# DoD Applies CMMC to Contract Awards

A social-media post claims that DoD contracts now require the applicable CMMC Level 1 self-assessment or Level 2 third-party C3PAO certification before award, with requirements flowing down to subcontractors. The post provides no official rule citation, solicitation language, or effective date, so it does not establish that these conditions apply universally or confirm their current status. Contractors should check the specific solicitation and contract clauses to determine which CMMC requirements apply to their work and subcontracting chain.

- For solicitations that include applicable CMMC clauses, the stated assessment or certification level may be an award eligibility condition; subcontractors may also be affected through flow-down clauses.
- Prime contractors and subcontractors should review the solicitation and proposed contract language to identify the required CMMC level and which entities in the supply chain are covered.
- Because the claim is not accompanied by an official citation or effective date, do not rely on the post alone to determine eligibility or compliance obligations.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 08, 2026

### Government Entities
- U.S. Department of Defense (DoD)

### Sources
- [CMMC 2.0 is live in DoD contracts. The clause now requires Level 1 self-assessment or Level 2 third party C3PAO certification before award, and it flows down to subcontractors. No certification, no contract.

Follow me on SuperCool: https://t.co/okGyJxwrIv https://t.co/ecEX7AzY5V](https://x.com/ArrakisConsult/status/2119327088150802575) - twitter-defense