CMMC 2.0 is no longer a future event. Phase 1 became enforceable on November 10, 2025, when the Department of Defense published the 48 CFR Final Rule. New DoD solicitations can now require CMMC compliance as a condition of award — and Phase 2, which mandates third-party C3PAO certification for Level 2 contractors handling Controlled Unclassified Information, takes effect November 10, 2026.
If you manage IT for any business in the defense supply chain — prime contractors, subcontractors, or anyone whose work touches Federal Contract Information or CUI — your clients are already affected. The question for your MSP is not whether CMMC matters. It is whether you are positioned to help your clients respond to it, or whether they are about to find an MSP that is.
This article is for MSPs serving the Defense Industrial Base. It covers what CMMC actually requires, what the enforcement timeline means operationally for your clients, and what you need to deliver to be a credible security partner rather than a bystander during a compliance scramble.
What CMMC 2.0 Actually Is (and What It Replaced)
CMMC 2.0 is the DoD’s mechanism for verifying that defense contractors have actually implemented the cybersecurity practices they are required to have under existing federal acquisition regulations — specifically DFARS 252.204-7012, which has required contractors to meet NIST SP 800-171 since 2017. The problem CMMC is solving is that self-attestation under the old model was widely ignored. The DoD estimates that a significant portion of the Defense Industrial Base is not in compliance with NIST 800-171 requirements they have technically been obligated to meet for nearly a decade.
CMMC 2.0 simplified the original five-level CMMC 1.0 framework into three levels and aligned more directly with existing NIST standards. The three levels work as follows.
Level 1 (Foundational) applies to contractors handling only Federal Contract Information — basic administrative or logistical data. It requires annual self-assessment and affirmation of compliance with 15 practices drawn from FAR clause 52.204-21. This is the floor, not the ceiling, and it is already in effect under Phase 1.
Level 2 (Advanced) applies to contractors handling Controlled Unclassified Information. It requires compliance with all 110 security requirements in NIST SP 800-171 Revision 2. Under Phase 1, some Level 2 contracts allow self-assessment with SPRS submission and annual executive affirmation. Beginning November 10, 2026, most Level 2 contracts will require third-party certification by a C3PAO — a Certified Third-Party Assessment Organization. Contractors who have not started preparing now face a readiness window measured in months, not years.
Level 3 (Expert) applies to contractors on the highest-priority DoD programs handling the most sensitive CUI. It requires compliance with NIST SP 800-172 in addition to all Level 2 requirements and will be assessed by the Defense Industrial Base Cybersecurity Assessment Center. Level 3 requirements begin appearing in contracts under Phase 3, which starts November 10, 2027.
The Enforcement Timeline MSPs Need to Track
The phased rollout does not mean contractors can wait. The DoD has made clear that Phase 1 requirements apply to new solicitations issued after November 10, 2025, and that prime contractors are already pushing Level 2 requirements down to subcontractors even before the Phase 2 mandatory date. A subcontractor who does not have an active SPRS submission and a documented compliance posture is already at risk of being excluded from bids under primes who are enforcing the requirement early.
The Department of Justice has also made the stakes explicit. The Civil Cyber Fraud Initiative, using the False Claims Act as its enforcement tool, resulted in more than $52 million in cybersecurity-related recoveries in 2025 alone — a more than threefold increase from the prior year. Contractors who falsely attest compliance in SPRS without the supporting controls in place face potential civil and criminal liability that goes beyond losing a contract. That context should inform every client conversation you have about why this is not a checkbox exercise.
The practical window for your clients is narrower than the calendar suggests. Achieving Level 2 readiness — implementing 110 NIST 800-171 controls, documenting a System Security Plan, completing a Plan of Action and Milestones for any gaps, and passing a C3PAO assessment — typically requires six to twelve months of focused work for organizations that are starting with a meaningful gap. Most DIB contractors are. Accorian’s 2026 readiness analysis found that roughly 1% of contractors are currently considered audit-ready. Your clients are almost certainly in that other 99%.
Framework Checkbox Talk vs. Practice-Level Readiness
The most common mistake MSPs make when approaching CMMC is treating it as a documentation project rather than an operational security project. It is tempting to point a client at a framework checklist, have them self-attest the controls they believe they have in place, and call that CMMC readiness. That approach has two serious problems.
The first problem is that self-attestation without evidence is a False Claims Act risk, not a compliance posture. What the DoD and C3PAO assessors are looking for is not a signed document saying a control is in place. They are looking for evidence — configurations, logs, policies, audit records, and technical proof — that demonstrates the control is actually implemented and operating as intended. For each of the 110 Level 2 practices, a contractor typically needs two distinct pieces of evidence. The gap between “we have a policy that says we do this” and “here is the technical evidence that we actually do this” is where most clients are exposed.
The second problem is that generic framework presence is not the same as practice-level alignment. CMMC practices are specific. Access Control practice AC.L2-3.1.2, for example, requires limiting system access to the types of transactions and functions authorized users are permitted to execute — not just having a general access control policy. Each practice maps to specific technical implementations that can be verified. An MSP who tells a client they are “NIST-aligned” because they have endpoint protection and a firewall is not giving them accurate compliance information. They are setting them up for a failed assessment and potential legal exposure.
Practice-level readiness means your client can demonstrate, for each applicable CMMC practice, what control is in place, how it is implemented technically, and what evidence exists to prove it. That is a fundamentally different engagement than filling out a checklist.
What You Actually Need to Deliver as an MSP
For MSPs serving DIB clients, CMMC readiness breaks into four operational components. Understanding what each requires will tell you whether your current tooling and process can support a defensible engagement.
Vulnerability scanning and external exposure monitoring. The technical baseline. You need to know what is on the network, what is exposed, and what is unpatched. This is the starting condition for any gap analysis. Without continuous scanning, you are working from a snapshot that is outdated the moment you take it. CMMC practices under the Risk Assessment and System and Communications Protection domains require ongoing assessment, not annual reviews.
Control gap mapping against specific CMMC practices. This is where the real work is. A gap analysis maps what your client currently has implemented against what each CMMC practice requires, identifies the delta, and produces a prioritized remediation list. The output is not a color-coded spreadsheet. It is a structured System Security Plan and a Plan of Action and Milestones that a C3PAO assessor can review. If your tooling cannot map scan findings and configuration data directly to specific CMMC practices at the control level, you are building that mapping manually — and manual is slow, inconsistent, and hard to maintain as the environment changes.
Remediation prioritization and evidence generation. Once the gaps are mapped, remediation needs to be prioritized by risk and by what C3PAO assessors are most likely to scrutinize. Not every gap carries the same weight. Gaps in access control, configuration management, and audit and accountability tend to receive the closest scrutiny in Level 2 assessments. Your remediation plan needs to sequence the work in a way that gets the highest-risk gaps closed before the assessment window, while generating audit artifacts — logs, configuration records, access control documentation — that serve as evidence during the assessment itself.
Client communication and ongoing compliance posture. CMMC is not a one-time assessment. Level 2 certification under Phase 2 requires annual executive affirmation and periodic reassessment. The System Security Plan and POA&M need to be living documents. Changes to the client’s system — new cloud services, personnel changes, software additions — can affect the scope of the CMMC assessment and need to be tracked. Your client communication around compliance needs to be structured enough that the client understands what changed, why it matters, and what action is required.
Why CMMC Is a Sharp Entry Point Into Broader Security Services
Beyond the compliance obligation itself, CMMC creates a durable service opportunity for MSPs who get in front of it. Here is why it is a particularly good entry point compared to other compliance frameworks.
The urgency is externally imposed. You do not have to convince a client that security matters in the abstract. The DoD is creating the urgency for you. A client who stands to lose contract eligibility because their SPRS submission is missing or their gap assessment has never been done is already motivated. The conversation starts from a concrete business risk, not a hypothetical one.
The scope expands naturally. A client who engages you for CMMC readiness work quickly discovers that the same controls that matter for CMMC — access control, audit logging, configuration management, incident response — are the same controls that matter for cyber insurance, HIPAA if they have any health-adjacent data, and basic IT hygiene. The CMMC engagement surfaces gaps that open conversations about ongoing security monitoring, dark web credential monitoring, and recurring compliance reviews. The initial engagement funds the entry; the recurring practice funds the growth.
The evidence standard creates recurring demand. Unlike compliance frameworks where a client can check a box and move on, CMMC evidence requirements create ongoing work. Annual executive affirmations require up-to-date SSPs. C3PAO assessments require current evidence. Configuration changes require documentation updates. That is recurring billable engagement attached to a regulatory requirement that is not going away.
The competitive window is open now. Because most MSPs have not yet built a structured CMMC practice, there is a meaningful first-mover advantage in most regional markets. A defense-sector MSP case study from partners working with the Sentinel platform found that delivering structured CMMC readiness assessments with control gap mapping and remediation prioritization — rather than generic security reviews — directly improved client retention and created referral pathways within the defense contractor community. Compliance circles are small and word travels fast.
→ See how Sentinel’s CMMC depth compares to typical platform approaches, including the difference between framework presence and practice-level alignment.
What to Do Now If You Have DIB Clients
The practical starting point is knowing where your clients actually stand. Not where you think they stand, and not where they think they stand — where the evidence shows they stand against the 110 NIST 800-171 controls that map to CMMC Level 2.
The first step is identifying which of your clients handle CUI and which handle only FCI. That determines whether they need Level 1 self-assessment or Level 2 preparation. Some clients will not know the answer without your help, because the distinction requires them to understand what data flows through their systems in the context of their DoD contracts.
The second step is running a structured gap assessment — not a self-reported questionnaire, but a technical assessment that maps their actual configuration and control state against CMMC practices. The output should be a documented gap list with remediation priority and an estimate of what closing each gap requires in time and resources.
The third step is having a direct conversation with your client about the Phase 2 timeline. November 10, 2026 is not far from here. For a client who has never had a formal assessment, six months of remediation work before the Phase 2 deadline means starting now. That conversation should be grounded in specifics — which controls are open, what is required to close them, and what the cost of inaction is in terms of contract eligibility.
If you want to see how the Sentinel platform maps findings to specific CMMC practices — not just framework presence, but practice-level control alignment with evidence generation — book a 30-minute demo. We will walk through the compliance workflow with your client base in mind and show you what a structured CMMC readiness engagement looks like from the MSP side.
Frequently Asked Questions
What is the difference between CMMC Level 1 and Level 2 for an MSP’s clients?
Level 1 applies to contractors handling only Federal Contract Information — basic data related to a government contract, such as administrative records or logistics information. It requires annual self-assessment against 15 baseline practices. Level 2 applies to contractors who handle Controlled Unclassified Information — more sensitive data related to DoD programs, research, or technology. It requires compliance with all 110 practices in NIST SP 800-171 and, starting November 2026 under Phase 2, third-party certification by a C3PAO. The practical difference for an MSP is the depth of evidence, documentation, and technical control required. Level 2 is a materially more demanding engagement than Level 1.
My client says they have already been “NIST-compliant” for years. Does that mean they are CMMC ready?
Not necessarily, and in many cases not at all. NIST SP 800-171 compliance has technically been required since 2017 under DFARS 252.204-7012, and the DoD’s own estimates suggest that the majority of the DIB has not fully implemented it. A client who has checked boxes on a self-assessment without technical verification of the underlying controls is not CMMC-ready — they are exposed to both assessment failure and False Claims Act liability if they have attested compliance in SPRS without supporting evidence. The right response is a technical gap assessment, not a self-report review.
What is SPRS and why does it matter?
SPRS stands for Supplier Performance Risk System. Under Phase 1, Level 1 and Level 2 contractors must submit their self-assessment scores and executive affirmations to SPRS as a pre-award condition for new DoD contracts. Contracting officers check SPRS submissions before awarding contracts. A missing or outdated SPRS entry can disqualify a contractor from a bid entirely, regardless of their actual security posture. Helping your clients understand what SPRS requires and keeping their submissions current is a direct, tangible service you can offer as part of a CMMC readiness engagement.
Do subcontractors have to comply with CMMC, or only prime contractors?
CMMC requirements flow down through the supply chain. If a subcontractor receives, processes, or stores CUI as part of their work on a defense contract, they are subject to the same CMMC requirements as the prime contractor. The DFARS rule includes explicit flowdown clauses requiring primes to pass CMMC obligations down to subcontractors handling applicable data. In practice, major primes like Lockheed Martin and Boeing are already requiring Level 2 compliance from subcontractors even before the Phase 2 mandatory date. Your clients who are subcontractors should not assume they have more time than the prime they work under is giving them.
How long does it realistically take to prepare a client for a C3PAO assessment?
For a client starting with significant gaps — which most DIB contractors have — six to twelve months is the realistic preparation window for Level 2 C3PAO readiness. That time covers technical remediation, documentation of controls in a System Security Plan, closure or mitigation of items on the Plan of Action and Milestones, and a pre-assessment readiness review. Clients who wait until late 2026 to start will not be assessment-ready by the Phase 2 deadline. The cost of that delay is not just a failed assessment — it is potential loss of contract eligibility while they work through remediation.
Can I offer CMMC readiness services without being a C3PAO myself?
Yes. MSPs are not required to be C3PAOs to deliver CMMC readiness services. The C3PAO performs the formal certification assessment — that is a distinct and regulated function. Your role as an MSP is to help the client get ready for the assessment: gap analysis, remediation implementation, evidence generation, SSP documentation, and ongoing compliance maintenance. That is a substantial and valuable engagement in its own right, and it positions you as the trusted partner who knows the client’s environment when assessment time arrives. Some MSPs also partner with C3PAOs to manage the formal assessment piece while retaining the ongoing security relationship.