What Is CMMC? A Guide for Construction Contractors

Most construction contractors have never heard of CMMC. That isn’t surprising. The requirement came out of the defense world and it sounds like an IT problem, not a construction problem. But if you bid on Department of Defense construction work and the contract involves certain types of information, CMMC is your problem too. Get caught without it and your bid gets thrown out automatically. No call. No second chance.

This post explains what CMMC is, which construction contracts require it, and what you actually need to do about it.

2026 Update: The Rollout Is No Longer Theoretical

For years CMMC was a proposed rule that contractors could safely ignore. That window is closed. The Department of Defense’s CMMC final rule took effect on November 10, 2025, and Phase 1 is in real contracts today. The later phases are on hold:

Phase 1 (began November 10, 2025, still in effect): Solicitations can require Level 1 or Level 2 self-assessments, documented in SPRS.
Phase 2 (was set for November 10, 2026, now suspended): This is the phase that would have made Level 2 third-party certification from a C3PAO mandatory on applicable contracts. On July 13, 2026 the Department of War (the Department of Defense’s other name) suspended it.
Phases 3 and 4 (2027 and 2028, also suspended): Level 3 requirements and full implementation on all applicable DoD solicitations are on hold along with Phase 2.

The suspension came with a 60-day review by a new CMMC Reform Task Force. Industry comments were due August 14, 2026, and the task force sent its report to the Department of War CIO around September 11, 2026. As of September 23, 2026 the report has not been made public. Results are expected in late September or early October 2026.

What this means for you right now: the pause is not a pass. Phase 1 stays in force. Level 1 and Level 2 self-assessments, your SPRS score, and the annual affirmation all still apply, and DFARS 252.204-7012 still requires you to protect Controlled Unclassified Information to NIST SP 800-171 Rev 2. Level 2 certification takes most small businesses 3 to 12 months, so if your work touches CUI, keep building toward it. Whatever the review decides about third-party assessments, you will not be starting from zero.

What CMMC Stands For

CMMC stands for Cybersecurity Maturity Model Certification. The Department of Defense created it because contractors kept getting hacked. Sensitive defense information was sitting on contractor laptops, shared drives, and email inboxes with no real protection. The DoD built CMMC to set minimum cybersecurity standards for any company that handles that information.

It isn’t a suggestion. It’s a contract requirement. If a solicitation says CMMC Level 2 is required, you need a current Level 2 status in SPRS before your bid is even considered.

The Three Levels

The CMMC framework has three levels. Each one requires more from you.

Level 1: Foundational

This is the baseline. It covers 17 basic cybersecurity practices pulled from the Federal Acquisition Regulation. Things like using antivirus software, limiting who has access to sensitive files, and changing default passwords. Most small businesses already do most of this without thinking about it. Level 1 applies to contractors who handle Federal Contract Information (FCI), which is basic information created for or by the government under a contract.

Level 2: Advanced

This is where most DoD construction contractors run into trouble. Level 2 requires 110 practices based on NIST Special Publication 800-171. It covers how you store, transmit, and protect Controlled Unclassified Information (CUI). CUI includes things like building plans for military installations, technical specifications for secure facilities, and personnel or access data related to government property.

Right now, under Phase 1, a Level 2 requirement usually means a self-assessment posted in SPRS. Phase 2 was going to require a third-party assessment on many Level 2 contracts, where a CMMC Third-Party Assessment Organization (C3PAO) comes in, reviews your systems, and issues the certification. That requirement is suspended while the CMMC Reform Task Force review is underway.

Level 3: Expert

This level is for contractors working on the most sensitive DoD programs. It requires everything in Level 2 plus additional practices designed to counter advanced persistent threats. Most construction contractors will never encounter a contract requiring Level 3. If you do, you’ll know it because the solicitation will be explicit about it.

Which Construction Contracts Require CMMC

Here is the honest answer: most federal construction contracts don’t require CMMC. Routine maintenance, renovation work on non-sensitive facilities, and general construction at non-DoD sites typically don’t involve CUI and don’t trigger CMMC requirements.

The ones that do include:

Construction at military bases or secure DoD facilities
Projects involving design documents for sensitive installations (secure communications rooms, SCIFs, bunkers, weapons storage)
Contracts where you receive technical data or drawings that are marked as controlled
Any contract where the solicitation specifically lists a CMMC level in the requirements

The key is reading the solicitation. If a SAM.gov opportunity involves DoD and the Statement of Work mentions sensitive facility improvements, infrastructure that touches classified systems, or any requirement to handle protected technical data, read the full solicitation for CMMC language. Look for the clause DFARS 252.204-7012 and any CMMC level specified in Section L or M. (See also our breakdown of DFARS 252.204-7021 and SPRS scores, the related self-assessment requirement that runs in parallel with CMMC, and our walkthrough of how to read a federal solicitation if Section L/M is unfamiliar territory.)

How to Tell If a Solicitation Requires CMMC

Pull up the solicitation and search the document for these terms:

“CMMC”
“252.204-7012”
“Controlled Unclassified Information”
“CUI”

If none of those appear and it’s a simple construction project on a non-sensitive site, you’re probably fine. If they appear, you need to know your current CMMC level before you spend time building a bid.

Also check the CMMC Marketplace at https://cyberabb.cms.gov to see if the contracting officer has registered the contract with a required level. This is a public database.

What Happens If You Bid Without It

Automatic disqualification. There’s no appeal process for missing a required certification. The contracting officer can’t waive it. You don’t get to explain. Your bid goes in the trash.

This is different from most other requirements where you might get a phone call asking for a missing document. CMMC compliance either exists or it doesn’t. The government checks before awards are made and often before best-and-final offers are requested.

Worse, if you represent in your bid that you meet CMMC requirements and you don’t, that’s a False Claims Act issue. Contractors have faced serious legal exposure for misrepresenting their compliance status on federal bids.

Level 1 vs Level 2: What You Actually Need to Do

If your contracts only require Level 1, you can self-attest annually through the Supplier Performance Risk System (SPRS). Go to https://www.sprs.csd.disa.mil, document your 17 practices, and submit your score. No third party required.

If your contracts require Level 2, the process is more involved:

Get a NIST 800-171 assessment done, either internally or with a consultant, to see where your gaps are
Build a System Security Plan (SSP) documenting how you protect CUI
Create a Plan of Action and Milestones (POAM) for anything you haven’t yet fixed
Post your Level 2 self-assessment score and annual affirmation in SPRS. This is what Phase 1 solicitations ask for today.
Get ready for a C3PAO assessment. Third-party certification was set to start with Phase 2 and is suspended for now, so keep your SSP and POAM current and you can move fast when it returns.

Level 2 certification takes most small businesses anywhere from 3 to 12 months depending on how far they’re from the baseline. It costs money. Budget for it before you pursue DoD work that requires it.

How to Know If a Contract Requires It Before You Bid

If you track federal construction opportunities through RenovationRoute, contracts that contain CMMC language get flagged on the opportunity card. That’s your signal to stop and check your certification status before spending time building a number. It isn’t a product feature so much as a shortcut. Instead of searching a 60-page PDF for DFARS 252.204-7012, you see the flag and know immediately.

From there, getting certified is a separate process entirely and it takes time. Don’t wait until you find a contract you want. Start that process before you need it.

Getting Certified: Where to Start

If you’re new to CMMC and need help figuring out where you stand, get a gap assessment done first. It will tell you exactly where you’re relative to the level required and what it will take to close the gap. This is worth doing before you pursue any DoD work that requires certification.

Start free. We wrote CUI Commander, an open-source CMMC guide for small construction and trade firms. Which level applies to you, what each clause means, what fails an assessment, and a 14-day zero-budget plan to get a baseline in place. It’s written for a 5 to 50 person shop with no IT person. Read it before you pay anyone $6,000 a month.

MSTechAlpine specializes in helping construction and defense contractors through the CMMC process. They can assess your current posture, help you build your System Security Plan, and guide you through the C3PAO assessment. If DoD construction work is part of your plan, they’re the right starting point.

The Short Version

Most construction contractors don’t need CMMC right now. But if you want to bid on DoD facility work, secure construction projects, or any contract involving sensitive technical data, you need to know this framework exists and understand which level applies before you start building numbers. Bidding without the required certification isn’t just a wasted effort. On the wrong contract, it’s a legal problem.

Read the solicitation. Search for CMMC and CUI. Know your level. If you need Level 2, start the process early because it takes longer than you think.