CMMC 2.0 in 2026: A Practical Guide for Southern California Defense Suppliers

Reviewed by Adrian Monges Rodriguez, Founder & CEO

Defense suppliers handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) may have cybersecurity obligations under their contracts. CMMC establishes assessment levels for covered Department of Defense contracts. The solicitation and contract specify the required status and assessment type.

Current status, October 29, 2026: The Department of War suspended Phase II implementation in July 2026 while keeping Phase I self-assessment requirements in place. Check the official CMMC program page and the specific solicitation for current requirements.

What are the CMMC levels?

• Level 1: 15 basic safeguarding requirements for FCI, with annual self-assessment and affirmation.
• Level 2: 110 NIST SP 800-171 Revision 2 requirements for protecting CUI. The solicitation specifies self-assessment or a third-party C3PAO assessment; both generally require reassessment every three years and an annual affirmation.
• Level 3: Additional selected NIST SP 800-172 requirements and a government-led DIBCAC assessment for applicable higher-risk programs. Level 3 is not limited to prime contractors.

See the DoD small business cybersecurity overview and 32 CFR Part 170. Requirements flow down to subcontractors as specified by the applicable rules and contracts.

What does Level 2 preparation involve?

Start with the contract and the CUI you handle. Define the assessment boundary and document systems, services, and external providers that process, store, transmit, or protect relevant information. A narrowly scoped enclave can be useful, but no particular cloud product or enclave architecture automatically establishes compliance.

Document the environment in a System Security Plan, assess the 110 requirements, and gather evidence such as approved policies, configurations, logs, and training records. A Plan of Action and Milestones may be used for eligible unmet requirements under the rule's conditions; it is not a substitute for meeting every requirement. Conditional status has restrictions, including a minimum score and a 180-day closeout period. See our CMMC Level 2 guide for details and links to the regulation.

Does every supplier need a C3PAO?

No. The solicitation determines whether a Level 2 self-assessment or a C3PAO assessment is required. AdVran is not a C3PAO. We can help with a gap assessment, documentation, control implementation, and preparation for an independent assessment when one is required.

How long does preparation take and what does it cost?

Both depend on scope, existing controls, evidence, remediation, and the required assessment. Request separate estimates for implementation, licensing, internal work, and any independent assessment. The 2024 CMMC final rule's economic analysis includes assessment estimates based on stated assumptions; it does not include every organization's remediation costs.

Does Microsoft 365 GCC High guarantee compliance?

No. Product choice depends on contract requirements, the information involved, the service's authorization and configuration, and the shared responsibility model. Evaluate the actual environment and services against applicable requirements rather than assuming one product is the only path or guarantees an assessment outcome.

What should a supplier do next?

1. Review the solicitation, contract clauses, and any prime-contractor flow-down requirements.
2. Identify and map the FCI or CUI involved, its systems, and service providers.
3. Compare current controls and evidence to the applicable assessment requirements.
4. Assign owners and timelines for gaps, and track any eligible POA&M items.
5. Plan for the assessment and affirmation specified in the contract.

AdVran's compliance and risk management services support this readiness work for Southern California organizations. Contact us to discuss your environment.

Related reading

• CMMC Level 2 requirements
• NIST SP 800-171
• Defense industry IT