How do I know if my organization needs CMMC Level 2 certification?

The short answer: start with the information your organization handles, then confirm what your contract with the Department of War, or prime contractor, requires.

The CMMC program is evolving, and the Department’s July 2026 review has left open the possibility of further changes. But the review does not erase the cybersecurity obligations already contained in defense contracts. If your organization handles information that must be protected, those safeguarding requirements still matter regardless of when a CMMC assessment is ultimately required.

Start with the data, not the certification level

CMMC levels are tied to the type of federal information an organization handles. Before asking which CMMC level applies, first determine what information the government or a prime contractor has entrusted to your organization.

Federal Contract Information (FCI). FCI is information provided by or generated for the federal government under a contract to develop or deliver a product or service that is not intended for public release. Organizations that handle FCI but do not handle CUI are generally associated with CMMC Level 1, which addresses 15 basic safeguarding requirements.

Controlled Unclassified Information (CUI). CUI is unclassified information that requires safeguarding or dissemination controls under applicable law, regulation, or government-wide policy. If your organization stores, processes, or transmits CUI, CMMC Level 2 may apply. Level 2 is based on the 110 security requirements in NIST SP 800-171.

Then read the contract

Your contract determines the requirements you are obligated to meet. Do not rely solely on assumptions about your size, your role in the supply chain, or whether information was visibly marked.

• DFARS 252.204-7012. Review whether this clause is included in the contract and whether covered defense information is involved.
• CMMC contract language. Look for language identifying the required CMMC level and the type of assessment required for the procurement.
• Flow-down requirements. If you are a subcontractor, review the requirements passed down by your prime contractor. Many subcontractors learn of their CMMC obligations through the prime rather than directly from the government.

Two assumptions that can create problems

“It was not marked CUI, so it cannot be CUI.” Do not rely on markings alone. If you receive technical drawings, specifications, engineering data, or other sensitive contract information and are uncertain about its status, confirm the designation with your contracting officer or prime contractor.

“We are too small or too far down the supply chain for CMMC to apply.” Company size does not determine whether information requires protection. A small subcontractor that receives CUI can still have safeguarding and assessment obligations because applicable requirements may flow down through the supply chain.

Level 2 does not always mean the same assessment

Organizations sometimes hear “Level 2” and assume that every Level 2 contractor must immediately undergo the same third-party certification assessment. That is not necessarily the case. Depending on the contract and the applicable CMMC requirement, Level 2 may involve a self-assessment or a certification assessment conducted by an authorized C3PAO.

That distinction matters. It affects the evidence you must prepare, the assessment process, scheduling, and cost. The appropriate assessment path should be determined from the applicable contractual requirement, not from an organization’s preference.

What the current CMMC review means for your organization

The Department paused part of the CMMC phased rollout in July 2026 while it reviews the program. That review may affect how future third-party assessment requirements are implemented. It does not, however, make existing contractual cybersecurity requirements disappear.

Your underlying security obligations still matter. If your contract requires you to safeguard CUI under NIST SP 800-171, delaying preparation because of the CMMC review can leave the organization exposed to compliance and contractual risk.

Your data and contract still determine your path. The first questions remain the same: Do you handle CUI? What clauses and flow-down requirements apply? What assessment requirement does the contract specify?

Readiness work is still valuable. Organizations that understand their scope, close security gaps, organize evidence, and maintain accurate documentation will be better positioned when an assessment is required.

A practical way to determine whether Level 2 applies

• Identify the federal information your organization receives, creates, stores, processes, or transmits.
• Determine whether any of that information is CUI.
• Review your prime contract, subcontract, purchase order, and applicable DFARS clauses.
• Confirm any flow-down requirements with your prime contractor.
• Determine whether the contract calls for a Level 2 self-assessment or a Level 2 certification assessment.
• If the information or contract language is unclear, obtain clarification before assuming the requirement does not apply.

Still not sure?

That is common. CMMC applicability can become confusing when contract clauses, flow-down requirements, and information markings do not tell a consistent story. A focused review of the information you handle and the language in your contract can usually clarify whether Level 2 applies and what type of assessment you should be preparing for.

Note: CMMC policy and implementation requirements can change. Organizations should confirm current requirements against their specific contract and the latest Department guidance.