A company can have a mixed contract portfolio where some work requires Level 1, some Level 2 self-assessment, and some work may call for Level 2 C3PAO status. The right path is determined by the contract requirement and the specific information system that will handle the work.
Status note: reviewed September 4, 2026. Phase II is suspended, Phase I remains in force, and the Department of War's CMMC Reform Task Force review is still open. Re-check the official CMMC page before publication if this article is published after that date.
The rule in plain English
CMMC status is tied to assessed information systems and program identifiers, not merely to the company name on a website.
Phase II suspension affects future mandatory third-party timing, so current solicitations and clauses must be read rather than inferred from an old phase chart.
How to implement it without overbuilding
Build a contract-to-system matrix: solicitation, data type, required level/status, system boundary, CMMC UID where applicable, assessment date/status, and affirmation needs.
Where practical, standardize work onto one well-controlled environment capable of supporting the stricter requirement, but do not expand scope without a business reason.
What evidence to keep
Keep solicitation clauses, system mappings, status records, affirmations, assessment reports, and decisions about which environment will perform each contract.
Review the mapping before proposal submission and again when the contract or technical work changes.
Where teams get into trouble
The main failure is sales bidding work against the wrong environment or assuming a self-assessed enclave can satisfy a C3PAO requirement simply because both are called Level 2.
During the Phase II suspension, read the current contract before choosing a path
The underlying CMMC program still defines Level 2 self-assessment and Level 2 C3PAO certification paths, but the July 13, 2026 Department announcement suspended Phase II and pending or future implementation milestones while continuing NIST SP 800-171 Rev. 2 enforcement through self-assessments and select government-led assessments. That changes the practical answer for new contracting actions during the interim.
For each opportunity, read the solicitation and any amendments instead of assuming the old rollout table controls. If language still appears to require a Phase II certification path, route it through the contracts channel and check for an amendment or current Department guidance. Do not let a sales team promise a C3PAO-backed status merely because an older template contains the clause.
Build a contract-to-system matrix for mixed work
A contractor with multiple programs should map each contract or opportunity to the information system that will perform it. Record the data type, required level/status, CMMC UID where applicable, current assessment path, status date, annual affirmation date, and any prime-specific requirement. The matrix prevents a company-wide statement such as 'we are Level 2' from being used for a system that was never part of that assessment scope.
If one environment can safely support multiple contracts, consolidation can reduce duplicate evidence and administration. But do not expand the assessment boundary just to simplify a spreadsheet. A broader boundary increases the number of assets, providers, users, and evidence paths that must be maintained.
- Opportunity or contract number.
- FCI/CUI handled and source of classification.
- Required CMMC level/status from current solicitation language.
- Information system/CMMC UID that will perform the work.
When a third-party path becomes relevant again
If the Department restores or restructures third-party requirements, re-evaluate the contract pipeline rather than assuming every CUI workload needs the same assessment path. The CMMC rule's Level 2 structure distinguishes self-assessment and certification assessment, and future acquisition language will determine which status a specific procurement needs.
Keep the environment assessment-ready even while timing is unsettled: stable scope, accurate SSP, objective-level evidence, current Rev. 2 implementation, and clean affirmation/status records. Those assets survive a schedule change and reduce the chance that a future certification requirement triggers a rushed rebuild.
Do not let sales use one CMMC label for the whole company
A company can have a mature Level 2 environment and still be unable to use that status for a new opportunity if the work will occur on a different information system. The contract-to-system matrix should be part of bid review: before proposal submission, sales identifies the planned system, compliance verifies its current status and affirmation, and IT confirms the CUI workflow will stay inside that boundary.
This process also catches the opposite problem—over-scoping. If a new contract can be performed inside the existing assessed enclave, do not automatically add the rest of the enterprise simply because the customer is new. Scope follows the system and data path used for performance.
- Require a CMMC check before bid/no-bid approval.
- Record the planned information system in the proposal file.
- Verify CMMC UID/status and affirmation before award milestones.
- Escalate stale solicitation language during the Phase II suspension.
- Re-run the check when contract performance moves to another system.
Use bid review to prevent the wrong status from being promised
For every opportunity, record whether the planned performance system has Level 2 (Self) or Level 2 (C3PAO) status and whether that status matches the solicitation requirement. A company can operate both types of environments or statuses, but sales should not present the stronger status of one system as proof for unrelated systems.
Re-run the check when work moves between enclaves, business units, or providers. The contract-to-system decision is the bridge between the assessment result and the actual work.
Final operating detail
Keep the sales-facing status language system-specific. A proposal template should not say simply 'we are CMMC Level 2' when the company maintains multiple environments with different assessment types; name the system or approved enclave intended for the work.
Before assessment week
- ✓Map contracts to systems.
- ✓Read each solicitation's CMMC requirement.
- ✓Verify current status.
- ✓Separate self and C3PAO paths.
- ✓Coordinate sales, contracts, and IT.
- ✓Re-check Phase II status.
Common questions
Can one company have multiple CMMC statuses?
Different assessed information systems can have different relevant statuses and identifiers depending on program and contract use.
Does Level 2 self-assessment equal Level 2 C3PAO?
No. They are different assessment types, and solicitations or contracts can distinguish between them.
Can we use a stricter enclave for lower-level work?
Potentially, if the business and contract use fit and the information system is appropriately assessed.
Does the Phase II pause remove the need to review solicitations?
No. It makes current solicitation and clause review even more important.
What should be re-checked immediately before using this guide for a contract decision?
Re-open the controlling government source, confirm the solicitation or contract language for the specific information system, and verify that the provider or program status cited here has not changed since September 4, 2026.
Official sources used for this guide
Open the primary source before making a contract-specific decision. Regulations and program implementation can change.
