CMMC 2.0 Explained: What Changed and When It Applies

By Shaheer Malik · Updated Oct 28, 2026

CMMC 2.0 is the name for the revised CMMC program DoD announced in November 2021. It cut the model from five levels to three, uses only NIST standards, and lets companies self-assess at Level 1 and some at Level 2. It became final as 32 CFR part 170, effective December 16, 2024, and has been written into DoD contracts since November 10, 2025.^[1]^[2]

CMMC 1.0 vs 2.0

CMMC first came in through a DFARS interim rule effective November 30, 2020, with a five-year phase-in. DoD received about 750 public comments, started an internal review in March 2021, and announced the revised program in November 2021.^[1] The rule lists the key changes:^[1]

Streamlining the model from five levels to three.
Exclusively implementing NIST cybersecurity standards and guidelines.
Allowing all companies subject to Level 1, and a subset of those subject to Level 2, to show compliance through self-assessments.
More oversight of the professional and ethical standards of third-party assessors.
Allowing Plans of Action and Milestones (POA&Ms) under limited circumstances.

That is why searches for “CMMC Level 4” or “Level 5” find nothing current: those levels were removed.

Is CMMC 2.0 final?

Yes. The program rule (32 CFR part 170) was published October 15, 2024 and took effect December 16, 2024; the DFARS acquisition rule took effect November 10, 2025.^[1]^[2] DoD now simply calls it the CMMC Program.

Is CMMC 2.0 required now?

Only where a contract includes it. Phase 1 (self-assessments) applies; the Phase 2 requirement for C3PAO certification was suspended in July 2026, and a September 3, 2026 class deviation lets contracts require Level 1 (Self) or Level 2 (Self) while keeping NIST SP 800-171 Rev. 2 under DFARS 252.204-7012.^[3] See the CMMC timeline.

Does CMMC 2.0 use NIST SP 800-171 Revision 3?

No. The rule incorporates Revision 2, and the September 2026 deviation restates the Rev. 2 baseline.^[4]^[3] NIST published Revision 3 in May 2024.^[5] Federal News Network reports that the CMMC reform task force recommended finalizing the move to Revision 3; DoD has not done so.^[6] More in CMMC vs NIST SP 800-171.

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

When was CMMC 2.0 announced?

In November 2021, after an internal review of the original program that began in March 2021.

When did CMMC 2.0 take effect?

The program rule, 32 CFR part 170, took effect December 16, 2024. The DFARS rule that puts CMMC into contracts took effect November 10, 2025.

What happened to CMMC Levels 4 and 5?

They were removed. The revised program announced in November 2021 streamlined the model from five levels to three.

Is CMMC 2.0 the same as CMMC?

Yes. “CMMC 2.0” was the announcement name for the revised program; today it is simply the CMMC Program under 32 CFR part 170.

Sources

Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)
DFARS: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041), 90 FR 43560 (Sep 10, 2025) (checked Oct 16, 2026)
Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)
32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
NIST SP 800-171 Revision 3 (May 2024) (checked Oct 28, 2026)
Federal News Network: RFI offers path forward for DoD with CMMC (Jason Miller, Oct 27, 2026) (checked Oct 28, 2026)

Get quotes from matching firms

Describe what you need once. It goes to up to 3 matching firms, never published or sold.

Request quotes

Independent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.