Quick answer: CMMC requirements depend on the information you handle and the applicable contract. The original five-level explanation is obsolete. Check the official program’s current implementation status and your solicitation before choosing an assessment path.
CMMC: replace the old five-level model with current requirements
The original article described an earlier CMMC design. Its five levels, blanket statement that self-assessments would end, 90-day remediation claim, and projected 2025 full rollout are no longer reliable guidance.
As reviewed on October 19, 2026, the official program page says Phase II implementation was suspended on July 13, 2026 and the program is paused in Phase 1. Contractors should verify current official updates and the requirements in their solicitation or contract before committing to an assessment path.
Start with the information and contract
Determine which Federal Contract Information or Controlled Unclassified Information your organization handles, where it is stored or transmitted, and which systems and providers support it. Confirm the required scope, assessment method, and affirmations with the contracting authority.
Prepare evidence that reflects daily practice
Maintain clear control ownership, documented procedures, operating evidence, and a prioritized remediation plan. Readiness work should improve how the scoped environment is managed, rather than produce documentation that does not match operations.
Use the current official CMMC resources for program status and assessment details. A general blog cannot establish the obligations for a particular procurement.
Practical next steps
- Identify Federal Contract Information and Controlled Unclassified Information and where they flow.
- Confirm the required assessment and affirmation obligations with the contracting authority.
- Document scope, controls, evidence, and remediation owners; review current official implementation updates.
Frequently asked questions
Does the old five-level CMMC model still apply?
No. The program changed substantially after the original article. Use current official program guidance and contract requirements.
Must every contractor obtain the same third-party certification?
No. Assessment requirements depend on the applicable program rules and contract. Verify current implementation status and the specific requirement.
Further reading: Official guidance and reference
