CMMC 2.0: What Defense Contractors Need to Know in 2026

Start with contract and data obligations, not tools. If you handle only Federal Contract Information (FCI), CMMC Level 1 applies: the 15 basic safeguarding requirements in FAR 52.204-21, an annual self-assessment, and annual senior official affirmation. If you create, receive, store, process, or transmit Controlled Unclassified Information (CUI), plan around CMMC Level 2: the 110 requirements in NIST SP 800-171, a System Security Plan (SSP), evidence, annual affirmation, and either a self-assessment or a third-party C3PAO assessment depending on the solicitation. Level 3 applies to selected higher-risk programs and adds requirements from NIST SP 800-172 on top of Level 2, with a government assessment. The common mistake is treating CMMC as an IT project while contracts, engineering, operations, HR, legal, and subcontract management keep creating uncontrolled CUI paths. Your target level should be driven by clauses, CUI categories, prime contractor requirements, and bid strategy.

Assessors evaluate a defined environment, not intentions. Before mapping controls, document where CUI enters, where it is stored, who can access it, how it is transmitted, where it is backed up, and which vendors or subcontractors can touch it. Common weak points include CUI in personal OneDrive locations, engineering files synced to unmanaged laptops, Teams guest access without review, email forwarding to commercial accounts, SharePoint sites with inherited permissions, unmanaged CAD workstations, and remote support tools used by an MSP without appropriate contractual and security controls. A smaller controlled enclave is often cheaper and easier to assess than bringing the entire company into scope. For example, a contractor with 80 employees and 12 CUI users might isolate CUI in a Microsoft 365 Government environment, require managed and compliant endpoints, restrict external collaboration, and use a documented transfer process instead of trying to include every mailbox, file share, legacy workstation, and vendor workflow.

Microsoft 365 is not automatically CMMC-ready. Tenant choice matters when CUI is stored or transmitted in Exchange Online, SharePoint Online, OneDrive for Business, Teams, or related services. DFARS 252.204-7012 includes cloud-service requirements tied to the FedRAMP Moderate baseline, incident reporting, and evidence preservation. Microsoft 365 Government GCC, GCC High, and DoD environments are commonly evaluated for defense workloads; GCC High is often selected for export-controlled data, ITAR/EAR considerations, DoD IL4 expectations, or customer requirements for US-sovereign operational controls. Commercial Microsoft 365 may be appropriate for non-CUI workloads, but do not assume it satisfies CUI requirements without clause, data, and customer review. Tenant selection is only one decision. You still need implemented controls: phishing-resistant MFA where required or justified, Conditional Access, Microsoft Entra ID governance, Intune device compliance, Microsoft Defender for Endpoint, audit logging, retention, sensitivity labels, least privilege, privileged access procedures, backup and restore evidence, vulnerability management, and tested incident response. Premium licenses do not compensate for stale Global Administrator accounts, unmanaged local admins, disabled logs, weak external sharing, or undocumented exceptions.

A C3PAO assessment is not the time to discover that policies describe a future state. For Level 2, expect objective evidence that controls are implemented and operating in the assessed scope. The SSP must describe the real environment. The Plan of Action and Milestones (POA&M), if used, must be limited to gaps allowed under CMMC rules and include owners, dates, and closure evidence. Access reviews should show actual review activity. Vulnerability scans should connect to remediation tickets. Incident response should be exercised. Backups should have restore evidence. Training records should match the in-scope workforce. Configuration baselines should match deployed endpoints and services. Subcontractor processes should show flowdown, access limits, incident-reporting expectations, and evidence for suppliers that handle CUI. Senior official affirmation increases accountability: leadership is attesting that the organization implemented the controls as represented. If your SPRS score was calculated by one person without input from contracts, legal, operations, and system owners, rebuild it from current evidence.

Most contractors underestimate cost because they price the assessment and ignore remediation. Level 2 readiness costs vary with scope, Microsoft licensing, endpoint condition, identity maturity, documentation quality, evidence history, and whether migration to a Microsoft 365 Government tenant is required. C3PAO fees are only one part of the budget. Common remediation items include licensing changes, unsupported endpoint replacement, Intune rollout, Microsoft Defender for Endpoint deployment, log retention, vulnerability scanning, secure backup, SSP development, policy and procedure cleanup, incident response exercises, administrator model redesign, and subcontractor management. The highest-return move is usually scope reduction: standardize endpoints, remove unmanaged storage locations, restrict external sharing, tighten identity, and create repeatable evidence. Reducing the CUI boundary from dozens of users to a controlled group can cut licensing, migration, monitoring, and assessment complexity.

Use a sequence that avoids rework. First, confirm contract drivers: DFARS clauses, expected solicitations, prime contractor requirements, CUI categories, and whether Level 2 certification is likely required. Second, define the CUI boundary and decide whether to isolate it. Third, choose the Microsoft architecture for that boundary, including tenant type, Microsoft Entra ID design, endpoint management, logging, retention, and collaboration rules. Fourth, run an evidence-based gap assessment against NIST SP 800-171. Fifth, remediate high-risk failures: MFA gaps, unmanaged endpoints, excessive administrator rights, missing audit logs, weak incident response, uncontrolled external sharing, and undocumented subcontractor access. Sixth, build or update the SSP, POA&M, policies, procedures, and evidence repository. Seventh, run a mock assessment before scheduling the formal assessment. Do not pay a C3PAO to find gaps you could have found through readiness testing.