Last updated September 26, 2026.
Is CMMC Level 2 a third-party assessment right now?
No. As of September 26, 2026, CMMC Level 1 and Level 2 are both self-assessments, and contracting officers have been told to take third-party assessment requirements out of contracts.
On July 13, 2026, the Department of Defense, which now uses the title Department of War, suspended CMMC Phase II. Phase II would have required third-party (C3PAO) assessments for Level 2 from November 10, 2026. Phases 3 and 4 are on hold. Phase 1 stays in force (DoD CIO). On September 3, a class deviation told contracting officers to remove third-party assessment requirements from contracts (Nextgov). The CMMC Reform Task Force report went to the department's CIO on September 11 and isn't public yet (DefenseScoop). So more changes may follow.
What still applies to MSPs today?
- Level 1: a self-assessment and affirmation in SPRS every year.
- Level 2: a self-assessment against NIST SP 800-171 every three years, with a yearly affirmation.
- DFARS 252.204-7012: still applies, so you still have to safeguard covered defense information and report cyber incidents within 72 hours.
The pause changed who checks the work, not the work itself.
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is the US Department of Defense's program for checking that contractors handling government data have put adequate cybersecurity in place. The program rule was finalized in October 2024 (Federal Register), and DFARS 252.204-7021 puts CMMC levels into contracts.
CMMC has three levels:
- Level 1 (Foundational): 15 requirements from FAR 52.204-21. Protects Federal Contract Information (FCI). Yearly self-assessment and affirmation.
- Level 2 (Advanced): 110 controls (NIST SP 800-171). Protects Controlled Unclassified Information (CUI). Self-assessment every three years with a yearly affirmation. C3PAO assessments were planned for Phase II, which is suspended.
- Level 3 (Expert): Adds 24 controls from NIST SP 800-172. Protects the highest-sensitivity CUI. Assessment by the DoD's DIBCAC team.
If your MSP supports a DoD prime or sub-tier contractor that handles CUI, plan for Level 2.
Does my MSP need its own CMMC assessment?
It depends on the data you touch. The CMMC final rule says MSPs are always External Service Providers (ESPs). An ESP that isn't a cloud provider and doesn't process, store or transmit CUI doesn't need its own CMMC assessment. Its services still sit inside the client's assessment scope (Federal Register). So expect defense clients to ask how you handle their systems, even when CMMC doesn't name you.
Which clients need CMMC?
Any company in the Defense Industrial Base that handles FCI or CUI under a DoD contract. In practice, that means:
- Direct DoD contractors (primes)
- Sub-contractors at any tier under a DoD contract
- Manufacturing firms supplying DoD platforms (think aerospace, naval, ground vehicles)
- Engineering and consulting firms with DoD or DARPA contracts
- Software vendors with DoD use cases
- Logistics, supply chain, and professional services firms with DoD scope
If a client's contract includes DFARS 252.204-7012, 7019, 7020 or 7021, it carries NIST SP 800-171 or CMMC obligations, and the services you run for that client sit inside its scope.
Where does CMMC apply?
CMMC is a US Department of Defense requirement. It applies to any company — domestic or international — that handles US DoD contract data. Foreign subsidiaries of DIB primes, allied nation suppliers, and offshore service providers are all in scope when they touch CUI.
How does CMMC readiness help MSPs win business?
Defense clients answer for how their providers protect FCI and CUI. An MSP that can hand over a current System Security Plan, a NIST SP 800-171 self-assessment and a working incident-reporting process makes that easy. One that can't makes it hard.
What recurring work does CMMC create for MSPs?
Becoming CMMC-ready yourself is the entry ticket. The recurring revenue is in helping your DIB clients stay ready.
CMMC isn't one-and-done. Level 1 needs a self-assessment and affirmation every year. Level 2 needs a self-assessment every three years and an affirmation every year, and the controls behind that affirmation need continuous monitoring. DFARS 252.204-7012 incident reporting runs all year.
With Cyber Verify CaaS, you can run this for DIB clients without building the platform yourself. Each client gets its own tenant, and you set the price and bill them.
How does Cyber Verify help with CMMC?
Cyber Verify gives MSPs a pre-built CMMC framework that takes most of the policy and evidence work off the table:
- Scoping templates that carve a defensible CUI enclave
- All 110 SP 800-171 controls pre-mapped to UCS Practice Domains and policy templates
- System Security Plan (SSP) template at the depth assessors expect, plus a POA&M for open items
- Evidence library indexed by CMMC assessment objective
- CORTEX scoring keeps you assessment-ready between self-assessments
- Introductions to C3PAOs when you or a client chooses a third-party assessment, under that firm's own engagement
Where can I check CMMC's current status?
- DoD CIO, About CMMC
- Department of War, Department of War Suspends CMMC Phase II Requirements
- Nextgov, CMMC's Phase 2 suspension locked in with binding regulation, September 2026
- DefenseScoop, Pentagon pores over heaps of industry feedback on CMMC reform, September 9, 2026
- Federal Register, CMMC Program final rule, October 15, 2024