Clear the security gate on US defense and manufacturing contracts 

CMMC (Cybersecurity Maturity Model Certification) is the US Department of Defense's cybersecurity program for its supply chain.

It applies to any company — American or foreign — whose contract involves Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). If you sell only commercial off-the-shelf products, it generally does not apply. Your contract clause decides, not your size or location. 

Level 1 covers FCI: 15 basic requirements, confirmed by an annual self-assessment.

Level 2 covers CUI: the 110 requirements of NIST SP 800-171, across 14 families.

Level 2 is confirmed either by self-assessment or by a certified third-party assessor (C3PAO) every three years, depending on what your contract specifies. Level 3 applies to the most sensitive programs and is assessed by the government. 

There is no single deadline — your deadline is your contract.

CMMC became contractually enforceable on 10 November 2025, when the DFARS acquisition rule took effect. Phase 1 runs to 9 November 2026 and centres on Level 1 and Level 2 self-assessments. Phase 2 starts 10 November 2026, expanding third-party Level 2 certification to most contractors handling CUI. Because readiness takes 6–12 months, the practical deadline is now. 

It depends on what your contract says.

Level 1 is always an annual self-assessment. Level 2 can be either — the DoD program office decides whether your contract requires a self-assessment or a C3PAO certification. From Phase 2 (10 November 2026) third-party certification becomes the norm for CUI. C3PAO capacity is limited and assessments are booked months out, so delay is a scheduling risk as much as a compliance one. 

Most organizations need 6 to 12 months to reach readiness, and longer from a weak security baseline. The timeline depends on scope — how much of your environment touches CUI — your existing documentation, and whether you are pursuing a self-assessment or a third-party certification. Scoping is the single biggest lever: narrowing your CUI boundary cuts both the time and the cost. 

Yes. CMMC follows the information, not the passport.

If a European company stores, processes or transmits FCI or CUI under a DoD contract — including as a subcontractor to a US prime — the requirements flow down to you. Primes are obliged to pass CMMC requirements down their supply chain. For EU companies this usually means designing a US-based enclave and getting the data-handling boundary right before the first contract, not after.