This article explains what a CMMC audit is, who needs one, and how the assessment process works under CMMC.
It also covers what changed when the Department of War suspended the Phase 2 third-party certification deadline on July 13, 2026, and how to keep your compliance program ready for whatever comes out of the resulting review.
Why it matters: CMMC audits now determine which contractors can bid on new DoD contracts, and certified assessor wait times are already running months long.
Key Takeaways
- A CMMC audit verifies your NIST 800-171 controls: Most contractors self-assess at Level 1; Level 2 requires a certified third-party (C3PAO) assessment for most CUI-handling contractors. That third-party mandate is currently paused pending a DoW review, but self-assessment is still required today.
- Preparation determines whether you pass: Run a gap analysis against your required CMMC level, document your policies and controls, and treat your SSP and POA&M as living artifacts — not a one-time audit-prep exercise.
- Costpoint builds in audit-ready controls: Deltek Costpoint GCCM supports DFARS 7012 and CMMC with built-in audit trails, and DCAA-ready reports that cut audit prep time.
Organizations that store, process, or handle Controlled Unclassified Information (CUI) for the DoD must comply with the Cybersecurity Maturity Model Certification (CMMC) program.
CMMC is now live: the program final rule took effect in December 2024, and the DFARS contract rule took effect in November 2025. CMMC requirements began appearing in new DoD contracts, RFPs, and RFIs in early 2026.
Most contractors are currently in Phase 1, which relies on self-assessment. Phase 2, which would have made a certified third-party (C3PAO) assessment mandatory for most CMMC Level 2 contractors starting November 10, 2026, was suspended on July 13, 2026, pending a Department of War review.
What is a CMMC Audit?
A CMMC audit is a formal assessment of an organization's cybersecurity controls against the Cybersecurity Maturity Model Certification (CMMC) framework, conducted by a Certified Third-Party Assessment Organization (C3PAO). For contractors seeking a Level 3 assessment, the government conducts those assessments following successful completion of Level 1 and Level 2 certifications.
The DoD created CMMC to make sure Controlled Unclassified Information (CUI) is protected consistently across the Defense Industrial Base (DIB).
Contractors that will be creating or handling controlled unclassified information from the DoD (Department of War) must demonstrate the required CMMC level in their contract(s), self-assessed or third-party assessed, depending on the level, as a condition of contract award.
The audit itself, known as a CMMC assessment, evaluates how an organization's controls successfully meet the NIST SP 800-171 assessment objectives and requirements (for Level 2 C3PAO certification) and NIST SP 800-172 assessment objectives and requirements for CMMC Level 3 certification.
Guide
Get Your CMMC Readiness Guide
See what changed in CMMC, what Phase 2 means for your contracts, and how to close compliance gaps before your audit.
CMMC Phase 2 Suspended: What This Means for Your Audit Timeline
On July 13, 2026, the Department of War's Chief Information Officer suspended the rollout of CMMC Phase 2 and launched a 60-day review of the program, per a memo from CIO Kirsten Davies and Under Secretary of War for Acquisition and Sustainment Michael Duffey. The November 10, 2026 target for mandatory C3PAO third-party assessments has been paused.
Program offices can now only require CMMC Level 1 (Self) or Level 2 (Self) certification assessments in new solicitations. CMMC Level 2 (C3PAO) and Level 3 (DIBCAC) requirements cannot be added during the review, and contracts that already carry them are being amended to remove those requirements.
What hasn't changed: The requirements of DFARS 252.204-7012, and FAR 52.204-21 remain fully in force. A CMMC Reform Task Force is running the 60-day review, informed by a public Request for Information and the DoD's last comparable program review, in 2021, took roughly nine months to produce what is commonly known as CMMC.
Self-assessment now carries more weight and risk for government contractors. Attesting to NIST SP 800-171 compliance in the Supplier Performance Risk System is a representation the government can rely on, and a false attestation carries False Claims Act exposure. Creating more direct liability than failing to successfully pass a third-party assessment, since the company itself is making the claim. For a full breakdown of what changed and what didn't, see Deltek's coverage: Suspended, Not Eliminated: Why the CMMC Rollout Pause Does Not Mean Stop.
The case for staying the course held even before the suspension. In a 2026 Deltek webinar, The GovCon Security, Compliance, and AI Intersection: Trends and Insights, Deltek's Michael Greenman and former DoD CIO Katie Arrington — one of the architects behind CMMC — noted that CMMC has become a competitive differentiator that flows down from primes to subs regardless of what's mandated on paper: 59% of contractors expect CMMC to apply to their business in 2026, and more than three-quarters of that group were already planning a third-party assessment this year.
CMMC Levels
CMMC streamlines requirements into three levels of cybersecurity maturity and aligns those requirements at each level with NIST cybersecurity standards.
Level 1
Level 1 requires an annual self-assessment — no third-party audit.
Organizations need to demonstrate basic cyber hygiene across 17 practices that represent the basic safeguarding requirements under FAR 52.204-21. It allows suppliers to self-attest to their compliance through annual self-assessments.
Level 2
Does CMMC Level 2 require an audit? For most contractors handling CUI, yes, a C3PAO assessment is required. Organizations that handle a narrower subset of less sensitive CUI may still be permitted to self-assess.
Organizations need to demonstrate they have implemented the requirements of NIST SP 800-171, the same controls that were already required under the preexisting DFARS 252.204-7012 clause since 2017. This includes 110 practices along with the CMMC Level 1 requirements.
The DoD applies two different approaches to compliance, depending on the type of data processed, stored, or handled. Organizations that handle critical national security information must undergo an audit by a C3PAO. In contrast, contractors who handle a subset of CUI that is not critical to national security may still perform a self-assessment.
Level 3
Organizations will need to demonstrate compliance with a subset of NIST SP 800-172, which provides the foundation and controls for a defense-in-depth protection approach. These additional practices must be complied with along with the CMMC Level 1 and Level 2 requirements. Organizations will be required to undergo a government-led assessment or audit every three years.
CMMC Assessment Cadence at a Glance
- Level 1: Annual self-assessment; no third-party audit required, but a company officer must attest to the accuracy of the attestation and is liable for false information.
- Level 2: Self-assessment today; a C3PAO assessment every three years once Phase 2 (or its successor) resumes, depending on contractual requirements. As of July 13, 2026, the Phase 2 third-party assessment requirement is currently suspended pending the DoW's CMMC review.
- Level 3: Government-led assessment every three years.
Who Needs CMMC Certification?
The following types of organizations need CMMC certification:
- Defense Contractors: Any organization that seeks to bid on DoD contracts, including prime contractors and subcontractors, needs a CMMC certification at the level specified in the contract.
- Suppliers and Service Providers: Organizations that provide goods or services to DoD contractors and handle CUI may also be subject to CMMC assessments or audits. This includes various tiers of suppliers and service providers in the defense supply chain.
- Subcontractors: Subcontractors working on projects for prime contractors that involve DoD CUI or have flow-down clauses.
Sixty-six percent of contractors report that CMMC compliance is required for subcontractors on their DoD contracts — underscoring how far the flow-down requirement now reaches.
It's important to note that CMMC assessments are specific to organizations that are part of the defense industrial base and interact with the DoD. The level of CMMC compliance required depends on the nature of the organization's work, the type of information it handles, and its role in the defense supply chain.
The CMMC Assessment Process: A Closer Look
In short, an organization prepares and self-assesses, hires a C3PAO, undergoes document and on-site review, and then receives a certification decision based on the assessment report.
The audit process to date involves the following key stages:
- Preparation: Organizations Seeking Certification (OSCs) must undertake thorough preparations, including identifying the specific CMMC level required for their contracts and conducting a self-assessment against the relevant practices and processes.
- Selection of C3PAO: Organizations must engage a certified third-party assessor organization (C3PAO) to perform the audit. The C3PAO is responsible for conducting an in-depth evaluation of the company's cybersecurity practices.
- Document review: During the audit, the C3PAO reviews the organization's documentation, policies, and procedures related to cybersecurity. This step is crucial in assessing the maturity of the company's cybersecurity controls.
- On-site assessment: Depending on the CMMC level being pursued, the on-site assessment may involve interviews with personnel, examination of technical systems, and a review of physical security measures. This step aims to verify the implementation and effectiveness of the cybersecurity practices.
- Assessment report: Following the assessment, the C3PAO prepares a comprehensive report detailing the organization's adherence to the CMMC requirements, identifying strengths, weaknesses, and areas for improvement.
- Certification: Based on the assessment report, the C3PAO awards the organization a CMMC certification at the appropriate level if it meets the required criteria. This certification is essential for bidding on DoD contracts that stipulate a specific CMMC level.
According to the 2026 Deltek Clarity GovCon Report, audit activity across government contractors doubled from 2024 to 2025, with firms now averaging 26 audits a year across financial, cybersecurity, quality, contract, and information security domains — including an average of five cybersecurity audits, a number likely to climb further once Level 2 third-party assessments resume, whenever the DoW's CMMC review concludes.
Are There CMMC Assessors?
Yes. C3PAOs and certified individual assessors are actively conducting CMMC assessments today. The CMMC program involves a comprehensive audit process to assess and certify the cybersecurity levels of organizations seeking CMMC certification.
The involvement of certified auditors and assessment organizations in the CMMC process is essential to maintain the integrity and credibility of the certification program. Their role ensures that organizations within the DoD supply chain meet the required cybersecurity standards and are adequately prepared to handle cyber threats.
Who Conducts the CMMC Assessment?
- CMMC Certified Assessors: CMMC assessors are qualified individuals or organizations authorized by the CMMC-AB to evaluate and assess organizations against the CMMC framework. They conduct on-site or remote assessments to determine if an organization meets the required cybersecurity practices and processes for certification.
- Certified Third-Party Assessment Organizations: C3PAOs are organizations authorized by the Cybersecurity Maturity Model Certification Accreditation Body (Cyber AB) to perform official CMMC assessments. They employ CMMC assessors and are responsible for conducting the assessments and issuing CMMC certifications to organizations that meet the requirements.
Who Trains and Manages the CMMC Assessors?
The Cyber AB is the official accreditation body for the CMMC program — the sole authorized non-governmental partner of the DoD overseeing the training, accreditation, and certification of CMMC assessors and C3PAOs, under a direct contract with the CMMC Program Management Officer (PMO).
The Information Systems Audit and Control Association (ISACA) serves as the official CMMC Assessor and Instructor Certification Organization (CAICO), managing training, examinations, and professional certifications for the US Department of War's Cybersecurity Maturity Model Certification (CMMC) program.
How Much Does a CMMC Assessment Cost?
CMMC compliance costs vary by level and organization size, and they're rising.
According to the 2026 Deltek Clarity GovCon Report, 46% of contractors report CMMC compliance costs to date between $100,000 and $249,999.
Looking ahead, 32% expect costs between $250,000 and $499,999 over the next three years, and 37% expect costs to top $500,000.
The top cost drivers for compliance costs are infrastructure upgrades, new cybersecurity tooling, staff training, and continuous monitoring. These are considered recurring investments rather than a one-time assessment fee and, therefore, should not be considered as part of the cost of a CMMC assessment.
What Happens If You Fail a CMMC Assessment?
A failed or deficient CMMC assessment doesn't necessarily end a contract opportunity immediately, but it does trigger consequences.
Depending on the level, organizations may be able to use a Plan of Action and Milestones (POA&M) to close minor gaps within a set time frame. Unresolved deficiencies can mean lost certification and contract ineligibility until the gaps are fixed.
"Companies should be aware that the C3PAO ecosystem is not yet prepared to handle the number of late-adopters. Unlike CMMC 1.0, the Pentagon is not identifying pathfinder contracts so companies are playing with fire if they expect their contracts will not be impacted by CMMC in the near term. While the PMO must approve the inclusion of CMMC in new contracts through November 2028, existing contracts can be modified (bilaterally) by the contracting officer. Contractors who do not agree to a bilateral modification may find their contract terminated for convenience."
— Eric Crusius, Partner, Hunter Andrews Kurth LLP
2026 Deltek Clarity GovCon Report
What is the Difference Between CMMC and NIST 800-171?
CMMC is the assessment and certification program for DoD contractual cybersecurity requirements. CMMC now appears in contracts as DFARS clause 252.204-7021.
NIST SP 800-171 is the framework of cybersecurity controls that are required to be implemented by DoD contractors through the DFARS 252.204-7012 clause, which has been around since 2017. Defense contractors do not implement CMMC. They are required to implement the NIST SP 800-171 controls, and the CMMC program is the assessment program that verifies whether those controls have been implemented.
Tips to Prepare for a CMMC Assessment
Preparing for a CMMC assessment is crucial to ensure your organization's compliance with the required security standards. The CMMC program is designed to verify the cybersecurity posture of the entire defense supply chain.
Here are some tips and best practices to help you prepare for a CMMC assessment:
- Understand CMMC requirements: You are responsible for your own compliance and awareness of program details.
- Run a gap analysis: Compare your current security posture against the CMMC level you need and document exactly where you fall short before you invest in fixes.
- Documentation and policies: Ensure you have comprehensive documentation of your cybersecurity policies, procedures, and practices. This includes security plans, incident response plans, risk assessments, and other relevant documentation. Make sure all documentation is well-organized and easily accessible for auditors. Develop and test an effective incident response plan that outlines how your organization will handle and mitigate cybersecurity incidents.
- Employee training: Train your employees on cybersecurity best practices and their roles in maintaining a secure environment. Human error is a common cause of security breaches.
- Network security & access control: Implement network security measures such as firewalls, intrusion detection/prevention (IDP) systems, and monitoring. Implement strong access controls to ensure that only authorized individuals have access to sensitive systems and data. This includes user authentication, authorization, and least privilege principles.
- Data encryption: Implement encryption for sensitive data both at rest and in transit. This helps protect data from unauthorized access.
- Vendor management: If you work with third-party vendors or contractors, ensure they also adhere to the requirements of CMMC. Their compliance will impact yours.
- Engage external experts: Consider hiring external cybersecurity experts to perform pre-audit assessments and provide guidance on achieving and maintaining compliance.
- Run a mock assessment: Simulate the C3PAO's on-site assessment internally, or through a pre-assessment with a third-party consultant, to close gaps before your official CMMC audit.
CMMC compliance doesn't end at the assessment. Most levels require continuous monitoring and annual affirmations after certification, so treat post-audit upkeep as seriously as the initial assessment to avoid slipping into non-compliance.
CMMC compliance is an ongoing process, and maintaining a strong cybersecurity posture is recommended to ensure the security of your organization's data and systems.
"Treat compliance as a capability, not a cost center. There's tons of data to back this up, whether it's CMMC, some other cybersecurity requirement, or just protecting your own intellectual property. That IP is the value of your business, and the ones that get that are going to be not only well-positioned for this opportunity, but that's where the puck is going, as they say. The gap between firms that are doing this and firms that aren't is widening."
— Michael Greenman, Sr. Product Marketing Manager, Deltek
How Costpoint Supports CMMC Assessment Readiness
Meeting CMMC requirements is supported by financial and project systems that are audit-ready by design. Deltek Costpoint GCCM meets FedRAMP Moderate Equivalency per DoD policy and supports DFARS 7012 and CMMC requirements, with built-in audit trails and DCAA-ready reports that reduce audit prep time.
"CMMC compliance is very much a priority for us because we are a Department of Defense contractor. It is of the utmost importance that we maintain all of our information to the top, most secure level. And Deltek has really helped with that because of their innovation and their forecasting of the compliance needs that are coming up in the future."
— Samantha Presser, HR Specialist, SURVICE
Frequently Asked Questions About CMMC Assessments
A CMMC assessment is a formal review of an organization's cybersecurity controls against the Cybersecurity Maturity Model Certification (CMMC) framework. It's typically conducted by a Certified Third-Party Assessment Organization (C3PAO), though some lower-risk contractors can self-assess. The audit determines whether a defense contractor meets the security requirements tied to its DoD contracts.
C3PAOs and CMMC-certified individual assessors conduct most CMMC audits. For CMMC Level 3, the government conducts the assessment directly. The Cyber AB accredits and oversees the C3PAOs that perform these audits.
Compliance costs to prepare for and achieve CMMC certification vary widely by level and organization size. According to the 2026 Deltek Clarity GovCon Report, 46% of contractors report costs to date between $100,000 and $249,999, and over a third expect costs to top $500,000 within three years as requirements mature.
That third-party requirement is currently suspended. As of July 2026, the DoW has paused the Phase 2 mandate that would have required most Level 2 contractors handling CUI to pass a C3PAO assessment starting November 10, 2026, pending a 60-day program review. Self-assessment against NIST SP 800-171 is still required today, and a C3PAO assessment is expected to become mandatory again for most Level 2 contractors once the review concludes.
A failed assessment can trigger a Plan of Action and Milestones (POA&M) to close gaps within a set time frame, depending on the level. Unresolved deficiencies can mean lost certification or contract ineligibility until the gaps are fixed.
It depends on the level. Level 1 requires an annual self-assessment, Level 2 typically requires a C3PAO assessment every three years (or annual self-assessment for less sensitive CUI), and Level 3 requires a government-led assessment every three years.
Guide
Get Your CMMC Readiness Guide
See what changed in CMMC, what Phase 2 means for your contracts, and how to close compliance gaps before your audit.
