What Is CMMC Compliance? Compliant vs Certified
By Shaheer Malik · Updated Oct 28, 2026
CMMC compliance means meeting every security requirement of the CMMC level your contract requires, holding the matching CMMC status in SPRS, and affirming it every year. “Certified” is narrower: only Level 2 (C3PAO) and Level 3 (DIBCAC) come from an outside assessment and a Certificate of CMMC Status; Level 1 and Level 2 (Self) are self-assessments.[1]
Compliant, self-assessed or certified
| Status | How you get it | Certificate? |
|---|---|---|
| Level 1 (Self) | Annual self-assessment against 15 requirements, entered in SPRS | No |
| Level 2 (Self) | Self-assessment against 110 requirements every three years | No |
| Level 2 (C3PAO) | Assessment by an authorized or accredited C3PAO | Yes |
| Level 3 (DIBCAC) | Assessment by DCMA DIBCAC | Yes |
Every status also needs an affirmation by your Affirming Official, “the senior level representative” with authority to affirm continuing compliance, after the assessment and annually.[1]
No product is “CMMC compliant”
CMMC statuses belong to an organization’s information systems inside a defined assessment scope, not to software or cloud services.[1] A vendor can help you meet requirements, and a cloud provider that stores your CUI must meet the FedRAMP Moderate requirement in DFARS 252.204-7012,[3] but the status is always yours. See which common tools can hold CUI.
What the requirements are
- Level 1: the 15 basic safeguarding requirements of FAR 52.204-21.[1] Listed in full in CMMC Level 1 requirements.
- Level 2: the 110 requirements of NIST SP 800-171 Rev. 2.[1][4]
- Level 3: Level 2 plus 24 requirements selected from NIST SP 800-172.[1]
How to become compliant
- Find out which information you handle: FCI only, or CUI too. That sets the level (see which level do I need).
- Define the assessment scope: the people, systems, facilities and providers that touch it.[1]
- Close the gaps and document them in a System Security Plan.
- Assess (yourself or with a C3PAO), post the result in SPRS and affirm.[1]
- Keep it current: affirm every year and reassess on schedule.
Since September 3, 2026 contracts may require Level 1 (Self) or Level 2 (Self) in place of third-party certification, but the NIST SP 800-171 baseline still applies.[2] Step-by-step: how to get CMMC certified.
Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.
FAQ
What is the difference between CMMC compliant and CMMC certified?
Compliant means you meet the requirements of your level and hold the matching status in SPRS. Certified means an outside assessor (a C3PAO for Level 2, DCMA DIBCAC for Level 3) assessed you and issued a Certificate of CMMC Status.
Can software or a cloud service be CMMC compliant?
No. CMMC statuses apply to an organization’s information systems. Tools can help you meet requirements; a cloud provider holding CUI must meet FedRAMP Moderate or equivalent under DFARS 252.204-7012.
How often do I need to confirm CMMC compliance?
Every year, through an affirmation in SPRS. Level 1 is also reassessed every year; Level 2 and Level 3 every three years.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (checked Oct 28, 2026)
- NIST SP 800-171 Revision 2: Protecting Controlled Unclassified Information in Nonfederal Systems (checked Oct 22, 2026)
More on cmmc basics
- CMMC Timeline: Phases, Dates and the Phase 2 Suspension
- What Is CMMC Certification? Levels, Costs and Who Needs It
- What Is CMMC? What It Stands For and How It Works
- CMMC 2.0 Explained: What Changed and When It Applies
- Who Needs CMMC Certification? Primes, Subs and Suppliers
- Is CMMC Going Away? The Phase 2 Pause Explained
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.