What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is the Department of War program that verifies defense contractors protect two kinds of government information: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The type of information you handle, and where it flows in your business, decides your CMMC level and what you have to do.
Every video here was recorded at CMMC-PNW with assessors, contracting officers, primes, and practitioners. Browse the 2026 sessions or the 2025 sessions.
Read this before you start
How Level 1 and Level 2 relate
A common first assumption is that Level 2 is Level 1 plus more controls, stacked on the same systems. In most cases it isn't. Each level is scoped around where its own type of data lives and flows, so the two boundaries are usually different.
Illustration only. Your boundaries follow your own FCI and CUI flows.
Scope each level separately. Level 1 covers the people, systems, and places that handle FCI. Level 2 covers only where CUI is stored, processed, or transmitted. Map both data flows before you decide anything else.
If you have Level 2 requirements, you almost always have Level 1 requirements too. Most companies that handle CUI also handle FCI on other systems.
Level 1 is a good place to start. It's widely considered basic cyber hygiene, and working through it shows you what the whole program involves.
Level 2 is a big step up. It follows the full NIST SP 800-171 standard, needs a System Security Plan and evidence for every requirement, and a self-assessment or third-party (C3PAO) assessment.*
- Protects
- Federal Contract Information (FCI)
- Scope
- Wherever FCI is handled
- Requirements
- Basic safeguarding in FAR 52.204-21
- Assessment
- Annual self-assessment
- Affirmation
- Annually in SPRS
- Protects
- Controlled Unclassified Information (CUI)
- Scope
- Wherever CUI is stored, processed, or transmitted
- Requirements
- NIST SP 800-171
- Assessment
- Self-assessment or third-party (C3PAO)*
- Affirmation
- Annually in SPRS
* CMMC Phase 2 implementation is currently under review. See Implementing the Suspension of CMMC Phase II (DoW, July 2026).
Go deeper: Level 1 Scoping Guide · Level 2 Scoping Guide
Session libraries
Every recorded session, by year
Prefer YouTube? Subscribe to the CMMC-PNW channel · Sponsor spotlights are on the Solution Providers page.
Not knowing much coming into this, she made it all come together for me.
Official sources · checked September 28, 2026
The official CMMC documents you'll actually use
Start with these. The full list of official CMMC resources is organized by what you're trying to do.
Updated on July 13, 2026 to reflect the Phase 2 suspension. Official answers to the most common program questions.
See all FAQ versions
| Edition | Cover reads | DoW change log | What changed | File |
|---|---|---|---|---|
| July 2026 CURRENT | Revision 2.3 (Excerpt) | 2.4 · Jul 13, 2026 | Updated to reflect the suspension of the program in Phase 1 | FAQsv6.pdf · DoW original |
| May 2026 | Revision 2.3 | 2.3 · Apr 29, 2026 | Micro-learning video links, new CAICO contacts, new Section F (Scoping), 3 new FAQs | FAQsv5.pdf |
| January 2026 | Revision 2.2 | 2.2 · Jan 5, 2026 | Three new FAQs (C-Q10, C-Q11, C-Q12) | FAQsv4.pdf |
| November 2025 | Revision 2.1 | 2.1 · Nov 17, 2025 | Four new FAQs (B-Q8, C-Q8, E-Q2, E-Q7) | FAQsv3.pdf |
| September 2025 | Revision 2 | 2 · Sep 25, 2025 | Major overhaul for the 48 CFR Part 204 effective date | FAQsv2.pdf |
| October 2024 | Initial release | 1 · Oct 14, 2024 | Initial release | FAQsv1.pdf |
The DoW names each file FAQsv1 to FAQsv6, and the revision number printed on the cover does not always match the change log. The July 2026 file's cover reads "Revision 2.3 (Excerpt)", while its change log lists that update as 2.4. We list both so you can match whichever number you see cited.
The official memo behind the July 2026 pause.
The Cyber AB accredits C3PAOs and assessors and runs the CMMC Marketplace. The Cyber EF, its nonprofit subsidiary, handles training and outreach. CMMC events across the US
Used togetherYou sign in to SPRS through PIEE, then enter your assessment results and annual affirmation. Contracting officers check SPRS before award.
Used togetherThe official home for every CMMC guide, template, and brief.
CMMC basics · checked September 28, 2026
Common CMMC questions, answered briefly
What is the difference between FCI and CUI?
Federal Contract Information (FCI) is information provided by or generated for the government under a contract that isn't intended for public release. Controlled Unclassified Information (CUI) is a narrower, more sensitive category the government marks or identifies for protection, such as controlled technical drawings. FCI points to Level 1. CUI points to Level 2.
Does Level 2 build on top of Level 1?
Not in the way most people expect. Each level is scoped around where its own data lives, so a company's Level 1 and Level 2 boundaries are usually different. If you have Level 2 requirements, you typically also have Level 1 requirements for the systems that handle FCI. See the explainer.
What are the CMMC levels?
Level 1 covers FCI and is an annual self-assessment of basic safeguarding. Level 2 covers CUI and follows NIST SP 800-171; depending on the contract it is a self-assessment or a C3PAO assessment. Level 3 adds NIST SP 800-172 requirements and is assessed by the government (DIBCAC). Most small contractors deal with Level 1, Level 2, or both.
Is CMMC still required after the July 2026 Phase 2 pause?
According to the CMMC-PNW 2026 keynote panel, yes: the pause stopped the Phase 2 rollout, not the contract clauses that already require you to protect FCI and CUI. See the DoW suspension memo.
What are SPRS and PIEE?
The Supplier Performance Risk System (SPRS) is where contractors record CMMC results and affirmations, and where contracting officers look you up before award. You reach SPRS by signing in through PIEE, the DoD's Procurement Integrated Enterprise Environment.
What is a C3PAO?
A CMMC Third-Party Assessment Organization, authorized by The Cyber AB, that performs Level 2 certification assessments.
How long does CMMC take?
It depends mostly on scope. Speakers at CMMC-PNW described first-time Level 2 builds of about three months with experienced help and six months or more without.
Stay current
Who to follow for CMMC news
CMMC changes often. These are the people, offices, and channels that post the updates first, on LinkedIn and YouTube.
Eric Crusius
Koren Wise
Jacob HorneFree and low-cost help
Help for Washington contractors
Washington APEX Accelerator
washingtonapex.org →Impact Washington (NIST MEP)
impactwashington.org →Project Spectrum
projectspectrum.io →Who puts this on
CMMC-PNW is hosted by Team Cavalry
CMMC-PNW and this resource hub are produced by three Kitsap County companies that work with defense contractors every day. The education here is vendor-neutral. If you want help, here is who does what.
Managed IT and security for on-prem and hybrid environments, including the day-to-day operation of CMMC controls.
helpdeskcavalry.com →
CMMC Level 1 and Level 2 readiness, the CMMC Level 1 Clinic, and SSP and evidence management.
compliancecavalry.com →
The Cavalry Enclave: a cloud CUI enclave that keeps CUI, and your Level 2 scope, contained.
securitycavalry.com →Get new sessions and CMMC-PNW 2027 news
Hear when new session videos go up and when CMMC-PNW 2027 registration opens.