CMMC vs. NIST SP 800-171: What Contractors Must Know Now

Quick Answer: CMMC is a certification program built on the NIST SP 800-171 security requirements baseline, adding verification, annual affirmations, and contract eligibility gates. As of November 2026, CMMC Phase 2's third-party assessment requirement remains paused, so most contractors still self-attest. However, DOJ enforcement under the False Claims Act means self-attestation alone no longer protects contractors from legal exposure—verify your current contract clauses before assuming what's required.

Defense contractors handling Controlled Unclassified Information (CUI) have spent years preparing for a certification requirement that keeps shifting. The Cybersecurity Maturity Model Certification (CMMC) program was designed to add independent verification on top of the security requirements contractors were already supposed to follow under NIST SP 800-171. But a 2026 suspension has paused that verification layer, leaving many companies unsure what actually applies to them right now.

This confusion matters. Misunderstanding the relationship between these two frameworks has already cost contractors millions in False Claims Act settlements.

This post breaks down how CMMC builds on NIST SP 800-171, where the two frameworks align, what's changed in 2026, and why self-attestation alone no longer satisfies DoD's expectations for verifiable compliance—even while third-party certification remains on hold.

What Is the Difference Between CMMC and NIST SP 800-171?

NIST SP 800-171 is a security requirements baseline. It is not a certification program and has no built-in enforcement or assessment mechanism of its own. Published by the National Institute of Standards and Technology, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations" (Revision 2) lays out 110 specific security requirements that contractors handling CUI must implement.

CMMC is the certification program that verifies whether contractors actually meet that baseline. Under 32 CFR Part 170, CMMC incorporates NIST SP 800-171 Rev. 2 in full, plus a subset of requirements from the more stringent NIST SP 800-172, according to Cozen O'Connor (September 2025). In short: NIST SP 800-171 tells contractors what to do. CMMC is supposed to confirm they actually did it.

How Does DFARS Tie These Two Frameworks Together?

The Defense Federal Acquisition Regulation Supplement (DFARS) is what makes NIST SP 800-171 enforceable in the first place. DFARS clause 252.204-7012 requires contractors handling CUI to implement the 110 NIST SP 800-171 requirements and report cyber incidents to DIBNet within 72 hours, with flow-down obligations to subcontractors.

DFARS 252.204-7019 goes a step further, conditioning contract award on a current assessment score logged in the Supplier Performance Risk System (SPRS). DFARS 252.204-7020 obligates contractors to provide access for government-led Medium or High assessments. Historically, this meant contractors self-scored their own compliance and submitted that score to SPRS—with no independent check on accuracy.

What Are the CMMC Certification Levels?

CMMC organizes compliance into three levels, each tied to the sensitivity of the information a contractor handles (32 CFR Part 170, via Cozen O'Connor):

• Level 1 (Self-Assessment): 15 requirements drawn from FAR 52.204-21, required for contractors handling Federal Contract Information (FCI). No Plan of Action and Milestones (POA&M) is permitted—contractors must meet all 15 requirements outright.
• Level 2 (Self or C3PAO): The full 110 NIST SP 800-171 requirements, required for contractors handling CUI. This level can be satisfied through self-assessment or through certification by a Certified Third-Party Assessor Organization (C3PAO), depending on contract sensitivity.
• Level 3 (DIBCAC): The 110 NIST SP 800-171 requirements plus 24 selected NIST SP 800-172 requirements, assessed by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). This level applies to contractors handling especially sensitive CUI.

DoD originally projected that by year four of full implementation, roughly 62% of awards would require only Level 1 self-assessment, 2% would require Level 2 self-assessment, 35% would require Level 2 C3PAO certification, and 1% would require Level 3 DIBCAC assessment, according to final rule statistics cited by Cozen O'Connor.

What Does CMMC Add on Top of NIST SP 800-171?

CMMC was designed to layer several accountability mechanisms on top of the NIST SP 800-171 baseline:

• Independent verification. Instead of contractors grading their own homework, C3PAOs or DIBCAC assess compliance for Level 2 and Level 3.
• Contract eligibility gates. DFARS 204.7503 requires contracting officers to check SPRS and prohibits award without the required CMMC status.
• Annual affirmations. A designated "Affirming Official" must certify continuous compliance in SPRS each year.
• Unique system identifiers. Each in-scope information system receives a 10-character CMMC unique identifier recorded in SPRS.
• Structured POA&M rules. Contractors can hold conditional status for up to 180 days at Levels 2 and 3, but Level 1 requires final status, and Level 2 self-assessed contractors cannot receive award on conditional status.
• Flow-down accountability. Primes are responsible for verifying subcontractor compliance down the supply chain.

The CMMC program rule was finalized on October 15, 2024, with the companion DFARS rule (introducing clause 252.204-7021 and provision 252.204-7025) published September 10, 2025. Phase 1 took effect November 10, 2025.

Why Is CMMC Phase 2 Paused in 2026?

This is where the current landscape gets complicated. Phase 2—originally scheduled to begin November 10, 2026—would have made Level 2 C3PAO certification a condition of award for applicable CUI contracts. On July 13, 2026, the Department of War (formerly DoD) announced an immediate suspension of Phase 2.

A CMMC Reform Task Force was established under the DoD CIO to review the program, with a public Request for Information (RFI) due August 14, 2026. More than 1,100 comments were submitted. 

As of this writing, no published task force outcome has been released. DoD CIO Kirsten Davies, who will decide whether to publish the findings, has indicated the review is about refining implementation, not abandoning cybersecurity requirements: "This isn't about whether cybersecurity is important or not. It is. It's critical. It's vital." Given the pace of change this year, contractors should verify current contract clauses directly rather than assume this status is permanent.

What Still Applies During the CMMC Suspension?

During the suspension, program managers may only designate Level 1 (Self) or Level 2 (Self) in new contracts. They cannot require Level 2 (C3PAO) or Level 3 (DIBCAC) certification, and no CMMC waivers are being issued while the review is underway.

Importantly, several obligations remain fully in effect:

• Phase 1 requirements continue to apply.
• DFARS 252.204-7012, 252.204-7019, and 252.204-7020 remain enforceable.
• NIST SP 800-171 Rev. 2 remains the confirmed interim baseline, per DoD's May 2, 2024 class deviation.
• Annual SPRS affirmations are still required.
• Government-led DIBCAC assessments continue.
• Existing Level 2 (C3PAO) certificates remain valid and satisfy lesser designations under an "or higher" standard.
• Primes retain the ability to require higher certification levels in subcontracts, even where the government contract itself does not mandate them.

According to a Cyber AB town hall held in May 2026, 1,391 Final Level 2 certificates had been issued by that point, reflecting meaningful adoption even before the suspension (governmentcontractslaw.com).

Why Doesn't Self-Attestation Alone Satisfy DoD Anymore?

This is the central tension contractors face today. CMMC was built specifically to replace self-attestation with independent verification. But with Phase 2 suspended, most contractors are back to self-assessing against NIST SP 800-171 and submitting scores to SPRS—largely the same process CMMC was designed to improve.

Choose self-attestation if your current contract only requires Level 1 or Level 2 (Self) status under the suspension. That's the compliance pathway DoD currently permits for most awards. But self-attestation alone no longer satisfies DoD's broader expectations in three important respects:

Verifiable evidence. DIBCAC audits continue, and inaccurate self-assessments are being caught. The Logzone case shows that a near-perfect self-reported score doesn't hold up if a government audit finds otherwise.

Accountability. The DOJ's Civil Cyber-Fraud Initiative, launched in 2021, treats inflated or false cybersecurity compliance claims as a False Claims Act violation. The MORSECORP and Logzone settlements—$4.6 million and roughly $507,144, respectively—demonstrate that misrepresenting NIST SP 800-171 compliance carries real financial and legal consequences, independent of whether CMMC certification is currently mandatory.

Prime contractor expectations. Even where the government hasn't mandated Level 2 (C3PAO) certification, primes managing supply chain risk may still require it from subcontractors as a condition of doing business.

Choose a higher assurance pathway—such as pursuing voluntary C3PAO assessment or maintaining meticulous documentation behind your self-assessment—if your business depends on winning CUI-sensitive contracts, works beneath a prime with strict flow-down requirements, or wants to reduce exposure to False Claims Act risk. The paperwork may look the same as before CMMC existed, but the scrutiny behind it has not eased.

What Should Contractors Do Next?

The relationship between CMMC and NIST SP 800-171 hasn't changed in principle—CMMC still incorporates the 110 NIST SP 800-171 requirements as its foundation. What's changed is which parts of CMMC's verification structure are currently enforceable.

Three steps make sense regardless of how the suspension resolves:

1. Confirm your current contract clauses. Don't assume Phase 2 timelines or requirements apply—check directly with your contracting officer given how quickly the landscape has shifted in 2026.
2. Treat your self-assessment as if it will be audited. Given active DOJ enforcement, document your NIST SP 800-171 compliance thoroughly, even where third-party certification isn't currently required.
3. Watch for the task force outcome. No findings have been published as of this writing, but the review's conclusions will likely shape whether, and how, Phase 2 resumes.

Verifiable compliance remains the direction DoD is heading, even if the regulatory path to get there is still being worked out.

Frequently Asked Questions

Is CMMC certification currently required for defense contracts?

Only Level 1 (Self) or Level 2 (Self) designations may currently be required in new contracts. Level 2 (C3PAO) and Level 3 (DIBCAC) certification requirements are suspended as of the September 3, 2026 class deviation, though primes may still request them contractually.

Do I still need to comply with NIST SP 800-171 even though CMMC Phase 2 is suspended?

Yes. DFARS 252.204-7012, 7019, and 7020 remain in effect, and NIST SP 800-171 Rev. 2 is confirmed as the interim baseline. Compliance obligations haven't paused—only the third-party certification requirement has.

What happens if my self-assessed NIST SP 800-171 score is inaccurate?

You could face False Claims Act liability under the DOJ's Civil Cyber-Fraud Initiative. Recent settlements include Logzone ($507,144, June 2026) and MORSECORP ($4.6 million, 2025), both tied to inaccurate self-reported compliance.

Can I still get CMMC Level 2 (C3PAO) certified if I want to?

Existing Level 2 (C3PAO) certificates remain valid and satisfy lower designations under an "or higher" standard. Contractors should check with an authorized C3PAO regarding current certification availability during the suspension period.

Who decides whether CMMC Phase 2 resumes?

The CMMC Reform Task Force report goes to DoD CIO Kirsten Davies, who will decide whether to publish its findings. No outcome has been announced as of this writing, so contractors should monitor official DoD channels for updates.