CMMC Compliance for Houston Contractors: Levels, Costs, and the Phase 2 Deadline

CMMC compliance for Houston DoD suppliers: Level 1 vs Level 2, what Phase 2 changed on Nov 10, 2026, DoD’s own cost estimates, and a readiness checklist.

By Scott McAuley · Nov 12, 2026 · 12 min read

Ask the owner of a Houston machine shop, fabricator, or engineering firm whether they need CMMC and you'll usually hear one of two answers: "We're too small for that," or "Our prime handles it." Both used to be survivable. As of this month, neither is.

CMMC compliance is now a condition of winning Department of Defense work, not a checkbox you get to later. CMMC (the Cybersecurity Maturity Model Certification) requires every DoD contractor and subcontractor that handles Federal Contract Information or Controlled Unclassified Information to prove a specific level of cybersecurity, and on November 10, 2026 the program entered Phase 2, when third-party Level 2 certifications start appearing in contracts. This article expands the compliance-overlays chapter of our small business cybersecurity guide into working detail for Houston-area defense suppliers: which level applies to you, what changed this month, what DoD itself estimates it costs, and a readiness checklist you can hand to whoever runs your IT.

What Is CMMC Compliance?

CMMC is the Department of Defense's program for verifying that companies in its supply chain actually protect the government information they receive. It is codified in federal regulation at 32 CFR Part 170, published as a final rule on October 15, 2024 and effective December 16, 2024. A companion acquisition rule in the Defense Federal Acquisition Regulation Supplement (DFARS) puts the requirement into contracts.

The important shift is from trust to verify. Defense contractors have been contractually required to protect this information for years through DFARS clause 252.204-7012 and FAR clause 52.204-21. What was missing was proof. CMMC adds assessments, signed affirmations from a senior company official, and results posted in the Supplier Performance Risk System (SPRS), where contracting officers check them before award.

Two kinds of information decide everything:

• Federal Contract Information (FCI) — information provided by or generated for the government under a contract that isn't intended for public release. Most companies with a DoD contract or subcontract have some.
• Controlled Unclassified Information (CUI) — a narrower, more sensitive category: technical drawings, specifications, export-controlled data, and similar material the government has marked for protection. If you machine parts from controlled drawings, you almost certainly handle CUI.

The Three CMMC Levels, Side by Side

| Level | Protects | Requirements | Assessment | How often |

|---|---|---|---|---|

| Level 1 | FCI | 15 safeguarding requirements from FAR 52.204-21 | Self-assessment | Every year, with annual affirmation |

| Level 2 | CUI | 110 requirements from NIST SP 800-171 Rev. 2 | Self-assessment or C3PAO certification, as the contract specifies | Every 3 years, with annual affirmation |

| Level 3 | CUI in the highest-priority programs | Level 2 plus 24 selected requirements from NIST SP 800-172 | Government assessment (DIBCAC) | Every 3 years, with annual affirmation |

Level 1 is basic hygiene: limit system access to authorized users, authenticate them, sanitize media before disposal, control physical access, keep malware protection current, and patch. Plans of Action and Milestones (POA&Ms) are not permitted at Level 1. You meet all 15 requirements or you don't qualify.

Level 2 is where most Houston suppliers land, because anyone touching controlled drawings or specs is handling CUI. The 110 requirements come from NIST SP 800-171 Revision 2 and cover access control, audit logging, configuration management, incident response, media protection, encryption, personnel security, and more. The contract decides whether a self-assessment is enough or whether you need a certification from a CMMC Third-Party Assessment Organization (C3PAO).

Level 3 applies to a small set of high-priority programs and is assessed by the government's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). You need a Level 2 certification first.

What Changed on November 10, 2026?

CMMC rolls out in four phases, each starting one calendar year after the last. Phase 1 began on November 10, 2025, the effective date of the DFARS acquisition rule published September 10, 2025. During Phase 1, solicitations began requiring Level 1 and Level 2 self-assessments.

Phase 2 started November 10, 2026. From here, DoD includes Level 2 C3PAO certification as a condition of award in applicable solicitations. Phase 3 follows in November 2027 and brings Level 3 requirements; Phase 4, full implementation, follows a year after that.

The practical consequence for a subcontractor is timing. The requirement shows up in the solicitation, and a contracting officer checks SPRS for a current status before award. If you start preparing when the RFQ arrives, you're already late: a Level 2 program for a small company is a project measured in months before an assessor is ever scheduled, and only authorized C3PAOs can perform the certification.

Does CMMC Apply to Subcontractors?

Yes. The CMMC requirements flow down. The DFARS clause requires prime contractors to pass the CMMC requirement to subcontractors whose work involves FCI or CUI, and the rule at 32 CFR 170.23 sets out what level each tier needs. A prime cannot "cover" a subcontractor's systems; your own systems that store, process, or transmit the information are assessed on their own.

Three situations catch Houston firms off guard:

• You're a second- or third-tier supplier. A machine shop in Pasadena that receives a drawing package from a Tier 1 aerospace supplier is in the flow-down chain, even if it has never signed anything with DoD directly.
• Your energy work has a defense side. Plenty of Houston fabrication and engineering firms that mostly serve oil and gas also build components for defense customers. The CMMC requirement attaches to the DoD contracts, but the systems that touch that data are in scope.
• NASA work is different. Space-sector work around Clear Lake and Webster is often for NASA rather than DoD. CMMC is a DoD program; a NASA contract on its own doesn't trigger it. Many suppliers serve both, though, and the defense side does.

If you can't tell which information you hold, ask your prime contractor directly what the contract designates as CUI and which CMMC level and assessment type they're flowing down. Get the answer in writing.

What Does CMMC Certification Cost?

DoD published its own cost estimates in the regulatory analysis of the final rule. These figures cover the assessment and affirmations only, and they assume you have already implemented the required controls. They do not include the cost of getting compliant.

| Assessment | DoD estimate for a small entity |

|---|---|

| Level 1 self-assessment and affirmation | About $5,977 per year |

| Level 2 self-assessment, three-year cycle | About $37,196 (an initial $34,277 plus two annual affirmations at $1,459) |

| Level 2 C3PAO certification, three-year cycle | About $104,670 (an initial $101,752 plus two annual affirmations at $1,459) |

All three figures come from the 32 CFR Part 170 final rule. DoD built them from labor hours for internal staff, an outside service provider, and the assessor.

The bigger and more variable number is implementation: closing the gaps between where your systems are and what the 110 requirements demand. That depends on the size of your environment, how much CUI moves through it, and whether you protect the whole company or a separate enclave. Typical cost lines:

• Gap assessment and scoping — mapping where CUI lives and scoring yourself against NIST SP 800-171.
• Technical remediation — multi-factor authentication everywhere, centralized logging, endpoint protection, encryption, configuration baselines, and network segmentation.
• A compliant cloud environment — DFARS 252.204-7012 requires cloud services that store CUI to meet the FedRAMP Moderate baseline or its equivalent. For Microsoft shops this usually means a government cloud tenant such as GCC High, which is priced and licensed differently from commercial Microsoft 365.
• Documentation — a System Security Plan, policies, and evidence that each control works.
• Ongoing operation — monitoring, patching, log review, and the annual affirmation. CMMC isn't a project you finish; a senior official affirms continuing compliance every year.

Ask any consultant for pricing in those lines, separated, before you sign anything. Including anything with us.

How Do You Get Ready for a Level 2 Assessment?

The order of operations matters more than the tools. Scoping and documentation decide more of the outcome than any product you buy.

Scope first. Identify every system, person, and service that stores, processes, or transmits CUI, including services from External Service Providers such as your IT provider and your cloud platforms. The rule makes those part of the assessment scope. A smaller scope is cheaper to protect and to assess, which is why many small manufacturers isolate CUI into an enclave instead of hardening the entire company.

Score yourself honestly. Run a self-assessment against all 110 requirements using DoD's assessment methodology and post the score in SPRS. Many contracts already require a current SPRS score. An inflated score is a real liability: the senior official's affirmation is a statement to the federal government.

Write the System Security Plan. The SSP describes your environment and how each requirement is met. Assessors test against it. If a control isn't in the SSP, for assessment purposes it doesn't exist.

Close the gaps, then gather evidence. Screenshots, configuration exports, logs, training records, signed policies. Assessors want proof that a control operates, not that someone intended it to.

Know the conditional rules. A Level 2 assessment can end in Conditional status if you score at least 80 percent (88 of 110) and the open items are eligible for a Plan of Action and Milestones. Every POA&M item must be closed within 180 days, or the conditional status expires. Plan to pass outright; treat the POA&M as a safety net, not a strategy.

Where Houston Contractors Get Stuck

Shared drives full of drawings. CUI tends to spread: emailed to estimators, copied to a shop-floor PC, synced to a personal laptop. Before you protect it, find it. Then reduce where it can go.

Commercial cloud tenants. A shop running ordinary Microsoft 365 Business that stores controlled drawings in it has a scoping problem. Moving CUI into a FedRAMP Moderate-equivalent environment, or keeping it out of the cloud entirely, is often the single largest decision in the project. Our walkthrough of cloud managed IT services in Houston covers the shared-responsibility side of that choice.

Shop-floor equipment. CNC controllers, coordinate measuring machines, and other operational technology often can't be patched on an office schedule. The rule treats some of this as Specialized Assets with different handling, but they still have to be inventoried and documented in your SSP.

Logging nobody reads. Several NIST SP 800-171 requirements cover audit logging and review. A log nobody reviews doesn't meet them. This is where endpoint detection and response and a monitored security operation earn their keep.

No incident plan. CMMC expects a working incident response capability, and DFARS 252.204-7012 already requires reporting cyber incidents to DoD. A one-page plan people have actually practiced beats a binder; our incident response plan template is a practical starting point.

Locally: the defense supply chain around Houston runs from aerospace suppliers near Clear Lake and League City to machine shops and fabricators along the Ship Channel in Pasadena and specialty engineering firms in Katy and The Woodlands. Most of them are small, most run lean IT, and most handle CUI through drawing packages. That profile is exactly what Level 2 was written for.

The CMMC Readiness Checklist

Hand this to whoever runs your IT and have them mark each line done, scheduled, or not applicable.

Scope and contracts

• Confirm in writing from each prime which information is CUI and which CMMC level and assessment type applies
• Map every system, cloud service, and outside provider that touches FCI or CUI
• Decide between protecting the whole company and building a CUI enclave

Status and paperwork

• Current self-assessment score posted in SPRS
• System Security Plan covering all 110 requirements, matching the real environment
• Named senior official who understands what the annual affirmation means

Technical controls

• Multi-factor authentication on every account that can reach CUI, including remote access
• CUI stored only in a FedRAMP Moderate-equivalent cloud or controlled on-premises systems
• Endpoint protection, centralized logging, and someone assigned to review the logs
• Encryption for CUI at rest and in transit, configuration baselines, and timely patching
• Shop-floor and specialty equipment inventoried and documented in the SSP

People and process

• Security awareness training with records
• An incident response plan, tested, including how you would report to DoD
• A dated plan for closing every open gap before your C3PAO assessment

Where This Lands

CMMC Phase 2 turns a long-standing contract obligation into something checked before award, and for most Houston defense suppliers the target is Level 2. The broader security baseline that sits under all of this is laid out in our small business cybersecurity guide, and the industry-specific view for shops and fabricators is in our manufacturing IT overview.

This is standing work for our compliance support practice: we scope where your CUI actually lives, score you against NIST SP 800-171, close the technical gaps through our cybersecurity services, write the SSP with you, and hand you the findings in writing before an assessor ever sees them. Certification itself comes from an authorized C3PAO that is independent of whoever helped you prepare; the program is built that way on purpose. If Microsoft 365 is the hardest part of your environment, Scott McAuley's notes on Microsoft 365 security hardening go deeper on tenant configuration. Start with scoping. Everything else gets cheaper once you know where the drawings are.

Scott McAuley is the founder and CEO of Texas Management Group, and founder of Talos Automation and Talk Is Cheap — 25+ years running IT, communications, and automation for Texas businesses.

Frequently Asked Questions

Do small businesses need CMMC compliance?

Yes, if they hold a DoD contract or subcontract that involves Federal Contract Information or Controlled Unclassified Information. There is no size exemption. DoD did publish separate cost estimates for small entities, but the 15 Level 1 requirements and the 110 Level 2 requirements are the same for a 12-person machine shop as for a large prime.

What is the difference between CMMC Level 1 and Level 2?

Level 1 protects Federal Contract Information with 15 basic safeguarding requirements and an annual self-assessment, with no open items allowed. Level 2 protects Controlled Unclassified Information with the 110 requirements of NIST SP 800-171 Rev. 2, assessed every three years either by self-assessment or by a C3PAO, as the contract specifies.

When does CMMC Level 2 certification become required?

Phase 2 of the rollout began November 10, 2026. From that date DoD includes Level 2 certification by a C3PAO as a condition of award in applicable solicitations. Which contracts require certification rather than a self-assessment is set in each solicitation, so check every RFQ and ask your prime what they are flowing down.

How much does CMMC Level 2 certification cost?

DoD estimates about $104,670 over a three-year cycle for a small entity's C3PAO certification, including two annual affirmations, and about $37,196 for a Level 2 self-assessment cycle. Those figures assume the controls are already in place. Implementation, the work of closing gaps, is usually the larger cost and varies with your environment.

Can we pass CMMC Level 2 with open items?

Sometimes. A score of at least 80 percent, 88 of 110, with only eligible items open earns Conditional status and a Plan of Action and Milestones. Every open item must be closed within 180 days or the conditional status expires. Level 1 allows no open items at all.