CMMC in Higher Education: Complete Guide

TL;DR:

The DoD’s DFARS Interim Rule introduces new contract clauses to facilitate the phased rollout of CMMC and requires contractors (including higher education institutions that handle CUI under DoD contracts) to have an SSP, report compliance with NIST SP 800-171 on SPRS, and provide a timeline for full compliance prior to contract award.

The Department of Defense (DoD) released the Defense Federal Acquisition Regulation Supplement (DFARS) Interim Rule on September 29, 2020, and went into effect on November 30, 2020.

The DFARS Interim Rule introduced several new contract clauses (252.204–7019, 252.204–7020, and 252.204–7021) to support the rollout of the Cybersecurity Maturity Model Certification (CMMC). DoD adopted it as a final rule effective November 10, 2025, which started Phase 1 of the CMMC rollout.

Specifically, the DFARS Interim Rule requires contractors to have a System Security Plan (SSP), quantify their compliance with the NIST SP 800-171, self-report that status on the Supplier Performance Risk System (SPRS), and a timeline for full compliance, prior to a new contract award or exercise of a contract option.

Higher Education Institutions must comply when they hold DoD contracts or subcontracts that involve FCI or CUI. DoD has said CMMC is unlikely to apply to fundamental research that involves neither.

What is the purpose of the DFARS Interim Rule?

TL;DR:

The DFARS Interim Rule introduced the CMMC contract clause, DFARS 252.204-7021. It required contractors to complete a NIST SP 800-171 self-assessment using the Assessment Methodology and report the score to SPRS. Under 32 CFR Part 170, contracts involving FCI call for Level 1, which has 15 requirements. Contracts involving CUI generally call for Level 2, which has the 110 requirements of NIST SP 800-171 Rev. 2.

The purpose of the DFARS Interim Rule was to kickstart the five-year, phased rollout of the Cybersecurity Maturity Model Certification (CMMC). Prior to the Interim Rule, DFARS 252.204-7012 required any contractor with systems that stored or transmitted Controlled Unclassified Information (CUI) to agree to be compliant with NIST SP 800-171. From November 30, 2020, contractors required to implement NIST SP 800-171 needed an assessment under the NIST SP 800-171 Assessment Methodology, posted in SPRS.

Under 32 CFR Part 170, contractors that handle Federal Contract Information (FCI) need at least Level 1, which covers 15 requirements. Contractors that process, store, or transmit CUI generally need Level 2, which covers the 110 requirements of NIST SP 800-171 Rev. 2. Level 2 is met by a self-assessment or a C3PAO assessment, depending on the contract. During the suspension announced in July 2026, only the self-assessment route may be required. Contractors will also need to demonstrate proof by documenting multiple forms of evidence for each practice.

Free download: Compare CMMC requirements with NIST controls using the CMMC | NIST 800-53 Multi-Framework Crosswalk.

Who is required to comply with the DFARS Interim Rule?

Any prime contractor or subcontractor for the DoD who handles Controlled Unclassified Information (CUI) will need to comply with the new DFARS Interim Rule. This includes research labs, and their subsequent systems, in Higher Education Institutions that handle CUI under DoD contracts.

Are Higher Education Institutions exempt from the DFARS Interim Rule?

TL;DR:

Higher Education Institutions are not exempt from the DFARS Interim Rule or the CMMC.

No, Higher Education Institutions are not exempt from the DFARS Interim Rule or the CMMC. In its 2025 DFARS final rule, DoD said fundamental research, as defined in National Security Decision Directive 189, cannot be safeguarded as FCI or CUI. Other research information handled during contract performance may be FCI or CUI and can trigger CMMC requirements. EDUCAUSE and several other organizations urged the DoD to clarify that fundamental research falls outside the rule’s CMMC and NIST SP 800-171 assessment provisions. DoD addressed fundamental research when responding to public comments in the final CMMC Program rule and the final DFARS rule.

What is included in the DFARS Interim Rule?

TL;DR:

The DFARS Interim Rule includes three new clauses: Notice of SP 800-171 DoD Assessment Requirements, NIST SP 800-171 DoD Assessment Requirements, and Cybersecurity Maturity Model Certification Requirements.

The DFARS Interim Rule introduced three new clauses (7019, 7020, 7021), and the codified DFARS text still carries them.

• DFARS 252.204–7019, Notice of NIST SP 800–171 DoD Assessment Requirements
  • This clause provides notice to contractors of their requirement to maintain a record of their NIST SP 800-171 compliance within the SPRS. As per the NIST SP 800-171 Assessment Methodology required by DFARS 252.204–7019 and 252.204–7020, this means that contractors will need to have a Basic, Medium, or High assessment completed every three years and maintain a record of it on the SPRS. Contractors will start with a Basic assessment, which is a self-assessment. However, depending on the criticality of the program or the sensitivity of the information being handled by the contractor, contractors may be subject to a Medium or High assessment conducted by DoD, such as the Defense Contract Management Agency (DCMA)

• DFARS clause 252.204–7020, NIST SP 800–171 DoD Assessment Requirements
  • This clause requires a contractor to provide the government with access to its facilities, systems, and personnel when it is necessary for the DoD to conduct or renew a Medium or High assessment. Furthermore, the clause also requires the contractor to ensure that subcontractors also have the results of a current NIST SP 800-171 assessment posted in SPRS prior to awarding a subcontract or other contractual instruments. Finally, the clause also states that for Medium and High assessments, contractors have 14 business days to provide additional information to demonstrate that they meet any security requirements not observed by the assessment team or to rebut the findings that may be of question.

• DFARS clause 252.204–7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements
  • This clause carries CMMC level requirements into DoD contracts. It took its current form in the final DFARS rule effective November 10, 2025. The program office or requiring activity decides whether a contract requires a CMMC level. Solicitations and contracts solely for commercially available off-the-shelf (COTS) items are excepted. In a memorandum dated July 13, 2026, the Department of War CIO suspended the Phase 2 transition. During the suspension, only Level 1 (Self) or Level 2 (Self) may be required.

Are there penalties associated with the DFARS Interim Rule?

TL;DR:

The penalties associated with the DFARS Interim Rule include the inability to receive contracts or award subcontracts, potential liabilities under the False Claims Act, and limited competition for less favorable assessment scores.

Yes, there are several possible penalties associated with the DFARS Interim Rule.

• Contractors will not be awarded contracts, nor can they award subcontracts, unless they and their relevant subcontractors have a current NIST SP 800-171 assessment score posted in SPRS. That award rule is in the codified DFARS text. The FAR overhaul class deviations that contracting officers now use strike that award rule and prescribe DFARS 252.240-7997 for government-led Medium and High assessments.
• As per the False Claims Act, contractors could face potential liabilities for a self-assessment that is improperly conducted or reported. And although not directly stated anywhere, contractors could possibly be held responsible for self-assessments submitted by their subcontractors.
• Less favorable assessment scores may lead to limited competition, if and how they will be used in best value determinations for contract awards.

How does the NIST SP 800-171 Assessment Methodology work?

TL;DR:

The NIST SP 800-171 Assessment Methodology assigns a score based on the contractor’s implementation of 110 controls, and includes three levels: Basic, Medium, and High.

The NIST SP 800-171 Assessment Methodology creates a definitive scoring system by which the DoD can strategically assess a contractor’s implementation of NIST SP 800-171 and thus gain an understanding of their security posture. The highest score you can get is a 110, which reflects full implementation of all 110 controls in NIST SP 800-171. However, if a specific control is not implemented, the score is reduced and in some cases by more than just a single point. This means a negative score is possible. There are 42 controls worth 5 points, 14 controls worth 3 points, and 51 controls worth 1 point. Multifactor authentication and FIPS-validated cryptography are worth 3 or 5 points, depending on partial implementation. The system security plan requirement is not scored, because an assessment cannot be completed without one. Contractor’s that submit a score lower than 110 are also required to submit the exact date they expect to receive the perfect score.

Another facet of the NIST SP 800-171 Assessment Methodology is the three distinct levels of assessment that result in varying degrees of confidence.

• Basic Assessment
  • This assessment is a self-assessment that results in a “low” level of confidence.
• Medium Assessment
  • This assessment includes a review of your System Security Plan (SSP) by DoD personnel and results in a “medium” level of confidence.
• High Assessment
  • This assessment includes an on-site or virtual assessment by the DCMA and results in a “high” level of confidence.

What steps can I take to comply with the DFARS Interim Rule?

TL;DR:

To determine whether the entire organization needs to meet NIST SP 800-171 compliance, Higher Education Institutions with individual DoD sponsored research labs should adopt an “enclave approach” and only secure the specific research labs that handle CUI data, creating a specific SSP for each CUI enclave, conducting a pre-assessment, documenting evidence of compliance and other artifacts, and submitting the initial score into the SPRS to be awarded contracts under the Interim Rule, with the possibility of requiring a medium or high assessment afterward, while also preparing for the CMMC requirements that began phasing in on November 10, 2025 and track progress to full compliance using a GRC Assessment Platform.

1. Evaluate your organization and determine whether the whole organization will need to meet NIST SP 800-171 compliance. For Higher Education Institutions with individual DoD sponsored research labs, this is usually not the case. This means you can adopt what is called an “enclave approach”. By leveraging this approach, Higher Education Institutions only need to worry about securing the specific research labs that handle Controlled Unclassified Information (CUI), or “CUI enclaves”. When in doubt, it helps to follow the data—determine where CUI data is store and map out how it moves throughout the organization or between the organization and subcontractors.
2. For each CUI enclave, you’ll need to create a specific System Security Plan (SSP) that covers the specific systems, people, and locations that involve the specific CUI. If you need help scoping your CUI enclave, the Cyber AB, the CMMC Accreditation Body, provides a marketplace of practitioners that can help you.
3. Once your CUI enclaves are defined and SSPs created, we recommend conducting a pre-assessment. The pre-assessment is for internal use only and will help you identify compliance gaps in your CUI enclave. You’ll be able to understand what controls are missing, make strategic decisions about how to implement those missing controls, and begin working on a POA&M if necessary. You can also leverage the pre-assessment to document evidence of compliance and other artifacts. These are important in case of a DCMA assessment or to prepare for other third-party assessments including the CMMC. You can leverage a GRC Assessment Platform like Isora GRC to help you streamline your assessment workflow and collect evidence.
4. Under the codified DFARS text, you need a current score in SPRS to be awarded contracts. The FAR overhaul class deviations that contracting officers now use strike that award rule. As you implement new controls you can update your score on the SPRS to reflect your current progress. As of now you’ll need to provide the following in the SPRS:
   • Date assessment was completed
   • Assessment score (< or = 110)
   • Scope of assessment (e.g., Enterprise, Enclave, or Contract)
     • Contracts – Contract specific SSP review
     • Enterprise – Entire company’s network under the CAGEs listed
     • Enclave – Standalone under Enterprise CAGE as business unit (test enclave, hosted resources, etc.)
   • POA&M completion date (the specific calendar date at which you predict to attain a score of 110)
   • Included CAGEs (CAGEs you are reporting that are covered by the SSP)
5. After you’ve submitted your basic assessment, DoD may decide to conduct a medium or high assessment. Trained DoD personnel complete either assessment.
6. Finally, CMMC Phase 1 began on November 10, 2025, so DoD solicitations can now require a CMMC status. The security requirements of CMMC Level 2 are identical to those in NIST SP 800-171 Rev. 2. If you’re using a GRC Assessment Platform like Isora GRC, you can work off of your initial NIST SP 800-171 assessments to help you implement the additional controls required for a higher-level CMMC or track the progress to full compliance at the level your organization intends to get certified.

How Isora GRC from SaltyCloud can help

TL;DR:

Isora GRC from SaltyCloud is the powerfully simple CMMC solution making regulatory compliance easier while helping organizations improve their cyber resilience.

The race to prepare for CMMC continues as organizations work to safeguard sensitive data and meet DoD requirements. CMMC Phase 1 began on November 10, 2025, and the Department of War suspended the Phase 2 transition in July 2026.

Knowing where sensitive data resides, if it’s protected, and whether it meets the CMMC requirements warrants an agile and lightweight solution that transcends outdated GRC platforms and tedious manual spreadsheets.

Isora GRC from SaltyCloud is the powerfully simple solution changing how information security teams manage governance, risk, and compliance (GRC). A new intuitive, automated, and collaborative platform designed by GRC experts, Isora GRC helps organizations ace compliance audits, build information security culture, and strengthen cyber resilience at scale.

• Ace CMMC compliance audits with collaborative surveys, risk assessments, dynamic dashboards, and insightful reporting for auditors and leadership.
• Improve your organization’s security posture with maturity models, preloaded security frameworks, and remediation tracking.
• Protect CUI and other sensitive data with a comprehensive host inventory, robust API integrations, and continuous assessments.
• Minimize third-party risk with a complete vendor inventory, vendor risk assessment surveys, and vendor approval workflows.

Join dozens of information security teams partnering with Isora GRC from SaltyCloud to build a risk and compliance program they can trust.

Discover how companies use Isora GRC from SaltyCloud to ease the pressure of CMMC.