Free CMMC 2.0 Risk Check:
Which Level Applies to You, and What’s Your Estimated SPRS Score?

CMMC is the Department of Defense’s program for verifying that contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) at the level their specific contract requires. It applies across the defense industrial base, which includes manufacturers producing parts or materials for defense end use and transportation/logistics providers moving defense-related freight, not just companies that think of themselves as “defense contractors.”

Your contract, RFP, or your prime’s flow-down clause states it. Level 1 applies if you only handle FCI (15 basic safeguarding practices). Level 2, the level most manufacturing and logistics subcontractors land on, applies if you handle CUI and aligns to all 110 NIST SP 800-171 requirements. Level 3 adds 24 enhanced NIST SP 800-172 requirements for the most sensitive programs. If nothing in writing states your level, that’s itself a gap, and it’s question 1 in the tool above.

SPRS (Supplier Performance Risk System) is where DoD contractors submit their NIST 800-171 self-assessment score. The scoring starts at 110 points and subtracts 1, 3, or 5 points for every control not fully implemented, with no partial credit, down to a possible low of -203. Your score is what a contracting officer or prime sees when evaluating whether to award or renew a contract with you.

As of this writing, no, not on the original timeline. The Department of Defense suspended the Phase 2 requirement, which would have mandated a C3PAO assessment for Level 2 contracts involving CUI starting November 10, 2026, in a July 13, 2026 announcement, citing compliance cost, a shortage of certified assessors, and defense-industrial-base growth concerns. A 60-day CMMC Reform Task Force review is underway, with an industry RFI due August 14, 2026. What hasn’t changed: Phase 1’s Level 1 and Level 2 self-assessment requirements, and SPRS score submission, remain in effect.

The False Claims Act lets the government, or a whistleblower on the government’s behalf, pursue a company that knowingly submits false information to obtain a federal contract or payment. Since 2021, the DOJ’s Civil Cyber-Fraud Initiative has specifically targeted contractors who misrepresent their cybersecurity compliance, including inaccurate NIST 800-171 self-assessments and SPRS scores, and it has produced real settlements, including an $9 million settlement with Aerojet Rocketdyne (2022), an $8.4 million settlement involving Raytheon and its successor Nightwing (2025), and a $507,144 settlement with defense contractor LOGZONE (June 2026). An honest “Not sure” or “No” on a self-assessment is a compliance gap to close. A confident but inaccurate “Yes” is the specific conduct that’s drawn these settlements.

This is increasingly common and it’s a legitimate ask, since a prime carries its own flow-down risk if one of its subcontractors can’t substantiate its compliance. The fastest way to respond is with your SSP, POA&M, and current SPRS score in hand, rather than a verbal assurance. Question 10 in the checklist above (supply chain and flow-down) is where this shows up in your result.

Yes, cost and assessor availability are real constraints, which is part of why the Phase 2 requirement was paused. Reported C3PAO assessment fees for Level 2 have ranged roughly from the tens of thousands of dollars up into six figures depending on organization size and scope, and preparation work typically costs several times the assessment fee itself. Separately, industry reporting has described a large gap between the number of companies expected to need Level 2 assessments and the number of authorized C3PAOs available to perform them.