 0790-AM01) was listed for July 2026 but had not been published as of mid-October 2026. Until then, DFARS 252.204-7012 and CMMC assessments use Revision 2.

Yes, according to DoD's CMMC FAQs, but with conditions. A company may implement Revision 3 using the Department's organization-defined parameters, yet assessments are still conducted against Revision 2, so any gap between the two revisions has to be closed. Your SPRS score and any CMMC assessment still measure Revision 2.

Requirement 3.12.4 says periodically and does not set a frequency, so define one in the plan and follow it. Many firms review annually and after significant changes, such as a new cloud service, office or IT provider. CMMC requires an annual affirmation of continuing compliance under 32 CFR 170.22, which is hard to support with a stale SSP.

It is a value left blank inside a Rev 3 requirement, shown as [Assignment: ...] or [Selection: ...], such as the number of failed logons before lockout. NIST does not set the values. A federal agency may, and otherwise the contractor must. DoD published its values in an April 2025 memorandum and says companies implementing Rev 3 must use them.

Yes, when they use the FIDO2 standard. A passkey is bound to the real website or app, so a fake login page cannot capture and replay it. Some passkeys stay on one device and others sync through a cloud account. NIST SP 800-63B-4 does not allow syncable authenticators at its highest assurance level, AAL3, so device-bound keys are the safer choice for administrator accounts.

No. NIST SP 800-63B-4, finalized in July 2025, does not treat one-time passcodes or out-of-band methods that rely on entering or relaying a code as phishing-resistant. Microsoft's built-in phishing-resistant authentication strength in Entra ID includes Windows Hello for Business, FIDO2 security keys and passkeys, and multifactor certificate-based authentication, and leaves app push sign-in out.

A NIST SP 800-171 score runs from 110 down to -203. Each of the 110 Revision 2 requirements carries a value of 1, 3, or 5 points, and the value of each requirement not met is subtracted from 110. Multifactor authentication and CUI encryption can earn partial credit. The summary score is posted in the Supplier Performance Risk System (SPRS).

It can be. Table 3 of 32 CFR 170.19(c)(1) treats an endpoint hosting a VDI client as an Out-of-Scope Asset when it is configured so that nothing beyond keyboard, video and mouse reaches it. If users can download, print, copy or map drives to CUI, the laptop can process or store CUI and stays in scope. The configuration needs to be tested and documented.

A C3PAO is a CMMC Third-Party Assessment Organization: a company authorized by the Cyber AB to conduct CMMC Level 2 certification assessments. Its assessors evaluate a contractor against the 110 requirements in NIST SP 800-171 Rev 2 and submit the results through eMASS to SPRS, where they set the contractor's Level 2 (C3PAO) status.

It is the document required by requirement 3.12.4 of NIST SP 800-171 Rev 2. It describes the system boundary, the environment of operation, how each security requirement is implemented, and connections to other systems. Under 32 CFR 170.24, a CMMC assessment cannot be completed without an up-to-date SSP, so it is the first thing an assessor reviews.

Only AI services that meet FedRAMP Moderate or a verified equivalent and sit inside the environment your system security plan covers. DFARS 252.204-7012 applies that bar to any cloud service that stores, processes or transmits covered defense information, and a December 2023 DoD memo defines equivalency as 100 percent of the Moderate baseline validated by a FedRAMP-recognized assessor.

The contractor, and everyone at the firm who handles the information. DFARS 252.204-7012 requires the contractor to provide adequate security for covered defense information on its systems and to flow the clause down to subcontractors whose work involves it. NIST SP 800-171 requirement 3.2.1 also requires that users be made aware of the security risks of their activities.

Yes. A platform that brokers and controls access to CUI provides security functions to the assessment scope, which makes it a Security Protection Asset under 32 CFR 170.19. The DoD Level 2 scoping guide says these assets are assessed against the requirements relevant to the capabilities they provide, such as access control, authentication and audit logging. Zero trust can shrink endpoint scope, while the security stack itself stays in scope.