# Federal Contractors Seek CMMC Subcontractors

Federal contractors face a discovery gap when seeking qualified CMMC Level 2 subcontractors: firms may be hesitant to publicly identify themselves as handling controlled unclassified information (CUI), while buyers need to verify potential partners’ assessment status. The CyberAB marketplace is moving to cyberef.org, but it is not intended to function as a directory of companies with a final CMMC Level 2 C3PAO assessment, and the future of such listings is uncertain. An opt-in or anonymized matching service could help connect buyers and subcontractors, but would need reliable verification, current status information, and safeguards against exposing supplier-security information.

- Companies seeking CMMC Level 2 subcontractors should distinguish verified final C3PAO assessment status from general capability listings when evaluating potential teammates.
- An opt-in matching model could help subcontractors describe capabilities, NAICS codes, and service areas without disclosing whether they currently handle CUI; the cited proposal also identifies verification and status maintenance as key design challenges.
- This is a market-discovery issue rather than a specific contract opportunity: contractors and subcontractors can assess whether a privacy-conscious, verified directory would support their teaming and supplier qualification processes.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 11, 2026

### Government Entities
- U.S. Federal Government

### Key Quotes
> An opt-in directory could be a good middle ground. Contractors could list their capabilities, NAICS codes, service area, and verified CMMC status without disclosing whether they currently hold CUI. The biggest challenge would be verifying the status and keeping it current.
> — Community commenter

### Sources
- [Federal Work requiring CMMC2](https://www.reddit.com/r/CMMC/comments/1x396hd/federal_work_requiring_cmmc2) - reddit-cmmc