Cyber Grants AllianceDoD construction contractors CMMC 2026 questions have moved from theoretical to urgent this year, and many firms are finding out the hard way. Construction companies building barracks, hangars, secure facilities, and base infrastructure have long treated cybersecurity rules as something for IT companies and parts manufacturers. That assumption is now costing firms their place on bid lists.
The Cybersecurity Maturity Model Certification applies to any contractor or subcontractor that handles Federal Contract Information or Controlled Unclassified Information on a Department of Defense contract. Construction firms handle both more often than they realize. Here is what you need to know before your next DoD bid.
Yes, CMMC applies to construction
The DoD CMMC program makes no exception for trade. If your firm holds a DoD construction contract, or subcontracts under one, and receives non-public contract information, you fall under the framework. The requirement flows down from primes to subcontractors through contract clauses, which means even a specialty MEP or concrete sub on a base project can carry an obligation. Attacks on the sector reinforce the point: construction was the second most targeted industry for ransomware in early 2026, with victim counts up 44 percent year over year.
What counts as CUI on a construction project
Controlled Unclassified Information in construction is more common than most estimators expect. Typical examples include:
- Drawings and specifications for facilities on military installations
- Site plans, utility layouts, and security system details
- Documents marked with distribution statements or CUI banners
- Schedules and access procedures for controlled or secure areas
If any of these live in your project management system, your estimators' email, or a superintendent's laptop, you are storing CUI and Level 2 obligations are likely in play. Our explainer on what CUI actually is goes deeper on identifying it in your own systems.
Which CMMC level fits your contracts
Level 1 covers firms that handle only Federal Contract Information: contract terms, pricing, and correspondence not cleared for public release. It requires an annual self-assessment against 15 basic practices. Level 2 covers firms that touch CUI and requires all 110 controls in NIST SP 800-171, with most defense contracts requiring an independent third-party assessment. Many general contractors on DoD work land at Level 2 whether they expect to or not, because facility drawings alone can be CUI. If you are unsure where you sit, start with our Level 1 vs Level 2 comparison.
Key dates for 2026
CMMC requirements began appearing in new DoD solicitations in November 2025. The next milestone arrives on November 10, 2026, when Phase 2 makes third-party certification mandatory for new Level 2 contract awards rather than allowing self-assessment. Certification is not fast: remediation typically takes months, and assessor availability is tightening as the deadline approaches. A construction firm starting readiness work in late 2026 risks being locked out of 2027 awards.
A practical readiness path for construction firms
- Inventory where project data lives: office servers, cloud tools, jobsite devices, and personal phones.
- Identify which contracts include DFARS cybersecurity clauses such as 252.204-7012.
- Run a gap assessment against the applicable CMMC level to get a prioritized fix list.
- Remediate the gaps, starting with access control, multi-factor authentication, and backups.
- Train your people, because field staff and office staff are the most common entry point for attackers.
Sequence matters here. The inventory and contract review cost nothing but a focused afternoon, and they determine everything downstream. Firms that skip straight to buying security tools routinely spend money on the wrong problems, while firms that assess first fix the gaps that assessors and attackers actually care about.
What primes are asking subcontractors right now
General contractors and primes on DoD work have begun sending cybersecurity questionnaires to their subs, and the questions follow a pattern. What is your SPRS score? Do you have a system security plan? Where is project data stored, and who can access it? Can you provide evidence of employee security training? Firms that cannot answer are being quietly moved down bid lists, because a prime cannot risk a subcontractor who might disqualify the whole team.
Treat the questionnaire as a preview of the assessment. If your answers today would be thin, that is your gap list, and it is far better to discover it from a client survey than from a lost award.
Start with a Funded Gap Assessment
The CMMC Gap Assessment Grant provides a $5,000 professional assessment against all 110 controls with a remediation roadmap, at no cost to qualifying construction firms.
Apply for the CMMC Gap Assessment Grant →Funding help for assessment and training
Two grant programs remove the cost barrier for the hardest steps. The CMMC Gap Assessment Grant provides a $5,000 professional assessment against all 110 controls with a remediation roadmap. The Employees Cyber Training Grant funds a year of security awareness training and phishing simulations for your staff, which we covered in detail in our construction training post.
The Associated General Contractors of America has urged members to treat CMMC as a business development issue, not an IT issue, and that framing is right. Firms that certify early will inherit the bids that unprepared competitors can no longer chase. Apply for grant funding and start your readiness work while the calendar is still on your side.