As of January 2026DoD CMMC
Detailed Answer
CMMC requirements:
**When CMMC Is Required:**
- Contracts involving CUI (Controlled Unclassified Information)
- Will be specified in solicitation
- Phased implementation through 2028
**When CMMC Is NOT Required:**
- Commercial item contracts (typically)
- Contracts with only public information
- Below certain dollar thresholds
- Non-DoD federal contracts
**CMMC Levels:**
- Level 1: Basic safeguarding (17 practices)
- Level 2: CUI protection (110 practices)
- Level 3: Advanced (subset of NIST 800-172)
**Implementation Timeline:**
- Phased rollout starting 2025
- Not all contracts immediately
- Check solicitation requirements
- Plan ahead for certification
Want the full picture?
This answer is part of our comprehensive guide on this topic.
Read Full Guide: CMMC Certification: Roadmap to Compliance