What CMMC Phase 2 changes for small defense subcontractors

If you hold, or want, a subcontract with a defense prime, you may have been asked for your SPRS score this year. Starting November 10, 2026, that score will no longer be the whole story for a growing set of contracts. The requirements are changing in phases, and small subcontractors need to understand what applies to their work and when.

Where the program stands

The CMMC program rule, 32 CFR part 170, took effect in December 2024. The acquisition rule that puts CMMC requirements into DoD contracts took effect on November 10, 2025. That date also started Phase 1 of a four-phase rollout. During Phase 1, solicitations can require a Level 1 or Level 2 self-assessment, posted in SPRS and affirmed by a senior official of the company.

Phase 2 begins one year later, on November 10, 2026. From that date, solicitations can require Level 2 certification by an authorized third-party assessment organization, a C3PAO, where the contract involves Controlled Unclassified Information. Phases 3 and 4 follow in 2027 and 2028 and extend the requirements further, including Level 3.

The requirements also flow down to subcontractors. If a prime's contract requires Level 2 certification and you'll handle CUI under it, the prime needs you certified too, so this is worth discussing with your primes before a solicitation sets the timing.

What actually changes at Level 2

The 110 requirements are the same ones in NIST SP 800-171 Revision 2 that DFARS 252.204-7012 has pointed to for years. What changes is who checks whether your organization meets them.

A self-assessment is your own reading of your own environment. A certification assessment is someone else's reading, and the assessor will want to see evidence for each requirement. That means a written policy, a configuration that matches it, and a record showing it has been operating. A line in the System Security Plan saying it's in place isn't enough on its own.

This is where small companies can be surprised. The issue isn't always a missing security measure. It's often the evidence trail behind a measure that's already in place. The access review happened, but nobody recorded it. MFA covers email, but not the one remote access path the owner uses from home. CUI sits in a shared folder that nobody included in scope.

A few things worth doing now

Start with scope. Find where CUI actually comes in, where it's stored, and where it leaves. A smaller, cleaner boundary is the biggest lever on cost, because every system inside it has to meet every requirement that applies.

Then read your SSP against your environment, line by line, as if you were the assessor. For every requirement marked implemented, identify something you could show on a screen in under a minute. If the evidence isn't easy to point to, the documented status may be ahead of what you can demonstrate.

Check your SPRS score against what you could actually prove. A self-score that won't hold up to a third-party look is a risk in itself, because a senior official affirmed it.

Ask your primes directly what they expect and when. Some will want their subcontractors certified before Phase 2 solicitations start, so they can bid with a team that's already cleared. Don't assume every prime will set the same timeline.

If you'll need a C3PAO, start looking before the solicitation does. An assessment takes planning on both sides, and the time to find a gap is before the assessor does.

Where we fit

Our founder has spent years doing RMF and NIST control work inside federal and regulated environments. NetSecurely approaches readiness the way an assessor will look at it. Scope comes first, then evidence, followed by a plain list of what's left. We're a small, veteran-owned firm, and we work alongside your IT team rather than replacing it.

If November 10 is on your calendar and you're not sure where your evidence stands, a 15-minute conversation is a reasonable place to start.

netsecurely.com/service-page/free-discovery-call-15-to-30-minutes