If you sell anything to the Department of Defense (hardware, parts, consumables, services), you have probably seen the acronym CMMC in solicitations, supplier questionnaires, or emails from prime contractors. And if you are a small supplier, you have probably wondered whether it really applies to a company your size.
Short answer: yes, almost certainly. The longer answer is more reassuring than the acronym suggests. This post explains what CMMC 2.0 is, what its levels mean in plain English, how it connects to DFARS clauses you may already have signed, and what a small supplier should do first.
What CMMC is and why it exists
CMMC, the Cybersecurity Maturity Model Certification, is DoD’s program for verifying that contractors actually implement the cybersecurity safeguards their contracts already require.
That last part matters. The underlying security requirements are not new. Contractors handling federal data have long been contractually obligated to protect it. What was missing was verification: companies self-attested, and DoD had limited visibility into whether the promises were kept. CMMC closes that gap by tying an assessment (sometimes your own, sometimes a third party’s) to contract eligibility.
The program protects two categories of information as they move through the defense supply chain:
- Federal Contract Information (FCI): information provided by or generated for the government under contract that is not intended for public release. Almost every contractor touches FCI, even if it is just contract terms, delivery schedules, and government correspondence.
- Controlled Unclassified Information (CUI): sensitive but unclassified information the government requires to be safeguarded, such as certain technical drawings, specifications, and export-controlled data.
Adversaries have learned that the easiest way into the defense industrial base is not through a prime contractor’s hardened network. It is through the thousands of small suppliers connected to it. CMMC exists because the supply chain is only as secure as its smallest link.
The three levels in plain English
CMMC 2.0 has three levels. Which one applies depends on what information your contract involves, not on your company’s size.
Level 1: basic safeguarding of FCI
Level 1 applies when a contract involves FCI but no CUI. It maps to the safeguarding requirements you may already know from FAR 52.204-21: the fifteen basic controls covering things like limiting access to authorized users, enforcing authentication, patching promptly, running malware protection, and sanitizing media before disposal.
Verification at Level 1 is an annual self-assessment with an affirmation by a senior company official. No third party is involved. For a supplier with a professionally managed IT environment, Level 1 is achievable, but the affirmation is a formal representation to the government, so meet the requirements before signing your name to them.
Level 2: NIST SP 800-171 for CUI
Level 2 applies when a contract involves CUI. It aligns to NIST Special Publication 800-171, the same 110 security requirements that DFARS 252.204-7012 has required of CUI-handling contractors for years. Level 2 does not invent a new standard. It verifies an existing one.
The verification method depends on the contract. Some Level 2 contracts allow a self-assessment; others require a certification assessment by a C3PAO, a CMMC Third-Party Assessment Organization, with annual affirmations in between. The solicitation tells you which applies. You do not get to choose.
Level 3: for the most sensitive programs
Level 3 adds requirements beyond NIST SP 800-171 and involves government-led assessment. It applies to contractors supporting DoD’s most sensitive priority programs. Most small suppliers will never need it. If you do, you will know, because your customer will tell you well in advance.
Who this actually applies to
A common assumption among small product suppliers: we just ship boxes, this is a prime contractor problem. That assumption does not hold.
- CMMC flows down. Prime contractors must ensure their subcontractors and suppliers meet the appropriate level for the information that reaches them. Expect primes to ask for your status in supplier questionnaires, and to shop elsewhere if you cannot answer.
- Product suppliers are in scope. If you receive purchase orders, delivery instructions, or technical specs from the government or a prime, you are likely handling FCI at minimum. If drawings or specifications are marked as CUI, you are in Level 2 territory.
- The rollout is phased. DoD is introducing CMMC requirements into contracts gradually over a period of years rather than all at once. That is a runway, not an exemption: readiness takes months, and early movers will be the ones eligible to quote when the requirement lands.
How DFARS 7012, NIST 800-171, SPRS, and CMMC fit together
These four acronyms confuse everyone, so here is the relationship in one pass:
- DFARS 252.204-7012 is the contract clause that requires you to protect CUI and report cyber incidents to DoD. It points to NIST SP 800-171 as the standard you must implement.
- NIST SP 800-171 is the standard itself: the 110 security requirements.
- SPRS, the Supplier Performance Risk System, is where you post your NIST 800-171 self-assessment score (required by the companion clauses DFARS 252.204-7019 and -7020). Contracting officers check it before award. Scores are measured against a maximum of 110, and most honest first assessments land well below it.
- CMMC is the verification layer on top of all of it: the program that checks, at the level your contract requires, whether the implementation is real.
If you have already done serious NIST 800-171 work for DFARS 7012, you are most of the way to CMMC Level 2. If you have not, CMMC is the reason to stop deferring it.
First steps for a small supplier
You do not need to boil the ocean. You need a sequence:
- Scope where federal data lives. Which systems, mailboxes, file shares, and devices touch government or prime-contractor information? The smaller and better-defined that footprint, the cheaper everything that follows becomes. Many small suppliers can confine federal data to a handful of systems.
- Run an honest self-assessment. Map yourself against FAR 52.204-21 at minimum, and against NIST SP 800-171 if CUI is in play. Post your score in SPRS if DoD contracts require it. A low first score is normal; a fictional high one is a liability.
- Document gaps in a POA&M. A Plan of Action and Milestones (what is missing, who owns it, and by when) is standard practice. CMMC constrains how long POA&Ms can stay open and does not allow every requirement to be deferred. Treat the plan as a schedule, not a parking lot.
- Nail the basic hygiene first. Multi-factor authentication everywhere it is supported, prompt patching, access limited to the people who need it, malware protection, and offline-tested backups. These controls carry weight in every framework and stop real attacks in the meantime.
For a company without in-house IT, the honest path is a managed IT partner that already works to these standards, building assessment evidence, MFA, patching discipline, and access control into day-to-day operations instead of treating compliance as an annual scramble.
Where Next Plus fits
Next Plus sits on both sides of this topic: we are an IT and cybersecurity provider for small businesses, and we are a federal supplier ourselves, registered in SAM.gov and active on DLA DIBBS, so the clauses in this post are ones we operate under, not just write about.
If you are a small supplier trying to figure out where you stand, start with a free IT check-up, explore our federal solutions, or reach out through our contact page or at [email protected]. The suppliers who treat CMMC as a to-do list rather than a threat will be the ones still quoting when the requirements arrive.