CMMC Is Now Part of Winning Defense Work: Here's Where to Start

If you sell to the Department of War, CMMC is already part of how you win work. In a recent review of 87 open DoW opportunities on SAM.gov, 68 (nearly 4 in 5) named a required CMMC level: 43 at Level 1 and 25 at Level 2. They span the whole department, from DLA spare-parts buys and Navy test equipment to Army Corps of Engineers dam repairs. Ask yourself whether you'd be eligible to bid on them today. 

Why CMMC matters now 

CMMC is a condition of award. When a solicitation names a level, you need to post a current status at that level in the Supplier Performance Risk System (SPRS) before award. Without it, you can't receive the award, no matter how strong your price or past performance. 

• Level 1 applies when you handle Federal Contract Information (FCI), the everyday non-public information that comes with almost any contract. It means 15 basic safeguards and an annual self-assessment. 
• Level 2 applies when you handle Controlled Unclassified Information (CUI), such as technical drawings and data packages. It means the 110 controls in NIST SP 800-171. Many buyers won't release CUI drawings until you show Level 2 status, so you can't even prepare a quote without it. 
• Requirements flow down. Primes must make sure their subcontractors and suppliers meet the level for the information they handle, so small suppliers feel this too. 

You may have heard that CMMC is "paused." In July 2026, DoW suspended Phase II. Phase II would have required third-party Level 2 assessments. Despite this pause, Phase I is still in effect: Level 1 and Level 2 self-assessments still appear in solicitations, and the underlying rules, DFARS 252.204-7012, NIST SP 800-171 and FAR 52.204-21, haven't changed. As one DoW official told Federal News Network, the controls "are in place and that certainly hasn't changed." Waiting out the review only puts you behind competitors who are already compliant. 

Where to start: help is available 

You don't have to figure out CMMC alone: 

• Washington APEX Accelerator (APEX). APEX Accelerators help businesses compete for government contracts, and their counseling is provided at no-cost. In Washington, the Washington APEX Accelerator at Economic Alliance Snohomish County offers one-on-one advising to help you figure out which level applies to you, register in SPRS and read the CMMC language in a solicitation. 
• Project Spectrum. DoW's Project Spectrum offers free cybersecurity training, training videos on the Level 1 and Level 2 controls, and a Cyber Readiness Check that measures where you stand against CMMC Level 1, Level 2 and NIST SP 800-171. It's a good, no-cost first step before you start a self-assessment. 
• The CMMC Level 1 Cohort restarts in January 2027. This small-group workshop series takes you through the full Level 1 self-assessment: scoping your requirements, building your System Security Plan, and reporting your results in SPRS. Each session includes live Q&A with APEX Accelerator facilitators. Seats are limited, so reserve yours early:  
• CMMC Roundtable on November 19. Bring your questions about the Phase II suspension, flow-down requirements and what to expect next, and hear from other contractors working through the same issues. The January Cohort launches on January 8, 2027 with Q&A sessions on 1/15, 1/22 & 1/29. 

Take the first step this month 

Plan on several months to build and carry out a Level 1 plan, and longer for Level 2. Companies that start now will be ready when the right solicitation drops. Register to become a client with Washington APEX Accelerator HERE.