FAQ.

01Frequently Asked Questions

• Q1Does CMMC apply to me?

  Only if a contract puts it there. CMMC reaches you through a specific DFARS clause or provision — 252.204-7012, -7020, -7021, or -7025, plus -7019 on older solicitations — not through a general sense that you handle sensitive information. Start Here lists the exact signals and what each one may indicate.

  DFARS 252.204-7012, -7019, -7020, -7021, -7025

• Q2Which level will my contracts require?

  That’s a fact about your contract, not a choice you make. It comes from the solicitation, the clauses written into your contract, and — if you’re a subcontractor — what a prime flows down to you. FCI-only work points toward Level 1; CUI points toward Level 2 or 3. The Levels has the full breakdown; The Data explains what separates FCI from CUI.

• Q3What’s the COTS exemption?

  Contracts exclusively for commercial-off-the-shelf items are the one exemption the rule names directly. It only covers that specific contract — not any other work the company does. Glossary has the full definition.

  32 CFR 170.3(c); FAR 2.101

• Q4I’m a sub of a sub — does this reach me?

  Flow-down requirements reach subcontractors at every tier that touch the same FCI or CUI, not just the first one below the prime. The specific level a given subcontractor needs comes from the contract with the party directly above it, not from guessing what the prime originally signed.

  DFARS 252.204-7020 (flow-down)

• Q5What does it cost?

  This desk doesn’t publish a cost figure of its own — scope, current security maturity, and level change the number too much for a single answer to be honest. DoD’s own regulatory analysis for the rule estimates roughly $5,977 a year in assessment-and-affirmation cost for a small entity at Level 1, and roughly $37,196 over three years at Level 2 (Self) or $104,670 over three years at Level 2 (C3PAO). Those figures cover the assessment and affirmation only — not the cost of building the security practices being assessed.

  DoD Initial Regulatory Flexibility Analysis, CMMC 2.0 (32 CFR part 170; RIN 0790-AL49)

• Q6Enclave or whole company?

  Either can work; it’s a scoping trade-off, not a rule requirement. An enclave shrinks the assessment boundary at the cost of operational friction — CUI has to actually stay inside it. A whole-company scope avoids that friction but assesses everything. Scope & Boundary walks through the trade-off.

• Q7Self or C3PAO?

  Your contract decides, not you. The rule’s default is Level 2 (Self); DoD can require Level 2 (C3PAO) instead where a specific solicitation calls for it. Check the actual clause and status requirement in front of you rather than assuming.

  32 CFR 170.3(e)(1)

• Q8How long does this take?

  This desk doesn’t publish a duration estimate either, for the same reason it doesn’t publish a cost figure — how long depends on where an organization starts. What’s fixed by rule is the cycle once you’re in it: an assessment is valid three years, affirmations renew it annually, and a Conditional status closes out — or expires — within 180 days.

  32 CFR 170.16(a)(1); 170.17(a)(1); 170.21(b)

• Q9What happens during the assessment?

  The Assessment covers this end to end — scope validation, evidence review by examine, interview, and test, a finding on every requirement, and results filed through eMASS into SPRS for a certification assessment.

• Q10What if I’m not at 110?

  Not automatically disqualifying. A score of at least 88 of 110, with the open gaps limited to 1-point items (plus one named exception) and none of six specific requirements, produces Conditional status instead of Final — usable for contract award, on a 180-day clock to close out. Evidence, SSP & POA&M has the full mechanics.

  32 CFR 170.21(a)(2)

• Q11When do the clauses actually hit my contract?

  When your contract is awarded or re-competed after the relevant phase begins — CMMC doesn’t retroactively attach to a contract already running, except for option periods exercised after Phase 4. The System has the phase calendar.

  32 CFR 170.3(e)

• Q12Where do I check my status?

  SPRS. That’s the system a contracting officer actually checks, regardless of whether your assessment was self-performed or filed through eMASS by a C3PAO or DIBCAC — eMASS results transmit to SPRS automatically. Glossary covers how the two systems relate. SPRS, explained covers the workflow itself.

  32 CFR 170.4; 170.16; 170.17

02Sources