How CMMC 2.0 Affects Defense Contractors: What’s Actually Changed in 2026

CMMC 2.0 enforcement is live. The Final Rule took effect December 2024, and the acquisition rule requiring CMMC clauses in contracts took effect November 2025. Defense contractors handling CUI now face mandatory third-party C3PAO assessments starting November 2026. This isn't a framework you're preparing for — it's a requirement you're operating under.

CMMC 2.0 affects defense contractors by making cybersecurity certification a condition of DoD contract eligibility rather than a self-reported posture. Contractors handling Controlled Unclassified Information now face mandatory third-party C3PAO assessments beginning November 2026, with SPRS scores visible to contracting officers and prime contractors enforcing flow-down ahead of government deadlines.

In December 2025, Northrop Grumman notified its supply chain directly: CMMC requirements cannot be waived regardless of relationship history. Neither contracting officers nor prime contractors may deviate.

That notice wasn't unique. Lockheed Martin, Boeing, Raytheon, L3Harris, Elbit Systems of America, and Parsons Corporation sent similar notices to their supplier bases in 2025 and early 2026. Elbit's language was direct: their buyers will not issue purchase orders to suppliers who fail to meet contractual CMMC flow-down requirements.

The government deadline is November 2026. The primes moved earlier.

For defense contractors and subcontractors in Southern California's dense aerospace and defense supply chain, both clocks are running. Here's what changed, what it means for your business, and what you actually need to do.

See Consilien's full CMMC compliance program for Southern California defense contractors and manufacturers

What Changed — and When

Before CMMC, defense contractors self-attested compliance with NIST SP 800-171 under DFARS 252.204-7012, in effect since 2017. The problem was structural. The self-attestation model had no verification mechanism. A 2019 DoD Inspector General report found contractors routinely claimed compliance without implementing required controls. Nation-state actors — primarily from China and Russia — systematically exploited those gaps. Weapons system specifications, submarine warfare technology, fighter jet designs. All of it at risk because contractors checked boxes without enforcement.

CMMC changes the verification model. The controls themselves are largely the same — 110 NIST SP 800-171 requirements for Level 2 that contractors were already supposed to have. What's new is who confirms they're implemented.

The regulatory timeline that matters:

• October 15, 2024: 32 CFR Part 170 published — the CMMC Program Rule
• December 16, 2024: 32 CFR Part 170 took effect
• September 10, 2025: DFARS 252.204-7021 published — the acquisition rule inserting CMMC into contracts
• November 10, 2025: DFARS 252.204-7021 took effect — Phase 1 begins, CMMC clauses in new solicitations
• November 10, 2026: Phase 2 — mandatory C3PAO assessments for most Level 2 CUI contracts
• November 10, 2027: Phase 3 — C3PAO requirements expand to additional contract types

Phase 1 isn't a waiting period. DoD estimates approximately 65% of the Defense Industrial Base is affected during the first year, per OSIbeyond's Phase 1 analysis. Self-assessment requirements are in live solicitations now. SPRS scores are being reviewed by contracting officers today.

How CMMC Changes What Assessors Actually Verify

The most significant operational change isn't a new security control. It's the verification methodology.

Under DFARS 7012's self-attestation model, a contractor rated their own compliance and submitted a score to SPRS. Nobody checked. Under CMMC Level 2 with C3PAO assessment, the same controls are verified through three independent methods drawn from NIST SP 800-171A.

Examine — the assessor reviews every relevant policy, procedure, configuration record, and SSP entry against each control requirement. Documentation that doesn't match the real environment isn't a paperwork problem. It's a finding.

Interview — personnel named as control owners are asked to explain their role in implementing and maintaining each control. In their own words. Without coaching. A shop-floor supervisor asked about the procedure for handling a CUI-marked customer drawing when it comes off the printer needs an answer. If the procedure was written by an IT consultant who never visited the floor, the supervisor doesn't have one.

Test — the assessor verifies controls operate as documented in production. MFA enforced? Demonstrate it. Audit logs reviewed weekly? Produce the review record from three months ago.

Three methods. All 110 controls. 320 assessment objectives. A control that works but isn't documented fails Examine. A control that's documented but whose owner can't describe it fails Interview. A control that's documented and understood but not operating as described fails Test.

This is why Greenberg Traurig's October 2025 assessment analysis found 25% of contractors fail their C3PAO pre-assessment due to documentation failures, not technology gaps.

How CMMC Affects the Supply Chain at Every Tier

This is where most tier-2 and tier-3 suppliers make a costly assumption.

The prime's CMMC certification covers the prime's environment. Not yours.

Under 32 CFR § 170.23 and DFARS 252.204-7021, primes are legally required to flow CMMC obligations to every subcontractor at every tier that handles FCI or CUI. The prime is also responsible for verifying subcontractor compliance, which means primes face False Claims Act liability if their supply chain is non-compliant and they knowingly award work to uncertified subs when certification is required.

That pressure, not just regulatory but commercial is why enforcement started ahead of the government schedule. A StratoKey May 2026 analysis of prime contractor flow-down requirements documents exactly what each major prime is requiring now.

A tier-3 machining shop in Gardena that receives controlled drawings from a tier-2 supplier serving Northrop Grumman is in scope for CMMC Level 2. The absence of CMMC language in the purchase order doesn't change that if CUI actually flows.

What CMMC Means for Manufacturers Specifically

Standard CMMC guidance was written for office environments. It doesn't reflect how CUI actually moves through a production facility. For aerospace metal finishing shops, precision machining operations, electronics manufacturers, and special-process suppliers in Southern California, three dynamics make CMMC more complex than most content acknowledges.

CUI lives in physical environments. Job travelers with customer specifications are CUI. Controlled drawings posted near a NADCAP chemical processing line are CUI. Inspection records that excerpt dimensions from controlled drawings inherit the marking. The Physical Protection family in NIST SP 800-171 governs all of this, and most IT-led CMMC programs never address physical CUI handling at all.

Shop-floor OT needs its own treatment. CNC controllers, coordinate measuring machine software, heat-treat monitoring systems, and other operational technology often runs on legacy operating systems that can't be patched under standard IT protocols. The Cyber AB scoping guidance provides a Specialized Asset category for exactly this equipment. Properly classifying these systems limits the controls that apply and prevents the over-scoping that drives unnecessary remediation cost.

AS9100 and NADCAP accreditation is an advantage, not a distraction. The document control, internal audit, corrective action, supplier management, and training disciplines in AS9100D map directly to CMMC management controls. Organizations with mature quality management systems don't rebuild those disciplines for CMMC. They extend them. Quality Magazine's January 2026 analysis of the AS9100-CMMC overlap confirmed that manufacturers treating CMMC as a cybersecurity extension of AS9100 move faster and produce more defensible documentation than those treating it as a separate IT initiative.

Our CMMC for aerospace manufacturers approach is built on this integration principle.

The False Claims Act Dimension Most Contractors Miss

CMMC compliance isn't just a contract eligibility issue. It's a legal exposure issue for the individuals who sign the attestations.

SPRS scores are legal representations of compliance posture submitted to the federal government. Under the DoJ's Civil Cyber-Fraud Initiative, launched specifically to pursue cybersecurity misrepresentation under the False Claims Act, submitting an inaccurate SPRS score creates treble damages exposure. The DoJ settled seven cybersecurity-related FCA cases in 2025 alone. One April 2025 settlement involved a defense contractor paying $4.6 million to resolve allegations of a false SPRS score. A September 2025 settlement with a university research institution involved $875,000 over a false SPRS score and failure to implement required controls.

The affirming official, the senior company official who signs the annual affirmation carries personal liability. That isn't a distant risk. It's why getting the gap assessment right and producing a defensible SPRS score matters well beyond the compliance checklist.

What's Required Before You Can Bid

The practical consequence of the acquisition rule that took effect November 10, 2025, is straightforward: if a solicitation requires CMMC, you must hold the required certification before contract award. Promising future compliance doesn't work. Conditional certification with an accepted POA&M can qualify in some cases, but the assessment must have happened.

For most CUI contracts, that means:

• A documented gap assessment with an accurate SPRS score
• A current, accurate System Security Plan reflecting the real environment
• An evidence collection program producing dated, verifiable artifacts
• A completed C3PAO assessment, or at minimum a scheduled assessment date on the calendar

Industry data from dtctoday.com's April 2026 CMMC preparation guide puts it plainly: fewer than 1% of affected contractors are fully prepared. For a contractor who isn't in that 1%, the question isn't whether CMMC will affect their ability to win work. It's when.

What You Should Do Right Now

If you haven't started: The CMMC gap assessment is the first move. Walk all 110 controls against the real environment. Produce a documented SPRS score. Know your actual starting position before making any other decision, platform selection, remediation sequencing, documentation scope, C3PAO scheduling all depend on that number being accurate.

If you're mid-preparation: Verify that your SSP reflects the current environment, not a snapshot from 18 months ago. CMMC requires a current, accurate SSP at assessment time. An SSP authored once and never touched again fails the basic currency test. Also verify that your evidence collection cadence is running long enough to cover the historical sampling window an assessor will request.

If you're approaching your assessment window: Book the C3PAO slot now if you haven't. Scheduling runs 6 to 9 months out, with projections suggesting 18 months or more by Q3 2026 as Phase 2 demand accelerates. Run a full mock assessment before the C3PAO arrives. Prepare the personnel named as control owners for the Interview phase — this is where otherwise ready organizations lose ground. Our C3PAO assessment preparation services handle this final stage.

Our Take

What CMMC actually changed is accountability. The controls were always required. The enforcement wasn't.

The contractors who navigate this well aren't necessarily the ones with the best cybersecurity programs. They're the ones who got their documentation right, built evidence collection into normal operations, and ran a mock assessment before the real one. The technical controls are usually already there. The paper trail is what makes them provable.

For Southern California defense contractors, manufacturers, and supply chain suppliers, the window to get ahead of Phase 2 is closing. The primes are already enforcing. C3PAO slots are filling. The contractors who move now avoid competing for the last assessment dates in a backlogged market.

Consilien works with manufacturers and defense contractors across Los Angeles, Orange County, the Inland Empire, and San Diego on the full CMMC compliance path — from gap assessment through C3PAO readiness. Schedule a scoping call to start with an honest picture of where you stand.