govcon.forum

What are the CMMC Level 2 self-assessment requirements for November 2026?

Ask a question
Asked Active Viewed 0 timesQuestion
1answer

Our firm is an IT services provider, NAICS 541519, and a DoD contractor. We are preparing for a CMMC Level 2 self-assessment. I thought the deadline for the assessment would be November 2026, but I heard that date may have changed. We need to understand the current requirements for a Level 2 self-assessment. I've been reviewing the CMMC Program rule and the DFARS CMMC acquisition rule, but I'm getting conflicting information on the timelines. What documentation must we have in place for this self-assessment, and what is the current validity period for the CMMC status after completing it?

cmmcnist-800-171compliance-and-securityself-assessmentdfars
ShareReport
asked Priya S. Verified vendorCapture manager, IT services · Herndon, VA · 781 rep

1 answer

0

The Department of Defense suspended the CMMC Phase II implementation, which had been scheduled for November 10, 2026, and all Phase I self-assessment requirements remain in place. This means that if your contract requires a CMMC Level 2 self-assessment, you will still need to complete it. CMMC Level 2 requires meeting the 110 requirements of NIST SP 800-171 Revision 2. You will need to document your system security plan, your policies and procedures, and evidence of implementation for each of those 110 requirements.

A CMMC Level 2 self-assessment is conducted every three years. The resulting CMMC Status is valid for three years from the CMMC Status Date. The 32 CFR CMMC Program rule took effect on December 16, 2024, and the 48 CFR DFARS CMMC acquisition rule took effect on November 10, 2025. You should review your contract for specific CMMC requirements.

ShareReport
answered Tom B. Construction estimator, public works · Phoenix, AZ · 652 rep
It is also worth noting that CMMC Level 1 is the 15 requirements of FAR 52.204-21, and this level is always a self-assessment. These foundational controls apply broadly. · Jo R. ·

Your answer

Sign up to answerCite the FAR clause or procurement code where you can.

Related questions