CMMC 2.0 Changes: What Defense Contractors Need to Know in 2026

TL;DR: Quick Takeaways

•CMMC reduced from 5 levels to 3 streamlined levels for clarity and ease of implementation
•Level 2 now directly aligns with NIST SP 800-171 (110 practices), eliminating confusion
•Annual self-assessments allowed for most Level 2 contractors, with triennial third-party assessments
•Plans of Action and Milestones (POA&M) now permitted for certain controls during assessment
•Full implementation across all DoD contracts expected by late 2026

The Department of Defense made significant changes to the Cybersecurity Maturity Model Certification (CMMC) framework when it released CMMC 2.0, transforming it from a complex five-level model into a streamlined, more practical three-tier system. If you're a defense contractor who studied CMMC 1.0, much of what you learned has changed.

These changes weren't arbitrary—they came from thousands of public comments, industry feedback, and the realization that the original framework created unnecessary complexity and costs for contractors while not necessarily improving security outcomes. CMMC 2.0 represents a more balanced approach that maintains rigorous security standards while reducing redundancy and implementation burden.

In this guide, we'll break down every major change in CMMC 2.0, what it means for your organization, and how to adapt your compliance strategy to align with the new requirements.

From 5 Levels to 3: The Biggest Structural Change

The most visible change in CMMC 2.0 is the reduction from five certification levels to three. This simplification eliminates the confusion and overlap that existed in CMMC 1.0.

CMMC 1.0 vs CMMC 2.0 Level Comparison

CMMC 1.0	CMMC 2.0	Key Change
Level 1 (43 practices)	Level 1 (17 practices)	Reduced practice count
Level 2 (72 practices)	Eliminated	Removed as unnecessary
Level 3 (130 practices)	Level 2 (110 practices)	Now maps to NIST 800-171
Level 4 (156 practices)	Eliminated	Merged into Level 3
Level 5 (171 practices)	Level 3 (110+ practices)	Enhanced controls for critical programs

This consolidation has important implications for contractors who were preparing for specific CMMC 1.0 levels. Most contractors who would have needed CMMC 1.0 Level 3 now fall under CMMC 2.0 Level 2, which is the most common certification requirement.

⚠️ Important Note:

If you started CMMC 1.0 Level 3 preparation, you're actually in good shape for CMMC 2.0 Level 2. The practice count decreased from 130 to 110, and there's now clearer alignment with NIST SP 800-171, which many contractors were already implementing.

NIST SP 800-171 Alignment: The Foundation Change

One of the most significant changes in CMMC 2.0 is the direct alignment of Level 2 with NIST SP 800-171. This wasn't just a cosmetic change—it fundamentally altered how contractors should approach compliance.

Why This Alignment Matters

✓
Eliminates Dual Compliance: Contractors no longer need to maintain separate CMMC and NIST 800-171 programs—they're now the same
✓
Leverages Existing Work: Many contractors already implemented NIST 800-171 for DFARS compliance, making CMMC more achievable
✓
Clearer Requirements: NIST 800-171 is well-documented with years of implementation guidance available
✓
Consistent Assessment: Assessors use the same control framework, reducing interpretation variance

The 14 NIST 800-171 Control Families

CMMC 2.0 Level 2 requires full implementation of all 110 security requirements across these 14 families:

1.Access Control (AC) - 22 controls

2.Awareness & Training (AT) - 3 controls

3.Audit & Accountability (AU) - 9 controls

4.Configuration Management (CM) - 9 controls

5.Identification & Authentication (IA) - 11 controls

6.Incident Response (IR) - 4 controls

7.Maintenance (MA) - 6 controls

8.Media Protection (MP) - 9 controls

9.Physical Protection (PE) - 6 controls

10.Personnel Security (PS) - 2 controls

11.Risk Assessment (RA) - 3 controls

12.Security Assessment (CA) - 4 controls

13.System & Communications (SC) - 16 controls

14.System & Information Integrity (SI) - 8 controls

Assessment Requirements: Self-Assessment vs Third-Party

CMMC 2.0 introduced a major change in how assessments are conducted, creating a hybrid model that balances cost with assurance.

Level 2 Assessment Model

Annual Self-Assessment

Most Level 2 contractors can conduct annual self-assessments using the CMMC Assessment Guide. Results must be submitted to the Supplier Performance Risk System (SPRS).

Triennial C3PAO Assessment

Every three years, contractors must undergo a third-party assessment by a CMMC Third-Party Assessment Organization (C3PAO) to validate their security posture.

Exception:

Critical national security programs may require C3PAO assessment for every contract or more frequent assessments as specified by the contracting officer.

What Changed from 1.0

NEW:

Self-assessment option significantly reduces annual compliance costs

NEW:

3-year certification validity for most contractors (vs. annual under 1.0)

NEW:

Government oversight of C3PAOs ensures consistent assessment quality

CHANGED:

No more requirement for all assessments to be conducted by third parties

Cost Implications

This change dramatically reduces ongoing compliance costs:

CMMC 1.0 Level 3 (Annual)

C3PAO assessment: $15K-25K/year

Total 3 Years: $45K-75K

CMMC 2.0 Level 2 (Hybrid)

Self-assessment: $2K-5K/year × 2

C3PAO assessment: $15K-25K (year 3)

Total 3 Years: $19K-35K

Navigate CMMC 2.0 Changes with Confidence

Get a free assessment to see how CMMC 2.0 changes affect your compliance strategy and learn exactly what you need to implement.

Book Free Assessment Download Transition Guide

POA&M Allowance: A Practical Flexibility Addition

One of the most contractor-friendly changes in CMMC 2.0 is the allowance for Plans of Action and Milestones (POA&M) during assessment. This represents a significant shift from the "all or nothing" approach of CMMC 1.0.

What is a POA&M?

A Plan of Action and Milestones (POA&M) is a documented plan for addressing security control gaps. It identifies:

1.Specific controls that are not yet fully implemented
2.Root cause of the gap and compensating controls in place
3.Detailed remediation plan with specific milestones
4.Target completion dates and resources required
5.Risk assessment and mitigation strategy

✅ When POA&Ms Are Allowed

• Level 2 assessments for specific control gaps
• When contractor has documented remediation plan
• Gaps are not in critical security controls
• Compensating controls are in place
• Realistic timeline for closure (typically 30-180 days)
• Approved by authorizing official

❌ POA&M Limitations

• Not unlimited—must be justified and necessary
• Cannot be used for critical security controls
• Require approval from contracting officer
• Must show progress and meet milestones
• Open POA&Ms reduce overall security score
• Excessive POA&Ms may prevent contract award

💡 Strategic Tip:

POA&Ms should not be viewed as a way to avoid implementing controls. Instead, use them strategically for controls that require significant time or investment to fully implement (e.g., replacing legacy systems, completing physical security upgrades). Aim to have no more than 5-10% of controls on POA&M status during assessment.

Implementation Timeline and Rollout

Understanding the CMMC 2.0 implementation timeline is crucial for planning your compliance strategy and maintaining eligibility for DoD contracts.

2025-2026

Phased Rollout Period

CMMC requirements begin appearing in select DoD contract solicitations. Contractors should start preparation immediately to avoid losing bid opportunities.

Action: Begin gap assessment and remediation now

Late 2026

Full Implementation

All new DoD contracts and contract renewals will require appropriate CMMC certification. No exceptions for contractors handling FCI or CUI.

Action: Complete certification before this deadline

2027+

Ongoing Compliance

Continuous monitoring, annual self-assessments, and triennial C3PAO assessments become the new normal for maintaining DoD contract eligibility.

Action: Establish continuous compliance program

⏰ Recommended Timeline for Contractors

Months 1-2: Gap Assessment

Conduct comprehensive assessment of current security posture against CMMC Level 2 requirements. Identify all gaps and prioritize remediation.

Months 3-8: Remediation & Implementation

Implement missing controls, update policies and procedures, deploy required security tools, and train personnel on new processes.

Months 9-10: Internal Testing

Conduct internal audit to validate control implementation. Perform mock assessment to identify any remaining gaps before formal assessment.

Months 11-12: C3PAO Assessment & Certification

Engage C3PAO, undergo formal assessment, remediate any findings, and receive CMMC certification before full implementation deadline.

How to Transition from CMMC 1.0 to 2.0

If you've already invested in CMMC 1.0 preparation, your work is not wasted. Here's how to adapt your existing compliance program to CMMC 2.0 requirements:

Step 1: Reassess Your Required Level

Map your CMMC 1.0 target level to CMMC 2.0 equivalent:

• CMMC 1.0 Level 1 or 2 → CMMC 2.0 Level 1
• CMMC 1.0 Level 3 or 4 → CMMC 2.0 Level 2
• CMMC 1.0 Level 5 → CMMC 2.0 Level 3

Step 2: Align with NIST SP 800-171

For Level 2 contractors, map your existing controls to NIST 800-171:

• Download NIST SP 800-171 Rev 2 and crosswalk to your current controls
• Identify any CMMC 1.0 practices that are no longer required
• Add any NIST 800-171 controls you didn't implement under 1.0
• Update System Security Plan (SSP) to reference NIST control IDs

Step 3: Update Assessment Strategy

Adapt your assessment approach to the new hybrid model:

• Implement annual self-assessment process and documentation
• Plan for triennial C3PAO assessment instead of annual
• Update budget for reduced assessment frequency (lower ongoing costs)
• Establish continuous monitoring program to support self-assessments

Step 4: Leverage POA&M Flexibility

For any remaining gaps, develop formal POA&Ms:

• Document detailed remediation plans for incomplete controls
• Implement compensating controls where possible
• Set realistic milestones (30-180 day windows)
• Get contracting officer approval for POA&M approach

Step 5: Automate for Continuous Compliance

Invest in automation to maintain compliance efficiently:

• Use compliance automation platforms to continuously monitor controls
• Automate evidence collection from security tools and cloud providers
• Generate assessment reports automatically for annual self-assessments
• Establish alerts for control drift or configuration changes

Achieve CMMC 2.0 Level 2 with LowerPlane

Our platform is built specifically for CMMC 2.0 requirements with NIST 800-171 control automation, continuous monitoring, and streamlined C3PAO coordination.

✓All 110 NIST 800-171 controls automated
✓Annual self-assessment automation
✓POA&M management and tracking
✓C3PAO assessment preparation
✓Continuous compliance monitoring

See How It Works

Key Takeaways

1
CMMC 2.0 streamlines compliance from 5 levels to 3, with most contractors needing Level 2 (110 NIST 800-171 controls).
2
Direct alignment with NIST SP 800-171 eliminates dual compliance requirements and leverages existing contractor investments.
3
Hybrid assessment model (annual self-assessment + triennial C3PAO) reduces ongoing costs by 40-60% compared to CMMC 1.0.
4
POA&M allowance provides practical flexibility for complex controls, but should be used strategically and sparingly.
5
Start preparation now—full implementation expected by late 2026, and certification takes 9-12 months on average.

Frequently Asked Questions

Do I need to recertify if I already have CMMC 1.0 certification?

Yes, CMMC 1.0 certifications will need to transition to CMMC 2.0. However, much of your existing work applies—especially if you were pursuing CMMC 1.0 Level 3, which closely aligns with CMMC 2.0 Level 2. The transition is primarily documentation and mapping your existing controls to NIST 800-171 format.

Can I still bid on DoD contracts while working toward CMMC certification?

It depends on the contract. During the phased rollout (2025-2026), some contracts will require CMMC certification before bid submission, while others may allow you to bid with the understanding that you'll achieve certification before contract award. Check each solicitation carefully for specific CMMC requirements and deadlines.

How many POA&Ms can I have during assessment?

There's no official limit, but best practice is to keep POA&Ms to no more than 5-10% of total controls (5-11 controls for Level 2). Each POA&M must be justified, include compensating controls, and have contracting officer approval. Too many POA&Ms may indicate insufficient security maturity and could prevent contract award.

What's the difference between self-assessment and C3PAO assessment?

Self-assessments are conducted internally using the CMMC Assessment Guide and submitted to SPRS. They're less expensive ($2K-5K) and can be done annually. C3PAO assessments are conducted by certified third-party assessors, are more rigorous and expensive ($15K-25K), and are required every three years for Level 2 contractors. Both use the same NIST 800-171 control framework.

Will CMMC 2.0 requirements change again?

CMMC 2.0 is now codified in the Federal Acquisition Regulation (FAR), making it more stable than CMMC 1.0. While minor updates may occur over time (similar to how NIST 800-171 has revisions), major structural changes are unlikely. The framework is designed to remain consistent while allowing for evolution of specific control requirements as cybersecurity threats change.

🛡️

Defense