CMMC Compliance

CMMC compliance is how the Department of Defense checks that its contractors protect government information. Level 1 covers federal contract information, with 15 basic requirements and a self-assessment every year. Level 2 covers controlled unclassified information (CUI), with the 110 requirements of NIST SP 800-171. Depending on the contract, Level 2 is either a self-assessment or a third-party assessment. Level 3, for the most sensitive programs, adds 24 requirements from NIST SP 800-172 and a government assessment. Contractors post their results in SPRS, the Department’s supplier risk system, and affirm them every year.

The timeline changed in 2026. Phase 1 began on November 10, 2025, so new contracts can require Level 1 or Level 2 self-assessments. Phase 2 would have added third-party Level 2 assessments from November 10, 2026. However, the Department suspended it on July 13, 2026 and opened a review of the program. Self-assessments still apply.

On Microsoft 365, the cloud you choose matters as soon as you hold CUI. Commercial Microsoft 365 is outside Microsoft’s DFARS commitments. Instead, Microsoft points defense contractors to its government clouds. GCC holds a FedRAMP Moderate authorization, and GCC High also covers the cloud provider clauses of DFARS 252.204-7012.

These guides take a small contractor through CMMC compliance in order. Start with the CMMC compliance checklist and the Level 2 requirements. Then work through the NIST 800-171 checklist, readiness on Microsoft 365, the audit and the cost. Each guide maps the requirements to the Microsoft 365 settings you already own.

Scroll to Top