govcon.forum

What are the latest CMMC Level 2 self-assessment requirements for October 2026?

Ask a question
Asked Active Viewed 2 timesQuestion
1answer

What are the latest CMMC Level 2 self-assessment requirements for October 2026?

Our firm is an IT services small business, NAICS 541519, and we are looking at a federal opportunity that will require CMMC Level 2. The solicitation is expected to drop in early 2026, and we want to get our self-assessment done well before then. I saw on the DoD CIO page that Phase II of CMMC was suspended, but that Phase I self-assessment requirements are still in place. I need to know the most current requirements for a Level 2 self-assessment that will be valid in October 2026. What does a Level 2 self-assessment entail now, and how often do we need to conduct it?

cmmcnist-800-171compliance-and-securitycybersecurity
ShareReport
asked Priya S. Verified vendorCapture manager, IT services · Herndon, VA · 690 rep

1 answer

0

A CMMC Level 2 self-assessment requires your firm to assess its compliance with the 110 requirements of NIST SP 800-171 Revision 2. The 32 CFR CMMC Program rule was published October 15, 2024, and the 48 CFR DFARS CMMC acquisition rule was published September 10, 2025. The Department suspended Phase II of CMMC implementation, but all Phase 1 self-assessment requirements remain in place. Your self-assessment is conducted every three years, and the resulting CMMC Status is valid for three years from the CMMC Status Date. This means a self-assessment completed in early 2026 will be valid through October 2026 and beyond. You will need to ensure your IT services firm meets all 110 controls of NIST SP 800-171 to achieve Level 2.

ShareReport
answered Tom B. Construction estimator, public works · Phoenix, AZ · 609 rep

Your answer

Sign up to answerCite the FAR clause or procurement code where you can.

Related questions