CMMC 2026: What Defense Contractors Need to Know
The CMMC certification window is narrowing. Defense contractors face tightening requirements across CMMC, FedRAMP, and ITAR. Here is what is changing and what it means for your program.
Published December 10, 2025 by Megan Fulton.
Category: Federal
What you’ll take away
- Understanding CMMC 2.0 Levels
- What Has Changed Since CMMC 1.0
- Common CMMC Gaps in the Defense Industrial Base
The Cybersecurity Maturity Model Certification program is moving from optional self-attestation to mandatory third-party assessment for thousands of defense contractors. Organizations that have treated CMMC compliance as a future concern are running out of time. 2026 is not a distant deadline.
CMMC applies to any organization that handles Controlled Unclassified Information in connection with Department of Defense contracts. That includes prime contractors and, critically, subcontractors throughout the defense industrial base — many of whom have historically operated without rigorous security programs.
Understanding CMMC 2.0 Levels
CMMC 2.0 establishes three levels of certification, aligned with the sensitivity of the information being handled and the criticality of the program being supported.
- Level 1 (Foundational): 17 practices from NIST SP 800-171, self-attestation annually. For contractors handling Federal Contract Information.
- Level 2 (Advanced): 110 practices from NIST SP 800-171, third-party assessment required for most contracts. For contractors handling Controlled Unclassified Information.
- Level 3 (Expert): 134+ practices including NIST SP 800-172 requirements, government-led assessment. For contractors supporting critical programs.
What Has Changed Since CMMC 1.0
CMMC 2.0 eliminated the intermediate maturity levels from the original model, simplified the certification structure, and aligned the practice requirements more directly with NIST SP 800-171 and 800-172. It also reduced the number of domains and clarified which requirements apply to which contractor types.
The most significant change for most contractors is the transition from self-attestation to third-party assessment for Level 2. Organizations that have been self-certifying under the interim rules will need to engage a Certified Third-Party Assessment Organization for their next assessment — and the bar C3PAOs apply is higher than self-assessment typically produces.
Common CMMC Gaps in the Defense Industrial Base
- Access control deficiencies: least privilege not consistently enforced, privileged access not adequately monitored
- Configuration management: no formal baseline, no change control process, no automated configuration monitoring
- Incident response: no documented plan, no defined roles, no tested procedures
- Media protection: removable media controls incomplete or inconsistently applied
- System and communications protection: encryption requirements not fully implemented
- Audit logging: log collection incomplete, log review not occurring on a defined schedule
Preparing for a C3PAO Assessment
A C3PAO assessment is not a self-assessment with an external reviewer present. It is a rigorous independent examination of whether an organization's security controls are actually operating as documented. Assessors interview personnel, review evidence, test controls, and verify that what is documented reflects what is actually happening.
Organizations that approach CMMC with documentation that does not reflect operational reality consistently receive findings. Organizations that build programs that genuinely operate the required controls — not just document them — position themselves to succeed.
VioletX works with defense contractors across the industrial base to build CMMC-ready security programs — from gap assessment through remediation, assessment preparation, and ongoing continuous assurance after certification.