What is CMMC Phase 2 and when does it apply to a defense contractor?

CMMC Phase 2 is the second phase of the Cybersecurity Maturity Model Certification (CMMC) 2.0 phased rollout formalized in 32 CFR Part 170 (effective October 15, 2024). The CMMC 2.0 model itself organizes DoD contractor cybersecurity obligations under three Maturity Levels: Level 1 (Foundational) for Federal Contract Information (FCI) under FAR 52.204-21, Level 2 (Advanced) for Controlled Unclassified Information (CUI) under NIST SP 800-171 Rev 2, and Level 3 (Expert) for select DoD priority programs adding NIST SP 800-172. Defense contractors see which Maturity Level applies by reading the CMMC requirement line on each DoD solicitation: a Level 1 requirement line means the contract involves only FCI; a Level 2 requirement line means the contract involves CUI; a Level 3 requirement line means it is on the DIB-priority list. ComplianceStack's free CMMC Phase 2 readiness analyzer at /free-cmmc-readiness-analyzer helps a contractor identify which Maturity Level applies to their portfolio and what deadlines the relevant clause sets apply.

How does the 32 CFR Part 170 phased rollout affect my CMMC Phase 2 readiness deadline?

32 CFR Part 170, effective October 15, 2024, defines the three CMMC 2.0 Maturity Levels, the assessment types (Self, Self-Assessed, C3PAO, DIBCAC), and the phased rollout window in which CMMC requirements begin appearing in DoD solicitations. The rule itself does not state a single calendar deadline a contractor can put on a wall — instead, it shifts the contract-award eligibility check so that a DoD solicitation with a CMMC requirement line controls when the applicable Level must be met for that specific award. DFARS 252.204-7012 (DFARS 7012) operates in parallel, requiring every contractor handling Covered Defense Information to implement NIST SP 800-171, post a NIST 800-171 DoD Assessment score to SPRS, and report cyber incidents through DIBNet within 72 hours. ComplianceStack notes that a contractor with an overdue SPRS posting can be removed from source selection regardless of the CMMC status of the solicitation.

Does DFARS 7012 require a separate deadline for SPRS posting?

DFARS 252.204-7012(b) requires the contractor to post a NIST SP 800-171 DoD Assessment score to the Supplier Performance Risk System (SPRS) at https://www.sprs.pm.dod.mil/ before contract award and to refresh the posting at least every 12 months. An outdated SPRS score does not satisfy DFARS 7012(b): the assessment must reflect the contractor's current implementation of NIST SP 800-171 controls. ComplianceStack tracks the SPRS scoring on a -203 to +110 scale per the NIST SP 800-171 DoD Assessment Methodology, with the lowest single-control score governing the consolidated SPRS posting. Contractors that let their SPRS posting lapse should treat that expiration as the controlling deadline — it is independently enforceable of the CMMC solicitation-level timeline.

What is the difference between Self-assessment, C3PAO, and DIBCAC under CMMC Phase 2?

Under CMMC 2.0 (32 CFR Part 170) there are four assessment paths. (1) Level 1 Self-assessment: annual self-assessment against the 17 FAR 52.204-21 practices with affirmation of compliance in SPRS. (2) Level 2 Self-assessment: a triennial self-assessment scoring all 110 NIST SP 800-171 Rev 2 controls using the NIST SP 800-171 DoD Assessment Methodology, with results posted to SPRS — used for select DoD programs whose solicitation carries a CMMC L2 Self requirement line. (3) Level 2 C3PAO third-party assessment: a Cyber AB-accredited C3PAO (https://cyberab.org/) audits the contractor against all 110 NIST SP 800-171 Rev 2 controls and issues a Conditional or Final CMMC Level 2 designation. (4) Level 3 DIBCAC assessment: government-led assessment by the Defense Industrial Base Cybersecurity Assessment Center, scheduled only after a current CMMC Level 2 Final is in place, adding selected NIST SP 800-172 enhanced-security requirements. ComplianceStack's free CMMC Phase 2 readiness analyzer tags each contract role with the assessment path the contractor is most likely to face so the readiness score reflects the contractor's actual situation.

What sources does the ComplianceStack CMMC Phase 2 analyzer cite for scoring and deadlines?

ComplianceStack's free CMMC Phase 2 readiness analyzer cites only verified official sources. Scoring inputs map to: 32 CFR Part 170 (effective October 15, 2024) at https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-170; NIST SP 800-171 Rev 2 at https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final; the NIST SP 800-171 DoD Assessment Methodology on the DoD CMMC website; NIST SP 800-172 (Enhanced Security Requirements) at https://csrc.nist.gov/pubs/sp/800/172/final; DFARS 252.204-7012 at https://www.acq.osd.mil/cpc/cpc/dfars/dfars-252.204-7012.pdf; FAR 52.204-21 at https://www.acq.osd.mil/cmmc/Resources/FAR-52.204-21.pdf; the SPRS portal at https://www.sprs.pm.dod.mil/; the Cyber AB at https://cyberab.org/; and 31 USC §3729 (False Claims Act) liability for failure to flow-down DFARS 7012 at https://www.govinfo.gov/app/details/USCODE-2018-title31/USCODE-2018-title31-subtitleIII-chap37-subchapIII-sec3729. ComplianceStack does not invent deadlines absent from these sources; the free analyzer outputs a deadline band keyed to your assigned Maturity Level and the controlling clause (FAR 52.204-21 annual for Level 1, the 32 CFR Part 170 phased rollout + triennial self-assessment cadence for Level 2, the post-Level-2-Final DIBCAC path for Level 3).

Free CMMC Phase 2 Readiness Analyzer — DoD Contractor Deadline Tool (2026)

CMMC Phase 2 puts CMMC Level 2 on the contract award line. The CMMC 2.0 phased rollout (32 CFR Part 170, effective October 15, 2024) means CMMC requirements now appear in DoD solicitations on a predictable cadence. Pair that with DFARS 252.204-7012's annual SPRS posting window, and a defense contractor's "applicable deadline" is whatever current solicitation they are bidding on. This tool scores your readiness and shows you what your deadline band looks like today.

CMMC Phase 2 Readiness Questionnaire

Each option is mapped to a primary regulatory source so your score is grounded in the actual controlling clause.

8 questions · DIB role → information scope → NIST 800-171 → SPRS → MFA → incident response → DFARS flow-down → target CMMC Level

1. What is your role in the Defense Industrial Base?

Cited: 32 CFR Part 170 · DFARS 252.204-7012 flow-down

2. What information does your organization handle under DoD contracts?

Cited: 32 CFR Part 170 Maturity Level criteria · FAR 52.204-21

3. Have you completed a NIST SP 800-171 DoD Assessment?

Cited: NIST SP 800-171 Rev 2 DoD Assessment Methodology

4. Is your NIST 800-171 assessment score currently posted in SPRS?

Cited: DFARS 252.204-7012(b) · SPRS portal

5. What authentication do you enforce on systems handling CUI?

Cited: NIST SP 800-171 Rev 2 IA.L2-3.5.3

6. Do you have a DFARS-aligned incident response plan with 72-hour DIBNet reporting?

Cited: DFARS 7012(c) · NIST SP 800-171 IR.L2-3.6.2

7. Do all CUI-handling subcontractors receive a DFARS 7012 flow-down clause?

Cited: DFARS 252.204-7012 · 31 USC §3729 (False Claims Act)

8. What is your target CMMC Maturity Level?

Cited: 32 CFR Part 170 assessment ladder

Instant results in-browser. No data transmitted unless you email your score.

Your CMMC Phase 2 Readiness Snapshot

Directional — not a substitute for a C3PAO assessment or a DFARS 7012 compliance review.

Gap Score — Lower Is Better

—

Applicable CMMC Phase 2 Deadline — Cited

Each row's citation chip links to the verified official source. Your applicable deadline band is the row(s) matching the Maturity Level your contract or Q8 target assigned.

Contract Implications Under CMMC Phase 2

Phase 2 makes CMMC a DoD solicitation requirement. 32 CFR Part 170 shifts the contract-award eligibility check so a DoD solicitation with a CMMC requirement line controls when the applicable Level must be met for that specific award.
An outdated SPRS posting can forfeit award. DFARS 252.204-7012(b) requires the NIST 800-171 DoD Assessment score to be posted to SPRS and refreshed at least every 12 months.
Failure to flow down DFARS 7012 creates False Claims Act exposure. 31 USC §3729 liability attaches when a contractor misrepresents CMMC compliance or fails to flow the clause down — a commonly cited DCAA violation pattern.
Level 3 is government-led. The Level 3 assessment is conducted by the Defense Industrial Base Cybersecurity Assessment Center only after a current CMMC Level 2 Final designation is in place.

Share Your Readiness Snapshot

Email My Deadline + Score

We'll send your applicable Phase 2 deadline band + cited readiness snapshot so you can forward it to your DoD contracting officer.

✨ Available Now

CMMC Evidence-Ready Readiness Pack — $199

Convert this Phase 2 readiness snapshot into a C3PAO-ready remediation backlog. The $199 Evidence-Ready Readiness Pack ships a step-by-step remediation plan mapped to all 110 NIST SP 800-171 Rev 2 controls, a NIST 800-171 + DFARS 7012 evidence checklist, and an exportable HTML + PDF report — delivered by email in under 30 minutes.

Get The Evidence-Ready Readiness Pack — $199 →

Stripe-secured checkout · 30-minute delivery · No account required.

Sources used by this analyzer (verified): 32 CFR Part 170 (effective October 15, 2024) · NIST SP 800-171 Rev 2 · NIST SP 800-172 · DFARS 252.204-7012 · FAR 52.204-21 · SPRS · Cyber AB · 31 USC §3729.

Free CMMC Phase 2 Readiness AnalyzerDoD Contractor Deadline Tool