CMMC requirements for small businesses
Published 2026-10-23, 13 min read
A ten-person machine shop and a defense prime meet the same CMMC rule. What changes with size is how the work gets done and who helps you do it. This guide covers what binds you today, what DoD itself expects it to cost, and the decisions to make first.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Contracts may require CMMC Level 1 (Self) or Level 2 (Self): your own assessment, scored and entered in SPRS, with a senior official's affirmation. Class Deviation 2026-O0025 Rev 3; 32 CFR 170.15, 170.16
- The CMMC rule itself, 32 CFR Part 170, is unchanged since it took effect on 2024-12-16. eCFR, 32 CFR Part 170
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Existing contracts that carry CMMC requirements have them removed at the next option period or the next scheduled administrative modification. Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
- DoD's 2026 Regulatory Plan lists an interim final rule amending 32 CFR Part 170 (RIN 0790-AM01) to set a deadline and transition from NIST SP 800-171 Rev 2 to Rev 3. It was timetabled for July 2026 and has not been published as of 2026-10-23. 91 FR 52824
- Class Deviation 2026-O0025, Revision 3 (DFARS part 240), read 2026-10-23
- DFARS 252.204-7012, -7019, -7020, -7021 (acquisition.gov), read 2026-10-23
- 32 CFR Part 170 (eCFR), read 2026-10-23
- Federal Register 2026-16603, 2026 Regulatory Plan (RIN 0790-AM01), read 2026-10-23
- Federal Register: CMMC documents, read 2026-10-23
0
times 32 CFR Part 170, the CMMC rule, uses the word “small”
eCFR, 32 CFR 170
29,260
small businesses holding DoD contracts in an average year, FY 2019 to 2021, by DoD's count
89 FR 83204
73%
of companies in the defense industrial base are small, in the SBA Office of Advocacy's words
89 FR 83203
$37,196
DoD's estimate for a small entity's Level 2 (Self), per three-year cycle, in 2023 dollars
89 FR 83092, Table 10
There is no small-business exemption
The CMMC rule decides who it covers by the information on your systems, not by the size of your company. Part 170 never uses the word "small". Its applicability section reads:
The carve-outs that do exist are about the order, not the company. CMMC requirements apply to contracts above the micro-purchase threshold, commercial items included, except those exclusively for COTS items. DoD can also waive them for a procurement "in advance of the solicitation at the discretion of DoD". That is a decision the department makes about a buy. A company cannot apply for it.
- Decides it
- The FCI or CUI your systems will process, store or transmit for the contract
- The CMMC status the solicitation names
- What your prime flows down to you
- Whether the order is only for COTS items, or at or below the micro-purchase threshold
- Does not
- Your headcount
- Your revenue
- Your SBA size status, or a set-aside
- How few CUI files you hold
32 CFR 170.3(a), (c), (d); 170.23(a)
The last row on the right is the one small shops most often hope for. DoD answered it directly when it published the rule:
The requirements necessary to protect a single document are the same as to protect many documents.
Size still matters in two places. It sets which of DoD's cost estimates fits you, and it decides set-aside eligibility. For a 5 to 50 person shop the size question rarely bites: SBA puts the line for Machine Shops (NAICS 332710) and Precision Turned Product Manufacturing (332721) at 500 employees. If you are not sure which data you hold, start with the CMMC level finder and FCI vs CUI.
What the SBA asked, and what DoD answered
The SBA's Office of Advocacy commented on the proposed rule. DoD printed those comments in the final rule with its answers. Read together, they are the clearest statement of where DoD drew the line for small contractors.
Cost
SBA Office of Advocacy
Advocacy reminds the DoD that this rule will impose a high cost of compliance on small businesses and any means to reduce the burden on small businesses will increase the participation of these impacted businesses.
89 FR 83202
DoD
CMMC Level 1 and select CMMC Level 2 requirements are now met via self-assessment, which reduces burden to small businesses. The CMMC program incorporates flexibility with the use of self-assessment, POA&Ms, and waivers.
89 FR 83150
Enclaves
SBA Office of Advocacy
Advocacy requests clear and concise guidance for small business contractors and subcontractors to create enclaves in order to lessen the burden of compliance on the businesses.
89 FR 83202
DoD
However, the Department does not intend to formulate specific directives pertaining to the configuration and segregation of corporate information systems into enclaves. … External service providers (ESPs) will be a driving force for small businesses' compliance with CMMC requirements.
89 FR 83202–83203
Time to ramp up
SBA Office of Advocacy
Small businesses urge DoD to create flexibilities such as using Plan of Action and Milestones (POA&Ms) when this rule goes into effect initially, allowing small businesses to ramp up to full compliance with their respective CMMC level.
89 FR 83203, Advocacy quoting small businesses
DoD
OSAs that are currently attesting that they meet DFARS clause 252.204-7012 should not have difficulty successfully achieving a Level 2 self-assessment.
89 FR 83150
Two of those answers shape everything below. Self-assessment is the relief DoD chose for small firms, so Level 1 (Self) and Level 2 (Self) are where most small shops land. And DoD expects small firms to lean on outside providers rather than on federal guidance for how to wall off a CUI environment. That puts the choice of MSP or enclave near the top of your list.
What a small shop owes today
Find your shop by what sits on your systems, not by what your customer calls the contract. Most small shops fall in the first two boxes. The third is the one the suspension changed.
Purchase orders, specs and schedules that are not public, and no CUI
Today: Level 1 (Self) may be required
- The 15 basic safeguarding requirements of FAR 52.204-21, on the systems that hold FCI. FAR 52.204-21(b)(1)
- Where the contract names Level 1 (Self): all 15 MET, no POA&M, repeated every year, entered in SPRS with an affirmation. 32 CFR 170.15, 170.22
- A subcontractor that only handles FCI needs Level 1 (Self), whatever the prime holds. 32 CFR 170.23(a)(1)
Drawings with a distribution statement, CTI, export-controlled data
Today: 7012 applies; Level 2 (Self) may be required
- DFARS 252.204-7012: the 110 requirements of NIST SP 800-171 Rev 2, incidents reported within 72 hours, FedRAMP Moderate or equivalent for any cloud holding the data. DFARS 252.204-7012(b)(2), (c)
- A score in SPRS. Under the codified 7019/7020 it must be current, not over 3 years old; contracts written under the deviation reach it through Level 1 or 2 (Self) instead. DFARS 252.204-7019(b); 252.240-7997
- A subcontractor that handles CUI needs Level 2 (Self) at minimum. 32 CFR 170.23(a)(2)
A contract or bid that names Level 2 (C3PAO) or Level 3
Today: Suspended, see the status box
- Everything in the CUI column still applies. The third-party assessment is what the suspension covers. Class Deviation 2026-O0025 Rev 3
- The requirements a C3PAO would check are the 110 you score yourself against today. 32 CFR 170.14(c)(3)
A distribution statement B through F on a drawing usually means Controlled Technical Information, and that moves a shop from the first box to the second. The rule texts behind each box are in Level 1 requirements, Level 2 requirements and the DFARS 7012 guide.
DoD's cost figures for a small entity
DoD priced the rule itself, separately for small and other-than-small companies. Two warnings come with the figures. They are in 2023 dollars. And they cover the assessment, not the security work: DoD "did not consider the cost of implementing the security requirements themselves", because 7012 and FAR 52.204-21 already required it.
- Small entity
- Other than small
- Level 1 (Self)per one-year cycle
Small entity: $5,977
Other than small: $4,042
- Level 2 (Self)per three-year cycle
Small entity: $37,196
Other than small: $48,827
- Level 2 (C3PAO)per three-year cycle
Small entity: $104,670
Other than small: $117,768
89 FR 83092, Tables 9 and 10; assessment, reporting and affirmations only
One row runs the other way. A small entity's Level 1 (Self) costs more than a larger company's, because DoD assumed small entities "are likely to outsource IT and cybersecurity to an External Service Provider" and priced that help as bought in (89 FR 83179). At Level 2 the order flips: a small entity's C3PAO engagement assumes a 3-person C3PAO team, 120 hours at $260.28 = $31,234, against 5 people and 200 hours = $52,056 for a company that is not small.
Four decisions, in order
A small shop starts CMMC with four decisions. Make them in this order and you avoid paying for work you did not need. The order is our advice, not a DoD procedure; the rule each answer leans on is cited under it. Pick what your shop holds and the answers change.
CMMC for a small shop: four decisions, cuideck.com
Profile: CUI too
Do you need to hold CUI at all?
Then list every place it lands: the inbox, the file share, the PC beside the CNC, the paper in the cabinet. That list is your scope, and everything after this depends on it.
32 CFR 170.19CMMC scoping worksheet
The whole shop, or a smaller boundary?
Every asset that holds CUI is assessed against all 110 requirements, so the size of the boundary is the size of the job. Assets physically or logically separated from CUI are out of scope. DoD declined to tell small firms how to build an enclave; it is your design, often with a provider's help.
32 CFR 170.19(c)(1); 89 FR 83203CMMC enclaves compared
Yourself, an MSP, or a consultant?
DoD's own estimate assumes a small entity hires outside help. An MSP that only handles your security data is still in your assessment scope as a Security Protection Asset. A consultant who prepares you cannot take part in your certification assessment within 3 years.
89 FR 83179; 32 CFR 170.19(c)(2); 170.8(b)(17)(ii)(G)CMMC MSPs compared
What do you spend on first?
The gaps that may never wait on a POA&M and every 3- or 5-point item; a DoD-approved medium assurance certificate, so a 72-hour incident report is possible; and a FedRAMP Moderate or equivalent home for any cloud copy of CUI.
32 CFR 170.21(a); DFARS 252.204-7012(b)(2)(ii)(D), (c)SPRS score calculator
Prints the four answers for the profile picked above.
After these four, the work is the same for every size of company: scope, score, write the SSP, plan the gaps, post the result and affirm it. Each of those steps is laid out in how to get CMMC certified, and a week-by-week list for this quarter is on the CMMC status page. We do not repeat them here.
Where a small shop can get help
Start with the public options: programs run or funded by the government, with no product to sell you. Each card says what the program's own page said on 2026-10-23.
APEX Accelerators
DoD's procurement technical assistance program, managed by the DoD Office of Small Business Programs; the centers were called PTACs until the rename. DFARS points offerors to them by name.
Ask your nearest center what CMMC and SPRS help it offers. Services vary from center to center.
Find a centerDFARS 252.219-7000(c); 89 FR 46836
NIST MEP Centers
NIST's Manufacturing Extension Partnership says a center can help you “assess your business’s current risk posture, identify any gaps, and implement solutions” to meet “legal and contractual cybersecurity and privacy requirements”.
Ask whether the work is fee-based before you book it.
Cybersecurity resources for manufacturersnist.gov/mep, updated 2025-09-30
NIST Small Business Cybersecurity Corner
NIST's own collection for small firms: the basics, quick start guides and guidance by sector, manufacturing included. The rule text itself is NIST SP 800-171 on csrc.nist.gov.
Use it for staff training and policy wording; score yourself against 800-171 Rev 2, the revision DoD binds.
Small Business Cybersecurity Cornernist.gov/itl
SBA's cybersecurity page
Tells federal contractors and subcontractors to be aware of CMMC and that a CMMC level is a condition of award. It also points to free DHS cyber hygiene vulnerability scanning for small businesses.
Its line that CMMC rulemaking is “currently in progress” is out of date: Part 170 took effect on 2024-12-16.
Paid help comes in three shapes. A Registered Practitioner Organization advises; the Cyber AB lists them, and CMMC consultants and RPOs compares some. An MSP runs the IT and much of the evidence; see CMMC MSPs. An enclave provider gives you a ready-made boundary for the CUI; see CMMC enclaves. Whoever you hire, the affirmation in SPRS is signed by a senior person at your company, not by them.
Questions small shops ask
Is there a CMMC exemption for small businesses?
No. 32 CFR Part 170 applies to every DoD contractor and subcontractor whose systems will process, store or transmit FCI or CUI for the contract, and it never mentions company size. The exceptions are about the order: one exclusively for COTS items, one at or below the micro-purchase threshold, or a waiver DoD grants for a procurement before the solicitation.
Does a small-business set-aside change what CMMC asks?
No. Part 170 sets the requirement by the information and the level the solicitation names; it says nothing about set-asides. A set-aside decides who may bid, not what they must protect.
We are a 12-person subcontractor. Which level do we need?
It follows what the prime sends you, not your size. Only FCI: Level 1 (Self). Any CUI: Level 2 (Self) at minimum, and Level 2 (C3PAO) when the prime's own contract carries that requirement. The level finder walks the question.
Can a small shop do CMMC without hiring anyone?
For Level 1 (Self) and Level 2 (Self), yes: the assessment is your own, and a senior person at the company affirms it in SPRS. A self-assessment gets no certificate; a Certificate of CMMC Status follows only a C3PAO or DCMA DIBCAC assessment. Whether you have the hours in-house for 110 requirements is the real question.
What does CMMC cost a small business?
DoD's estimate for a small entity, in 2023 dollars: $5,977 per one-year Level 1 (Self) cycle, $37,196 per three-year Level 2 (Self) cycle, $104,670 per three-year Level 2 (C3PAO) cycle. Those cover the assessment, not fixing the gaps. Add your own quotes in the cost estimator.
Should a small shop wait for the Reform Task Force before spending?
Not on the DFARS 7012 work. That clause has required NIST SP 800-171 since December 31, 2017, and the status box near the top lists it among what applies today. The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23; that box is the one place we update when it is.