What are the CMMC Level 2 requirements in 2026?

They are the 110 requirements of the CMMC Level 2 model, mapped to NIST SP 800-171 Rev. 2. Your score starts at 110 and loses 1, 3 or 5 points for each requirement you miss. You need at least 88. Conditional status lasts 180 days while you close the rest and update SPRS.

Were CMMC Level 2 requirements cancelled in July 2026?

No. The 13 July 2026 Department of War action suspended the Phase 2 start date of 10 November 2026 and put Phases 3 and 4 on hold. The requirements themselves did not move. 32 CFR part 170, NIST SP 800-171 Rev. 2, DFARS 252.204-7012, self-assessments and annual affirmations in SPRS all stayed in force.

Do I still need a C3PAO assessment for CMMC Level 2?

Not as a Department of War contract requirement during the review. A requiring activity may only designate Level 1 Self or Level 2 Self, and third-party or Level 3 requirements must be removed from active solicitations and existing contracts. Certifications you already hold stay valid for three years.

What score do I need to pass CMMC Level 2?

You need at least 88 out of 110, which is 80 percent. Your score starts at 110 and drops by 1, 3 or 5 points for each requirement you miss. So you can lose 22 points at most. Requirements worth more than 1 point cannot go on a POA&M, apart from one encryption item, so treat those as must-meet.

Does CMMC apply if I only handle FCI and never touch CUI?

FAR 52.204-21 applies to you either way, with 15 minimum safeguarding controls and subcontract flow-down. The full CMMC clause stays at the program office's discretion until Phase 4 on 11 November 2028. From that date it applies wherever contractor systems handle FCI or CUI, excluding awards solely for off-the-shelf items.

Is NIST SP 800-171 Rev. 3 now the standard for CMMC?

Not yet. Rev. 3 has been final since May 2024, with 97 requirements instead of Rev. 2's 110 and three new control families for supply chain risk, planning and acquisition. As of August 2026 most defense contracts still referenced Rev. 2 through DFARS 252.204-7012. Assess against Rev. 2 and treat Rev. 3 as a forward plan.

CMMC Level 2 Requirements - What Still Binds You

Which CMMC Level 2 requirements still bind you after the July 2026 suspension?

On 13 July 2026 the Department of War suspended the Phase 2 transition set for 10 November 2026. The same action put Phases 3 and 4 on hold for a 60-day review. It stopped the way you prove compliance, not the controls. The CMMC Level 2 requirements did not move.

These parts stayed in force through the pause:

32 CFR part 170 - the rule that created CMMC 2.0.

NIST SP 800-171 Rev. 2 - the National Institute of Standards and Technology controls.

DFARS 252.204-7012 - the clause that requires covered systems to meet those controls.

SPRS filings - self-assessments and annual affirmations.

The part that changed is the assessment method. A requiring activity may now designate only Level 1 Self or Level 2 Self. Any third-party or Level 3 requirement must come out of contracts. No waivers are granted.

Your rule set depends on the data your systems hold. Some suppliers touch only federal contract information, called FCI. If your systems never hold controlled unclassified information, called CUI, then FAR 52.204-21 carries the load. FAR is part of the Federal Acquisition Regulation. Once CUI sits in your systems, DFARS 252.204-7012 comes with it, along with 32 CFR part 170. DFARS is part of the Defense Federal Acquisition Regulation Supplement.

How is the 88-point score worked out?

CMMC Level 2 scoring runs downward. You start at 110, one point for each of the 110 requirements. Each requirement you miss takes points off. Under 32 CFR 170.24, the loss is 1, 3 or 5 points. You need at least 88, which is 80 percent of 110.

That gives you a budget. You can lose at most 22 points and still reach 88. A requirement worth 3 or 5 points burns that budget fast. So 32 CFR 170.21 bars every requirement worth more than 1 point from a POA&M. A POA&M is a plan of action and milestones. One exception exists. SC.L2-3.13.11, the encryption requirement, may go on a POA&M when the encryption is not FIPS-validated.

Six one-point requirements are also barred from a POA&M. They are AC.L2-3.1.20 (external connections), AC.L2-3.1.22 (public information) and CA.L2-3.12.4 (system security plan). The other three are PE.L2-3.10.3 (escort visitors), PE.L2-3.10.4 (physical access logs) and PE.L2-3.10.5 (manage physical access). The other one-point requirements can stay open, as long as your total stays at 88 or higher.

Scoring step	Number	What it means
Starting score	110	One point for each requirement
Pass line	88	80 percent of 110, so you can lose at most 22 points
Loss per unmet requirement	1, 3 or 5	Set by the requirement
Can go on a POA&M	Most 1-point items and SC.L2-3.13.11 without FIPS-validated encryption	Can stay open on conditional status
Never on a POA&M	Every other item worth more than 1 point, plus the six named above	Must be met before you claim status
Conditional status window	180 days	Close the POA&M and update SPRS inside the window

The July 2026 memorandum gave three reasons. Compliance costs were prohibitive. Third-party assessors were in short supply. Regulatory timelines were complex. The Department of War said these pressures were driving small businesses out of its contracts.

A reform task force convened in early September 2026. It read more than 1,100 responses to a request for information. Its report was due to the Department of War Chief Information Officer on 11 September 2026.

The size of the program matters for planning. The regulatory impact estimate counts 1,104 contracts in year one, 5,565 in year two and 18,554 in year three. The numbers come from the Federal Register final rule of 10 September 2025. That rule reaches 337,968 entities, and 229,818 of them, 68 percent, are small entities.

Step	Original window	What it was meant to do	Status
32 CFR part 170 - CMMC 2.0 programmatic rule	Effective 16 December 2024	Create the CMMC 2.0 program	In force
Phase 1	10 Nov 2025 - 9 Nov 2026	DoW decides on CMMC in a solicitation	Window ended 9 Nov 2026; self-assessments still required
Phase 2	10 Nov 2026 - 9 Nov 2027	Third-party C3PAO Level 2 assessment for CUI awards	Suspended 13 July 2026; no restart date announced
Phase 3	10 Nov 2027 - 10 Nov 2028	Window set by the final rule	Suspended
Phase 4	From 11 November 2028	CMMC required wherever contractor systems handle FCI or CUI	Suspended

Two points follow. The Phase 1 window ended on 9 November 2026. But the Department of War program office or requiring activity still decides. It decides whether to insert a CMMC requirement into a solicitation. Phase 4 was set for 11 November 2028 and is now suspended.

Which contract clauses keep the requirements alive during the pause?

FAR 52.204-21 applies to every contractor whose systems process, store or transmit FCI. It sets 15 minimum safeguarding controls.

The controls cover access, user and device identity, safe media disposal, physical access, communications and malicious code protection. The full set of 15 is in FAR 52.204-21 on acquisition.gov.

DFARS 252.204-7012 stays the standard for CUI work and still points to NIST SP 800-171 Rev. 2. DFARS 252.204-7021 is what puts a CMMC level into a Department of War contract. Its title is Contractor Compliance with the CMMC Level Requirements. Read DFARS 252.204-7021 on acquisition.gov.

The contracting officer picks one of four designations. They are Level 1 Self, Level 2 Self, Level 2 C3PAO and Level 3 DIBCAC. The rule took effect on 10 November 2025.

Designation	Who performs it	Status length	Allowed now?
CMMC Level 1 (Self)	Self-assessment filed in SPRS	Final status 1 year	Yes
CMMC Level 2 (Self)	Self-assessment filed in SPRS	Final status 3 years; conditional status 180 days	Yes - the only Level 2 designation allowed now
CMMC Level 2 (C3PAO)	Approved third-party organization	Final status 3 years	No - removed during the review
CMMC Level 3 (DIBCAC)	Defense Industrial Base Assessment Center	Final status 3 years	No - suspended with Phases 3 and 4

Read CMMC Level 2 cost before you set aside money for tools and outside help.

Is NIST SP 800-171 Rev. 3 replacing Rev. 2 for CMMC yet?

Not yet. The CMMC Level 2 requirements in your contracts still map to Rev. 2. Rev. 3 has been final since May 2024, but most defense contracts still referenced Rev. 2 as of August 2026. Assess against Rev. 2 now and treat Rev. 3 as a forward plan.

Measure	Rev. 2	Rev. 3
Publication status	January 2021, now superseded	May 2024
Requirements in the model	110	97
New control families	Not applicable	Adds Supply Chain Risk Management, Planning, and System and Services Acquisition
Assessment procedures (one estimate)	About 320 determination statements	More than 400
Control families covered	14	17

The final NIST publication lists every change.

Compare CMMC with the cybersecurity compliance frameworks guide. If you also use the NIST Cybersecurity Framework, see NIST CSF implementation cost for enterprise 2026.

What should you do in the next 90 days?

Keep your SPRS record current. File the self-assessment and the senior-official affirmation on time.
Check every contract and solicitation for a designation. A third-party designation should come out during the review, so ask your contracting officer to confirm it.
Plan against Rev. 2 for assessments and Rev. 3 for roadmaps.
Watch for a new schedule. As of 19 October 2026 no new Phase 2 date had been announced.

In short, the July 2026 action changed the assessment method, not the CMMC Level 2 requirements. The 88-point line means you can lose at most 22 points. Requirements worth more than 1 point cannot go on a POA&M, apart from one encryption item. Self-assessments, SPRS affirmations, FAR 52.204-21 and DFARS 252.204-7012 all still apply to you. A senior-official affirmation must be no older than 1 year.

Photo: BRRT, Pixabay Content License, via Pixabay (https://pixabay.com/photos/clipboard-clip-business-document-2693418/)

CMMC Level 2 Requirements - What Still Binds You?

Which CMMC Level 2 requirements still bind you after the July 2026 suspension?

Related Articles

CMMC Level 1 Requirements - Do You Need Level 2

FedRAMP Compliance Requirements - What Changed in 2026?

HIPAA Compliance Requirements - What Changed in 2026

PCI DSS Requirements in 2026 - What Applies to You

GDPR Compliance Requirements - What Changed in 2026

Try It in the Browser

How is the 88-point score worked out?

What was Phase 2 supposed to add, and what is frozen until it restarts?

Which contract clauses keep the requirements alive during the pause?

Is NIST SP 800-171 Rev. 3 replacing Rev. 2 for CMMC yet?

What should you do in the next 90 days?

SOC 2 Type 1 vs Type 2 - Which Report Do You Need?