CMMC for North Carolina Defense Suppliers, in Plain English

Federal Contract Information is information the government provides or creates under a contract that is not meant for the public. Information already public and simple payment details do not count (FAR 52.204-21).

Controlled Unclassified Information is more sensitive: information the government says must be protected even though it is not classified (National Archives CUI program). For a manufacturer it is often technical drawings, specifications or export-controlled data that come with the job. It should be marked as CUI, but markings are not always consistent, a problem defense officials acknowledged in September 2026 (DefenseScoop).

CMMC applies to prime contractors and to subcontractors at every tier that handle FCI or CUI on their own computers, and primes must pass the requirement down to their subcontractors (32 CFR 170.23).

Key takeaway: If you never touch FCI or CUI, CMMC does not apply to that work. If you do, the level you need depends on which kind you touch.

Your contract or your prime's purchase order should say which level and which type of assessment is required. A subcontractor that handles CUI needs at least Level 2 (Self), and Level 2 (C3PAO) when the prime's contract requires that (32 CFR 170.23).

After every assessment, and every year after that, a senior person at your company called the "affirming official" must confirm in the government's Supplier Performance Risk System (SPRS) that you still meet the requirements (32 CFR 170.22).

The department started a 60-day reform review (Washington Technology) and received more than 1,100 responses from industry (DefenseScoop). The task force delivered its report to the department's Chief Information Officer on September 11, 2026, and as of late September 2026 it had not been made public (Covington & Burling).

The department's CIO has said security needs to be "continuous" rather than a "point-in-time check" (DefenseScoop). Nobody outside the department knows yet what the reformed program will look like, so plan for the security work either way.

• Paused: outside C3PAO certification and government assessments as a condition of winning a contract. New requirements may ask only for Level 1 (Self) or Level 2 (Self) (Latham & Watkins).
• Still required: Level 1 and Level 2 self-assessments, SPRS scores, yearly affirmations and flowing the requirements down to subcontractors (Latham & Watkins).
• Still required: the DFARS 252.204-7012 contract clause, which requires the NIST SP 800-171 controls and reporting cyber incidents to the Defense Department within 72 hours of discovery (DFARS 252.204-7012).
• Still in force: the CMMC rule itself. The pause changes what contracts ask for, not the rule in 32 CFR Part 170 (Redspin).

Key takeaway: The pause removed the outside audit for now. It did not remove the security work, the self-assessment or your responsibility for what you report.

Each missing requirement costs 1, 3 or 5 points depending on how much harm the gap could cause. For example, having no multi-factor authentication, a second check such as a code on your phone, costs 5 points; having it only for remote and administrator accounts costs 3 (32 CFR 170.24).

An honest score matters more than a high one. In March 2025 a defense contractor agreed to pay $4.6 million to settle claims that it reported a score of 104 when an outside consultant had calculated -142, and was slow to correct it (U.S. Department of Justice).

The free tools section further down this page includes an SPRS score calculator and policy templates that map to CMMC requirements, so you can see roughly where you stand before you talk to anyone.

Key takeaway: Report the score you actually have, keep the evidence behind it, and update it when things change.

The government's figures assume a small company hires outside help for planning and paperwork, and that the controls already exist (Federal Register). They do not include buying or setting up the security itself, such as multi-factor authentication, encrypted email, monitoring or a separate secure area for CUI.

What the security work costs depends on how many people, computers and systems touch CUI. Keeping CUI in a small, separate environment, often called an enclave, can shrink what has to be protected. Ask any provider for a written, itemized quote before work starts.

Key takeaway: Budget for the security work first. The assessment is usually the smaller line item.

Primes are required to flow CMMC down to subcontractors that handle FCI or CUI (32 CFR 170.23), and DFARS 7012 down to those that handle CUI (DFARS 252.204-7012), so a supplier that cannot show its status can lose work even while the Phase 2 audit is paused.