Blog · Manufacturing
CMMC Phase 2 starts November 10, 2026: what small manufacturers need to know
If you machine, fabricate or assemble anything that ends up in a Department of Defense program, even three tiers down, the rules for winning that work change on November 10, 2026.
That's the start of Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program. From that date, solicitations can require a third-party CMMC Level 2 certification as a condition of award. A self-assessment won't be enough for those contracts.
The timeline
The DFARS rule that puts CMMC into contracts was published on September 10, 2025 and took effect November 10, 2025. It rolls out in four phases:
| Phase | Starts | What it means |
|---|---|---|
| 1 | Nov 10, 2025 | Level 1 or Level 2 self-assessment can be a condition of award |
| 2 | Nov 10, 2026 | Level 2 certification by an authorized assessor (C3PAO) can be a condition of award |
| 3 | Nov 10, 2027 | Level 2 certification needed to exercise option periods; Level 3 requirements begin |
| 4 | Nov 10, 2028 | Full implementation across applicable contracts |
Which level applies to you
It depends on what information touches your systems.
- Federal Contract Information (FCI) is information provided or generated under a government contract that isn't meant for the public: purchase orders, schedules, basic contract details. Handling only FCI means Level 1: 15 basic safeguarding requirements from FAR 52.204-21, self-assessed every year.
- Controlled Unclassified Information (CUI) is information the government requires to be protected, and for manufacturers it is very often technical data: drawings, specs, CAD models, process sheets marked CUI or covered by export controls. Handling CUI means Level 2: the 110 requirements of NIST SP 800-171 Revision 2.
- Level 3 adds selected requirements from NIST SP 800-172 for the highest-priority programs. Few small shops will see it.
Quick test: look at the drawings and flow-downs from your customers. If you see CUI markings, ITAR or EAR notices, or the DFARS clause 252.204-7012 in your purchase orders, plan for Level 2.
What Phase 2 changes in practice
- Your score has to be real. A C3PAO assessor checks evidence for each requirement. A spreadsheet that says “implemented” isn't evidence.
- Someone signs for it. Each company names an affirming official who attests in the Supplier Performance Risk System (SPRS) every year that the company is still compliant.
- Primes will ask you directly. Your CMMC status goes into SPRS, but primes have to verify their subcontractors themselves. Expect questionnaires and requests for your certificate.
- Gaps have a deadline. A limited set of lower-weighted items can be left on a plan of action and milestones (POA&M) for conditional status, but they must be closed within 180 days. The heavy-hitters can't be deferred.
The mistake that costs the most: scope
CMMC applies to every system that stores, processes or transmits CUI, and to the people and devices that can reach it. If CUI drawings sit on the same shared drive as everything else, your whole network is in scope, including the shop floor.
The cheaper path for most small manufacturers is to shrink the scope: put CUI in a separate, locked-down environment (often Microsoft 365 GCC High or a dedicated enclave), limit who can reach it, and keep the rest of the business out. Fewer systems in scope means fewer controls to prove and a smaller assessment.
What to do in the next 90 days
- Find your CUI. List which customers send controlled data, what form it arrives in, and where it ends up. Inbox, shared drive, CAM workstation, USB stick.
- Decide your scope. Everything, or an enclave. This decision drives cost more than any other.
- Score yourself honestly against NIST SP 800-171 and update your SPRS score so it matches reality.
- Fix the big items first: multi-factor sign-in, encryption, logging, access control, incident response and backups you have actually restored.
- Write the System Security Plan. Assessors start with it, and many shops don't have one.
- Book an assessor early. Authorized C3PAOs are limited and demand will spike as Phase 2 contracts appear.
None of this is fast. Shops that start now can be ready for the contracts that matter; shops that wait for the solicitation usually can't.
General information, not legal advice. Your requirements depend on the specific clauses in your contracts.
Sources
- Cooley: DoD releases final rule implementing the CMMC contract clause (Sept. 2025)
- NIST SP 800-171 Rev. 2; FAR 52.204-21; DFARS 252.204-7012