Who Needs CMMC Certification? Primes, Subs and Suppliers

By Shaheer Malik · Updated Oct 28, 2026

CMMC applies to every DoD prime contractor and subcontractor, at any tier, that will process, store or transmit Federal Contract Information or Controlled Unclassified Information on its own information systems while performing a DoD contract that includes a CMMC requirement. Companies that only sell commercially available off-the-shelf (COTS) items are excluded.^[1]

What triggers it

The rule applies to DoD solicitations and contracts “pursuant to which a defense contractor or subcontractor will process, store, or transmit FCI or CUI on unclassified contractor information systems,” including commercial items, “except those exclusively for COTS items,” valued above the micro-purchase threshold.^[1] The program office picks the level based on the information involved.^[1]

Subcontractors

Primes must flow CMMC requirements down to subcontractors at all tiers that handle FCI or CUI:^[1]

Who it does not cover

• Contracts exclusively for COTS items, and awards at or below the micro-purchase threshold.^[1]
• Federal information systems that contractors operate on behalf of the government.^[1]
• Companies that never handle FCI or CUI in performing the contract.

Foreign suppliers and service providers

The applicability rule turns on the information handled, not where the company is based; nothing in 32 CFR 170.3 exempts suppliers outside the United States.^[1] IT and security providers that handle your CUI or security data are External Service Providers and fall inside your assessment scope (see CMMC for MSPs).^[1]

Is it required right now?

Only when your contract includes it. Since September 3, 2026, contracts may require Level 1 (Self) or Level 2 (Self), third-party certification is suspended, and DFARS 252.204-7012 with NIST SP 800-171 Rev. 2 still applies to anyone handling CUI.^[2] If you are unsure what you handle, read FCI vs CUI and which level do I need.

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

Does CMMC apply to subcontractors?

Yes, at every tier that will handle FCI or CUI. A sub handling only FCI needs Level 1 (Self); a sub handling CUI needs at least Level 2 (Self), or Level 2 (C3PAO) when the prime contract requires C3PAO or Level 3.

Does CMMC apply to all DoD contractors?

No. It applies to contracts that include a CMMC requirement and involve FCI or CUI on contractor systems. Contracts solely for COTS items and micro-purchases are excluded.

Do foreign companies need CMMC?

The rule has no exemption based on where a company is located. If a foreign supplier will handle FCI or CUI under a DoD contract or subcontract with a CMMC requirement, it applies.

Do MSPs need CMMC certification?

If an MSP processes, stores or transmits a client’s CUI or security protection data, it is an External Service Provider and its services are assessed as part of the client’s CMMC assessment.

Sources

1. 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
2. Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)

More on cmmc basics

• CMMC Timeline: Phases, Dates and the Phase 2 Suspension
• What Is CMMC Certification? Levels, Costs and Who Needs It
• What Is CMMC? What It Stands For and How It Works
• What Is CMMC Compliance? Compliant vs Certified
• CMMC 2.0 Explained: What Changed and When It Applies
• Is CMMC Going Away? The Phase 2 Pause Explained