Atch 4 - CMMC-FAQsv6

OFFICE OF THE CHIEF INFORMATION OFFICER

U.S. DEPARTMENT OF WAR

July 2026

CYBERSECURITY

MATURITY MODEL

CERTIFICATION

PROGRAM (CMMC)

FREQUENTLY ASKED

QUESTIONS

Revision 2.3 (Excerpt)

A-Q1. When will CMMC assessments be required for Department contracts? 1 A-Q3. What resources are available to assist companies in complying with A-Q4. Who is the point of contact for general inquiries regarding the CMMC B-Q1. How will my organization know what CMMC level is required for a B-Q2. What is the relationship between National Institute of Standards and B-Q3. The CMMC model uses National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Revision 2. Will the Department B-Q4. Can Department contractors implement National Institute of Standards B-Q5. What is the relationship between National Institute of Standards and B-Q7. What is the difference between Federal Contract Information (FCI) and B-Q8. Is encrypted Controlled Unclassified Information (CUI) still considered C-Q2. Will my organization need to be independently assessed if it does not C-Q3. Will CMMC independent assessments be required for classified systems and/or classified environments within the defense industrial base? . 4 C-Q4. Will the results of a company’s assessment be made public? Will the C-Q5. Does my company’s administrative office or manufacturing facility require a specific Commercial and Government Entity (CAGE) code for that C-Q6. If a company is a Joint Venture (JV), does the JV need its own CMMC

C-Q7. Which requirements are considered "critical" and are not allowed in a C-Q8. What happens after a Plan of Action and Milestones (POA&M) Closeout Assessment if one or more of the security requirements on the POA&M still C-Q9. What is the difference between an Operational Plan of Action (OPA) C-Q10. I have entered my company’s CMMC self-assessment into the Supplier Performance Risk System (SPRS) and have received the following error(s) for ‘CMMC Status Type’: No CMMC Status or No CMMC Score. How C-Q11: Are CMMC assessments required for organizations that only handle C-Q12: What qualifies as a "significant change" that would require an Organization Seeking Assessment to undergo a new evaluation under the D-Q4. Can non-U.S. citizens or organizations be part of the CMMC Ecosystem, e.g., Authorized CMMC Third-Party Assessment Organizations? 8 D-Q5. Starting November 10, 2025, does Department policy require program managers (PMs) to include CMMC Level 2 independent assessment