CMMC Level 2 and Construction QC: What Defense Contractors Need to Know Now
Many construction contractors circled November 10, 2026 as the day third-party CMMC Level 2 certification would start showing up as a requirement on Defense contracts. That date is on hold. Here is what changed, what still applies to your job today, and what it means for the quality control records your team produces every day.
1. What happened to the November 10 date
- November 10, 2025: the CMMC rule took effect. Phase 1 put Level 1 and Level 2 self-assessments into new Defense solicitations.
- November 10, 2026 (planned): Phase 2 was to make Level 2 certification by an accredited third-party assessor (a C3PAO) the normal requirement for contracts that handle CUI.
- July 13, 2026: the Department of War suspended Phase 2 and set up a CMMC Reform Task Force to review the program within 60 days.
- Mid-October 2026: the task force report had gone to the Department's CIO but was not public, and no new Phase 2 date had been announced.
Plan on the certification step coming back in some form. Contractors who stop preparing now will be the ones scrambling later.
2. What still applies on your job today
| Requirement | What it means in plain words |
|---|---|
| DFARS 252.204-7012 | If your contract has this clause, you must protect CUI using the 110 security requirements in NIST SP 800-171 and report a cyber incident to DoD within 72 hours. |
| Cloud services | Any cloud service that stores or processes your CUI must meet the FedRAMP Moderate baseline or its equivalent. |
| CMMC Phase 1 self-assessments | Level 1 and Level 2 self-assessments still apply where the contract calls for them. |
| SPRS score and affirmation | Your NIST SP 800-171 score must be posted in SPRS and kept current, with an annual affirmation by a senior company official. |
| Flow-down | Primes still pass these requirements to subcontractors who handle CUI, and some primes are keeping their own certification timelines. |
One more point: with third-party assessments paused, your own self-assessment carries more weight. An overstated score is a False Claims Act risk.
3. Where CUI lives on a construction job
Most of a contractor's CUI does not sit in an IT closet. It sits in the field office, on phones and in email. On military work, drawings and specifications are often marked CUI, especially base maps, utility layouts and anything showing security features. Then everything your team builds from them can carry the same protection:
- Submittal packages with marked-up contract sheets and shop drawings
- RFIs, as-builts, redlines and O&M manuals
- Site photos that show secured areas, utilities or building systems
- Daily QC reports, inspection records and test reports that describe the facility
- Email threads, text messages and shared folders where all of the above gets passed around
That is why quality control sits right in the middle of CMMC on a construction job. QC touches more contract documents than anyone else on site.
4. A checklist for QC managers and project managers
- Know what is marked. Read the contract and the cover sheets. Make a list of which document sets are CUI before work starts.
- Keep the record in one controlled place. Not personal email, not text messages, not a free consumer cloud folder.
- Check every software tool, including AI. If a tool reads or stores CUI, it has to sit inside your protected boundary or meet the FedRAMP Moderate equivalent. Most free consumer AI tools do not.
- Give each person only their own view. A subcontractor should see its own work and its own mail, not the whole job.
- Control photos. Follow the base photo rules, and store photos with the rest of the controlled record.
- Put it in the subcontracts. Flow the clauses down and confirm your subs can actually meet them.
- Keep your SPRS score honest and current. Score what is really in place, not what is planned.
- Keep preparing. If you were working toward a C3PAO assessment, keep your slot and keep closing gaps.
5. The bottom line
The pause changes the timing of certification. It does not change the work. The contractors who will be ready when Phase 2 returns are the ones treating their QC record as controlled information today: one place, the right people, the right tools.
Meet Zhēn Request a pilot or demo
Sources
- WilmerHale: Pentagon suspends CMMC Phase 2 requirements (July 20, 2026)
- Secureframe: CMMC Phase 2 paused, what still applies
- CMMC Map: The November 2026 deadline was suspended (updated October 16, 2026)
- ISI Defense: CMMC status (updated October 19, 2026)
- ConsensusDocs: CMMC phases and subcontract flow-down
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
This article is general information for construction professionals, not legal advice. Check your own contract clauses and current Department of War guidance.