CMMC Level 2 Certified Defense Contractors: What Buyers Need to Know
The Cybersecurity Maturity Model Certification (CMMC) 2.0 program represents the Department of Defense's mandate for protecting Controlled Unclassified Information (CUI) across the defense supply chain. Level 2 certification requires implementation of all 110 security controls from NIST SP 800-171, validated by an accredited C3PAO (Certified Third-Party Assessment Organization).
Current Certification Landscape
As of early 2026, fewer than 500 companies out of an estimated 80,000–118,000 that will ultimately need Level 2 certification have completed the process. This makes certified contractors a scarce and valuable commodity in the defense supply chain.
| CMMC Phase | Start Date | Requirement |
|---|---|---|
| Phase 1 | Nov 10, 2025 | Self-assessments for Level 1; Level 2 C3PAO assessments begin appearing in contracts |
| Phase 2 | Nov 10, 2026 | Level 2 C3PAO certification required for CUI contracts |
| Phase 3 | Nov 10, 2027 | Level 3 DIBCAC assessments required |
Why Certification Status Matters for Primes
Major prime contractors—Lockheed Martin, Northrop Grumman, Raytheon, and BAE Systems—are already requiring suppliers to document CMMC status. Lockheed Martin has signaled that some FY2026 contracts may already include Level 2 requirements. Primes who cannot verify subcontractor compliance risk losing contract eligibility under DFARS 252.204-7021.
Verification and Due Diligence
The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) maintains the authoritative registry of certified organizations. The Cyber AB Marketplace lists approximately 250 authorized C3PAOs that can conduct assessments. When evaluating a potential supplier's CMMC claim, procurement teams should request the certificate number, verify the scope of assessment, and confirm the certification has not expired (certifications are valid for three years).