CMMC Phase 2 status: suspended pending review. On July 13, 2026 the Department of War paused the CMMC rollout and suspended Phase 2 pending a 60 day review. CMMC Level 1 and Level 2 self-assessments, SPRS, the annual affirmation, NIST SP 800-171 and DFARS 252.204-7012 still stand.
DoD construction contractors CMMC 2026 questions have moved from theoretical to urgent this year, and many firms are finding out the hard way. Construction companies building barracks, hangars, secure facilities, and base infrastructure have long treated cybersecurity rules as something for IT companies and parts manufacturers. That assumption is now costing firms their place on bid lists.
The Cybersecurity Maturity Model Certification applies to any contractor or subcontractor that handles Federal Contract Information or Controlled Unclassified Information on a Department of Defense contract. Construction firms handle both more often than they realize. Here is what you need to know before your next DoD bid.
Yes, CMMC applies to construction
The DoD CMMC program makes no exception for trade. If your firm holds a DoD construction contract, or subcontracts under one, and receives non-public contract information, you fall under the framework. The requirement flows down from primes to subcontractors through contract clauses, which means even a specialty MEP or concrete sub on a base project can carry an obligation. Attacks on the sector reinforce the point: construction was the second most targeted industry for ransomware in early 2026, with victim counts up 44 percent year over year.
What counts as CUI on a construction project
Controlled Unclassified Information in construction is more common than most estimators expect. Typical examples include:
- Drawings and specifications for facilities on military installations
- Site plans, utility layouts, and security system details
- Documents marked with distribution statements or CUI banners
- Schedules and access procedures for controlled or secure areas
If any of these live in your project management system, your estimators' email, or a superintendent's laptop, you are storing CUI and Level 2 obligations are likely in play. Our explainer on what CUI actually is goes deeper on identifying it in your own systems.
Which CMMC level fits your contracts
Level 1 covers firms that handle only Federal Contract Information: contract terms, pricing, and correspondence not cleared for public release. It requires an annual self-assessment against 15 basic practices. Level 2 covers firms that touch CUI and requires all 110 controls in NIST SP 800-171, with most defense contracts requiring an independent third-party assessment. Many general contractors on DoD work land at Level 2 whether they expect to or not, because facility drawings alone can be CUI. If you are unsure where you sit, start with our Level 1 vs Level 2 comparison.
Key dates for 2026
CMMC requirements began appearing in new DoD solicitations in November 2025. Phase 2, which would have made third-party certification mandatory for new Level 2 contract awards on November 10, 2026, was suspended on July 13, 2026 pending a 60 day review. Certification is not fast: remediation typically takes months, so a construction firm that starts readiness work now is better placed when Phase 2 resumes.
A practical readiness path for construction firms
- Inventory where project data lives: office servers, cloud tools, jobsite devices, and personal phones.
- Identify which contracts include DFARS cybersecurity clauses such as 252.204-7012.
- Run a gap assessment against the applicable CMMC level to get a prioritized fix list.
- Remediate the gaps, starting with access control, multi-factor authentication, and backups.
- Train your people, because field staff and office staff are the most common entry point for attackers.
Sequence matters here. The inventory and contract review cost nothing but a focused afternoon, and they determine everything downstream. Firms that skip straight to buying security tools routinely spend money on the wrong problems, while firms that assess first fix the gaps that assessors and attackers actually care about.
What primes are asking subcontractors right now
General contractors and primes on DoD work have begun sending cybersecurity questionnaires to their subs, and the questions follow a pattern. What is your SPRS score? Do you have a system security plan? Where is project data stored, and who can access it? Can you provide evidence of employee security training? Firms that cannot answer are being quietly moved down bid lists, because a prime cannot risk a subcontractor who might disqualify the whole team.
Treat the questionnaire as a preview of the assessment. If your answers today would be thin, that is your gap list, and it is far better to discover it from a client survey than from a lost award.
Start with an In-Kind Gap Assessment
The CMMC Gap Assessment Grant provides a professional assessment against all 110 controls with a prioritized list of your compliance gaps by severity, at no cost to qualifying construction firms.
In-kind grants for assessment and training
Two grant programs remove the cost barrier for the hardest steps. The CMMC Gap Assessment Grant provides a professional assessment against all 110 controls with a prioritized list of your compliance gaps by severity. The Employees Cyber Training Grant covers a year of security awareness training and phishing simulations for your staff, which we covered in detail in our construction training post.
The Associated General Contractors of America has urged members to treat CMMC as a business development issue, not an IT issue, and that framing is right. Firms that certify early will inherit the bids that unprepared competitors can no longer chase. Apply for a grant and start your readiness work while the calendar is still on your side.