CMMC Conditional Status Implementation for Contractors

The rollout of the Cybersecurity Maturity Model Certification (CMMC) is progressing, with contracts requiring CMMC Level 2 self-assessments already in circulation since November 2025. Contractors can now achieve a Conditional Status, allowing them to work on CMMC Level 2 and 3 contracts even if they haven't fully implemented all requirements. This status is valid for 180 days, during which contractors must meet all remaining requirements to achieve Final Status. The Conditional Status is not applicable for CMMC Level 1 obligations. Prime contractors may impose their own requirements, often preferring subcontractors with Final Status. Organizations are encouraged to confirm acceptance of Conditional Status with their primes before proceeding. The CMMC framework aims to enhance cybersecurity across the defense supply chain.

Key Points: • CMMC Level 2 contracts are now available with Conditional Status for contractors. • Conditional Status allows work on Level 2 and 3 contracts for up to 180 days. • Prime contractors may require Final Status, limiting subcontractor opportunities.