CMMC Compliance for Maryland and DC-Area Contractors: Levels, Dates, and What It Takes

CMMC stopped being a future requirement on November 10, 2025. From that date, Department of Defense contracting officers can put the CMMC clause into new solicitations, and a contractor without the required self-assessment status in the government’s Supplier Performance Risk System is not eligible for award. The second stage, third-party certification, was due to start in November 2026 and has been suspended while the department reviews the program; the self-assessment requirements have not. For the Maryland and DC-area supply chain, which runs from Fort Meade and Aberdeen to the federal civilian agencies and the primes along I-270, this is a sales problem as much as a security problem. This article explains the levels, where the schedule stands, and what a small subcontractor actually has to do.

The three levels

Most small subcontractors in the region land at Level 1 or Level 2. The difference is whether CUI touches your systems: drawings, specifications, technical data, and anything marked CUI in a contract deliverable. If you are not sure, your prime’s contract will say, and you should ask them in writing.

Where the schedule stands (October 2026)

• Phase 1, in force since November 10, 2025: Level 1 self-assessment or Level 2 self-assessment, posted in SPRS with an annual affirmation, required at award where the clause is included. This has not changed.
• Phase 2, suspended: Level 2 third-party certification (C3PAO) was to be required at award from November 10, 2026. On July 13, 2026 the Department of War suspended Phase 2 and the Level 3 assessments pending a review of the program, and a class deviation of September 3, 2026 directs contracting officers to remove third-party assessment requirements from solicitations and contracts. No new date has been announced.
• Phases 3 and 4 (November 2027 and November 2028 in the original rule): certification for option exercises, Level 3, then full implementation. On hold with Phase 2 until the review concludes.

The practical consequence for a Level 2 subcontractor: the self-assessment you post in SPRS is the requirement today, it has to be true, and the 110 requirements behind it have not changed. Third-party certification will come back in some form, and the contractors who kept implementing will be the ones ready when a date is set. A conditional status with a plan of action and milestones is allowed in limited cases under the rule, with open items closed within 180 days.

What flows down to you

The clause flows down to every subcontractor that handles FCI or CUI, at the level the information requires. Primes cannot see your SPRS record, so they will ask you for evidence directly: your SPRS score and date, your affirmation, and in many cases your System Security Plan. Expect this in questionnaires before it appears in a contract. Several of the larger Maryland primes started asking in 2024.

What Level 2 actually takes for a 20-person business

NIST SP 800-171 has 110 requirements across 14 families. For a small business the heavy lifting falls into a handful of areas.

• Scoping. Decide where CUI lives and keep it there. An enclave (a defined set of systems, often a GCC High or equivalent cloud tenant plus managed endpoints) is far cheaper to certify than the whole company.
• Identity and access. Multi-factor authentication everywhere, named accounts, least privilege, and documented onboarding and offboarding.
• Endpoints. Managed, encrypted, patched devices with endpoint detection and response, and no personal devices touching CUI.
• Audit and accountability. Centralized logging that is retained and actually reviewed, which is where most self-assessments quietly fail.
• Configuration management. Baselines, change control, and an inventory that matches reality.
• Incident response. A tested plan, and the ability to report incidents to DoD within 72 hours under DFARS 252.204-7012.
• Documentation. The System Security Plan and the policies behind each control family. Assessors score the evidence, not the intent.

Realistically, a business starting from a typical small-office setup needs six to twelve months to reach assessment readiness, with the first three spent on scoping and documentation.

Where the Maryland context matters

Maryland’s Personal Information Protection Act runs alongside CMMC: it covers employee and customer personal information that NIST SP 800-171 does not, with its own 45-day notification clock. Businesses exporting defense articles or technical data also carry ITAR obligations, which constrain which cloud services and which staff can touch the data. And cyber insurers in the region now ask about the same controls; see cyber insurance IT requirements in Maryland.

How Corporate Technologies works with defense subcontractors

We support contractors across Maryland and the DC area from our Frederick office, with a 24/7 help desk and security operations center shared across our 21 locations. For CMMC work that means building and operating the enclave, deploying the controls, producing the evidence, and keeping it current between assessments. Our Secure Advantage package covers the monitoring, endpoint, MFA, and training requirements; scoping, documentation, and assessment support are scoped as a project. We are not a C3PAO and do not certify our own work; we prepare clients for the assessor. For the New Mexico version of this topic, see CMMC readiness for New Mexico contractors.

Frequently asked questions

We only handle FCI. Do we need a C3PAO?

No. Level 1 is an annual self-assessment against the 15 FAR requirements, posted in SPRS with an affirmation from a senior official. It still has to be true; a false affirmation is a False Claims Act exposure.

Can we use Microsoft 365 for CUI?

Commercial Microsoft 365 is generally not suitable for CUI, and never for ITAR data. GCC High or an equivalent government cloud is the usual answer, inside a defined enclave.

What is a SPRS score?

A self-reported score from minus 203 to 110 based on the NIST SP 800-171 assessment methodology, posted in the Supplier Performance Risk System. Primes look at it. A score that does not match what an assessor later finds is a problem.

Our prime says we must be certified by next year. Is that still the case?

Ask them which requirement they mean. Third-party certification is suspended as of July 2026 and cannot be required in a DoD contract until the department sets a new date. A Level 2 self-assessment with an SPRS score and affirmation can be required now, and many primes ask for it contractually regardless. If you start now and scope tightly, most small businesses can be assessment-ready within a year, which is where you want to be when certification returns.