NIST 800-171 vs CMMC: What Small Contractors Must Do Now

When the Pentagon paused the next phase of CMMC in July, it was easy to read the news as "CMMC is off, so there is nothing to do." That reading is wrong, and it could cost a small contractor its next award. The pause changed how the Department of Defense (DoD) checks your security. It did not change the security your contracts already ask for.

The rulebook and the referee

Think of NIST SP 800-171 as the rulebook. It is a National Institute of Standards and Technology publication that lists 110 requirements in 14 families, such as access control, incident response and media protection, for protecting Controlled Unclassified Information (CUI) on your own computers and cloud accounts.

Think of CMMC, the Cybersecurity Maturity Model Certification program, as the referee. It sets how DoD confirms you follow the rulebook:

• Level 1 is for companies that only hold Federal Contract Information (FCI). It covers the 15 basic safeguarding requirements in FAR 52.204-21.
• Level 2 is for companies that handle CUI. It covers the 110 requirements of NIST SP 800-171.
• Level 3 is for a small number of the most sensitive programs. It adds 24 requirements from NIST SP 800-172.

So "NIST 800-171 or CMMC?" is the wrong question. If you handle CUI, you need both: the controls, and proof that you have them.

What the July pause changed

On July 13, 2026, DoD suspended the requirements for CMMC Phase 2, which were due to start on November 10, 2026. Phase 2 is the step where many Level 2 contracts would have needed an assessment by a certified third-party assessor (a C3PAO) before award.

• While the pause lasts, solicitations can only ask for Level 1 or Level 2 self-assessments.
• DoD set up a CMMC Reform Task Force to review the program and report within 60 days, with a stated aim of lowering barriers for small businesses.
• As of this writing, DoD has not published that report or set a new date for Phase 2.

What did not change

DFARS 252.204-7012 still applies

If this clause is in your contract and you handle covered defense information, DFARS 252.204-7012 says you must:

• Protect that information with the NIST SP 800-171 requirements.
• Report cyber incidents to DoD within 72 hours of discovery. You need a DoD-approved medium assurance certificate to file a report, so get it before you need it.
• Keep images of affected systems, and related monitoring data, for at least 90 days after you report.
• Use cloud services that meet the FedRAMP Moderate baseline, or an equivalent, for that information.
• Put the same clause in subcontracts where it applies.

Your SPRS score still matters

Under DFARS 252.204-7019, to be considered for award you need a current NIST SP 800-171 DoD Assessment, no more than three years old unless the solicitation sets a shorter period, with its summary score posted in the Supplier Performance Risk System (SPRS). A perfect score is 110, and the record also shows the date you expect to reach 110.

Phase 1 self-assessments stay in place

DoD's own announcement says "All Phase I self-assessment requirements remain firmly in place." Phase 1 began on November 10, 2025. Where a contract includes the CMMC clause, DFARS 252.204-7021, keep your self-assessment current and your yearly affirmation up to date.

Honesty is checked

A score that claims more than you have done is a bigger risk than a low one. The Justice Department announced that Honeywell Aerospace agreed to pay $2,042,518 (September 1, 2026) and LOGZONE agreed to pay $507,144 (June 18, 2026) to resolve False Claims Act allegations tied to cybersecurity requirements. Settlements resolve allegations without a finding of liability, but the cost and the scrutiny are real.

Revision 2 or Revision 3?

NIST published SP 800-171 Revision 3 in May 2024, and it formally replaces Revision 2. DoD has not switched yet: its July 2026 announcement still names Revision 2 for DFARS 252.204-7012, and CMMC Level 2 is built on it. Separately, a FAR rule that would set one CUI standard across federal agencies, using Revision 3, was re-proposed on June 23, 2026 and is not final.

Our advice: build to Revision 2 today, and note where Revision 3 differs, so a later move is a small step rather than a rebuild.

What to do now: six steps for small contractors

1. Read your clauses

Look for FAR 52.204-21 and DFARS 252.204-7012, -7019, -7020 and -7021 in your contracts, subcontracts and the bids you are chasing. Together they tell you which rules apply and how you will be checked.

2. Find your CUI, then shrink its footprint

List every place FCI and CUI live: email, file shares, laptops, phones and cloud apps. The fewer systems that touch CUI, the fewer systems you have to secure and document.

3. Score yourself honestly

Assess all 110 requirements using the DoD Assessment Methodology, post the summary score in SPRS, and update it when your systems change, not only when the three years run out.

4. Write it down

Keep a System Security Plan (SSP) that says how each requirement is met, and a Plan of Action and Milestones (POA&M) for each gap, with an owner and a date.

5. Fix the basics first

Start with the controls that stop the most common attacks: multi-factor sign-in, prompt updates, encrypted laptops, tested backups and logs someone actually reviews.

6. Get ready to report

Get your medium assurance certificate now, and write down who does what in the first 72 hours after you find an incident.

If you would like help, our free assessment for contractors is a NIST 800-171 gap snapshot: we read your clauses, map where your CUI lives and show you the gaps to close first. For the full set of rules, see our government contractor IT setup guide and the CMMC 2.0 compliance checklist.

Frequently asked questions