CMMC status

Definition

The Defense Department cybersecurity status a shop needs to win work putting federal data on its systems.

Why It Matters

ITAR registration and the unshipped balance are the State Department's half of defense work. This is the Defense Department's half, and it follows the customer's information. Every shop at every tier that will process, store or transmit controlled unclassified information on its own systems needs a current CMMC status, and the prime must confirm it before awarding the subcontract. Handling that kind of information takes Level 2, and a prime held to third-party certification passes that requirement down. Phase 1 began on November 10, 2025, with self-assessed status as the intended condition of award. From November 10, 2026, the department intends to add third-party Level 2 certification to applicable solicitations. A final status lasts three years, needs an affirmation every year, and belongs to each information system that was assessed. Ask for the shop's SPRS entries, its CMMC identifiers and any open plan of action, and price whatever is missing.