“We have never bid on a federal contract, so this does not apply to us.” I hear some version of that sentence often, and it is one of the most expensive misunderstandings a business in the defense supply chain can hold onto right now. The Cybersecurity Maturity Model Certification, known as CMMC, is no longer a future policy or a problem reserved for the big prime contractors. As of late 2025 it became an enforceable requirement, and the way it reaches small businesses is the part most people miss.
This matters a great deal here in the CSRA. With Fort Gordon, Army Cyber Command, and the cybersecurity ecosystem built around them, a large number of local companies are connected to defense work, often as a subcontractor a few steps removed from the actual government contract. If that describes your business, CMMC may already apply to you, even if you have never spoken to a contracting officer in your life.
What CMMC 2.0 actually is
Strip away the acronyms and CMMC is a verification layer. For years, defense contractors that handled sensitive government information were required to follow a security standard called NIST SP 800-171, and they confirmed compliance by self-attesting, essentially signing a form that said they were doing it. The government found, repeatedly, that the form and the reality did not always match. CMMC closes that gap by requiring proof instead of a promise.
The legal machinery is now in place. The CMMC program rule took effect in December 2024, and the acquisition rule that writes CMMC into actual contracts, through a clause called DFARS 252.204-7021, took effect on November 10, 2025. In plain terms, that is the date CMMC stopped being a proposal and became a contract requirement the Department of Defense can hold you to.
The word that changes everything: flow-down
Here is the correction for everyone who assumed this was a prime contractor problem. CMMC requirements flow down. A prime contractor that wins a defense contract is required to pass the relevant cybersecurity requirements down to the subcontractors who will handle the sensitive information, and those subcontractors pass it down again. You do not need a direct contract with the government for CMMC to apply to you. What determines whether it applies, and at what level, is a simple question: does your business store, process, or transmit the government’s information?
If you handle what is called Federal Contract Information, the most basic category, you fall under the foundational level. If you handle the more sensitive Controlled Unclassified Information, you fall under the advanced level. The prime contractor decides what information you will touch, and therefore what level flows down to you. This is precisely why so many small businesses were caught off guard. They were looking at the size of their company, when the only thing that mattered was the type of data crossing their systems.
The three levels, in plain English
CMMC has three levels, and the one you need depends entirely on the information you handle.
- Level 1, Foundational. Required for businesses that handle Federal Contract Information. It covers 15 basic security requirements and is confirmed through an annual self-assessment.
- Level 2, Advanced. Required for businesses that handle Controlled Unclassified Information. It aligns with all 110 security controls in NIST SP 800-171, and most companies at this level must pass an assessment by a certified third party, called a C3PAO, every three years.
- Level 3, Expert. Reserved for the most sensitive programs. It includes everything in Level 2 plus an additional set of controls from NIST SP 800-172, and the assessments are conducted by the government.
For most small and midsize subcontractors, the realistic question is whether you land at Level 1 or Level 2, and the jump between them is significant.
The timeline you are actually on
The rollout is phased, and the phasing is what lulls people into waiting. Since November 2025, self-assessment requirements have been appearing in new defense solicitations. Beginning November 10, 2026, the requirement for third-party Level 2 certification starts showing up as a condition of award for contracts involving Controlled Unclassified Information. That sounds far away until you account for two things. First, prime contractors are not waiting for the government’s calendar; many are already asking their subcontractors for proof of CMMC readiness now, to protect their own eligibility. Second, the supply of certified assessors is limited. The Department of Defense estimates that roughly 80,000 contractors will need Level 2, and reaching certification typically takes 6 to 12 months. Waiting until a contract demands it almost guarantees you will not be ready in time.
What it costs to ignore this, and what it costs to do it
The cost of certification is real, and I am not going to pretend otherwise. For a small to midsize business, reaching Level 2, including a gap assessment, the technical fixes, and the third-party assessment itself, can run from roughly $63,000 to well over $200,000 across the first three years. That is a serious number. But weigh it against the alternative. Without the required certification on record, you become ineligible for the award, which means losing the contract and any renewals tied to it. There is also a sharper risk: signing an affirmation of compliance that is not accurate can expose your business to liability under the federal False Claims Act, a category of legal and financial trouble no small business wants to invite.
Where to start this quarter
You do not have to solve all of this at once, but you do need to start, and the first steps are not expensive.
- Audit your contracts and pipeline. Identify which of your current and upcoming agreements involve Federal Contract Information and which involve Controlled Unclassified Information. This single step tells you which level you are facing.
- Determine your level and scope. Map exactly which of your systems touch that information, because everything inside that boundary is what gets assessed, and shrinking the boundary lowers the cost.
- Run a gap assessment against NIST SP 800-171. This shows you the distance between where you are today and where you need to be.
- Build your documentation. You will need a System Security Plan and a Plan of Action and Milestones, and your status has to be posted in the government’s reporting system.
- Engage early. If you will need a third-party assessment, get in line now, because assessor availability is the bottleneck that timelines cannot wait out.
For the defense supply chain in the CSRA
The businesses around Augusta that are connected to defense work have a real advantage if they move now and a real exposure if they wait. CMMC is not going to relax, and the contracts that require it are already being written. Treating compliance as a technical project to start this year, rather than a fire to fight next year, is the difference between staying in the supply chain and quietly aging out of it.
If you are not sure which level applies to your business, or where your current security posture stands against the requirements, that is exactly the assessment we help companies work through at Alchanis Technical Services. You can learn more at alchanistech.com.
Legal disclaimer
This article is for general educational purposes and reflects the state of the CMMC program as of June 2026. It is not legal advice. CMMC obligations are determined by your specific contracts and the information you handle, and the program continues to evolve. Confirm your requirements against official Department of Defense sources and consult qualified legal counsel and an accredited assessor before making compliance decisions.
