Atch 4 - CMMC-FAQsv4

OFFICE OF THE CHIEF INFORMATION OFFICER

U.S. DEPARTMENT OF WAR (DoW OR DEPARTMENT)

January 2026

CYBERSECURITY

MATURITY MODEL

CERTIFICATION

PROGRAM FREQUENTLY

ASKED QUESTIONS

Revision 2.2

CLEARED

For Open Publication
Dec 19, 2025
Department of Defense

OFFICE OF PREPUBLICATION AND SECURITY REVIEW

A-Q1. When will Cybersecurity Maturity Model Certification (CMMC) A-Q3. What resources are available to assist companies in complying with A-Q4. Who is the point of contact for general inquiries regarding the CMMC B-Q1. How will my organization know what CMMC level is required for a B-Q2. What is the relationship between National Institute of Standards and B-Q3. The CMMC model uses NIST SP 800-171, Revision 2. Will the B-Q4. Can Department contractors implement NIST SP 800-171 Revision 3?.. 6 B-Q5. What is the relationship between National Institute of Standards and C-Q2. Will my organization need to be independently assessed if it does not C-Q3. Will CMMC independent assessments be required for classified C-Q4. Will the results of a DIB company’s assessment be made public? Will C-Q5. Does my company’s administrative office or manufacturing facility require a specific Commercial and Government Entity (CAGE) code for that C-Q6. Which requirements are considered "critical" and are not allowed in a C-Q7. What happens after a POA&M Closeout Assessment if one or more of

C-Q8. What is the difference between an Operational Plan of Action (OPA) C-Q9. I have entered my company’s CMMC self-assessment into SPRS and have received the following error(s) for ‘CMMC Status Type’: No CMMC C-Q10: Are CMMC assessments required for organizations that only handle C-Q11: Can encryption alone create logical separation for a network within a C-Q12: Our enclave does not have a direct internet connection. Instead, it relies on enterprise networking components residing outside of the enclave. All CUI data is properly encrypted before leaving our enclave. Must the enterprise networking components be brought into our enclave’s CMMC D-Q5. Can non-U.S. citizens or organizations be part of the CMMC D-Q6. Starting November 10, 2025, does Department policy (ref: https://dodprocurementtoolbox.com/uploads/DOPSR_Cleared_OSD_Memo_C MMC_Implementation_Policy_d26075de0f.pdf) require Program Managers to include CMMC Level 2 (C3PAO) in a solicitation if the contractor will handle E-Q1. Must my cloud service provider (CSP) meet Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline