CMMC and UK Cyber Essentials: defense cyber baselines

Hugues Orgitello updated 7 Oct 2026 20 min read

Two government-backed cyber baselines condition access to defense and public-sector supply chains on either side of the Atlantic: CMMC (Cybersecurity Maturity Model Certification), codified in 32 CFR Part 170 and written into US DoD (Department of Defense) contracts through DFARS 252.204-7021, and Cyber Essentials with its tested tier Cyber Essentials Plus, owned by the UK NCSC and delivered by the IASME Consortium. Both assess the supplier's own information systems, not the product it ships. For electronics manufacturers and integrators selling into defense or government programs, the timing matters now: the US rollout reached Phase 1 on November 10, 2025 and Phase 2, which brings third-party Level 2 assessments into solicitations, begins on November 10, 2026, while the UK requirements moved to version 3.3 (question set Danzell) on April 27, 2026. This guide sets out what the texts require, the dates, and the readings they contradict.

Timeline: what applies when

Date	Event	Source
2014	UK central government starts requiring Cyber Essentials (or equivalent controls) for certain contracts, under PPN 09/14	PPN 014, paragraph 1
April 1, 2020	IASME becomes the sole NCSC Cyber Essentials partner, replacing several delivery bodies	IASME and NCSC partnership notice
November 30, 2020	DFARS 252.204-7019 and 252.204-7020 take effect: NIST SP 800-171 self-assessment scores posted in SPRS	85 FR 61505
January 16, 2023	NIS 2 Directive (EU) 2022/2555 enters into force	Directive (EU) 2022/2555, Article 45
September 19, 2023	PPN 09/23 replaces PPN 09/14	gov.uk
May 14, 2024	NIST withdraws SP 800-171 Rev. 2, superseded by Rev. 3; MOD publishes Def Stan 05-138 Issue 4	NIST CSRC; Def Stan 05-138
October 15, 2024	CMMC Program rule published (89 FR 83092)	Federal Register
October 18, 2024	Member States apply their NIS 2 transposition measures	Directive (EU) 2022/2555, Article 41
December 16, 2024	32 CFR Part 170 takes effect	Federal Register
January 17, 2025	DORA, Regulation (EU) 2022/2554, applies	Regulation (EU) 2022/2554, Article 64
February 17, 2025	PPN 014 published, for procurements commenced from February 24, 2025 under the Procurement Act 2023	gov.uk
April 28, 2025	Cyber Essentials requirements v3.2 (question set Willow)	NCSC, IASME
September 10, 2025	DFARS CMMC acquisition rule published (90 FR 43560)	Federal Register
November 10, 2025	DFARS rule effective; CMMC Phase 1 begins	Federal Register; 32 CFR 170.3(e)(1)
April 27, 2026	Cyber Essentials requirements v3.3 (question set Danzell)	NCSC, IASME
May 13, 2026	NIST withdraws SP 800-172 (February 2021), superseded by SP 800-172 Rev. 3	NIST CSRC
November 10, 2026	CMMC Phase 2: Level 2 (C3PAO) intended as a condition of award	32 CFR 170.3(e)(2)
November 10, 2027	CMMC Phase 3: Level 2 (C3PAO) for all applicable contracts, Level 3 (DIBCAC) intended	32 CFR 170.3(e)(3)
November 10, 2028	CMMC Phase 4: full implementation, including option periods on older contracts	32 CFR 170.3(e)(4)

Phases 2 to 4 are each defined in 32 CFR 170.3(e) as starting "one calendar year following the start date" of the previous phase, so the dates above are derived from the November 10, 2025 start of Phase 1.

CMMC: the US Defense Industrial Base baseline

Regulatory anchor: 32 CFR Part 170 and DFARS subpart 204.75

The program rule is 32 CFR Part 170, published on October 15, 2024 and effective December 16, 2024. It defines the levels, the assessment types, scoping, the scoring methodology and the assessment ecosystem (Cyber AB as accreditation body, C3PAOs, certified assessors). The contracting side is in DFARS subpart 204.75, the clause 252.204-7021 (Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements, NOV 2025) and the solicitation provision 252.204-7025 (Notice of CMMC Level Requirements, NOV 2025). Under DFARS 204.7502, a contracting officer may not award to an bidder without a current CMMC status in SPRS at the required level or higher, for each contractor information system that will handle FCI or CUI. The bidder lists those systems by CMMC UID, a 10-character identifier issued by SPRS.

Two categories of federal information drive scope:

• FCI (Federal Contract Information): information not intended for public release, provided by or generated for the government under a contract.
• CUI (Controlled Unclassified Information): information that a law, regulation or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls (32 CFR 2002.4(h), as quoted in the DFARS clause).

Under 32 CFR 170.3, the program applies to contracts above the micro-purchase threshold, except those exclusively for COTS items. The program manager or requiring activity chooses the level based on the type of information involved; the contractor does not pick its own level. Under 32 CFR 170.23, primes must flow the requirement down to every tier that handles FCI or CUI.

The seven CMMC statuses

The DFARS clause lists seven possible statuses. The table below gathers what 32 CFR 170.15 to 170.18, 170.21 and 170.22 say about each level.

Status	Requirement set	Assessed by	POA&M	Reassessment	Affirmation
Final Level 1 (Self)	15 requirements of FAR 52.204-21	The contractor	Not permitted	Every year	At each assessment, then annually
Conditional or Final Level 2 (Self)	110 requirements of NIST SP 800-171 Rev. 2	The contractor	Permitted under 170.21(a)(2)	Every three years	At each assessment, then annually
Conditional or Final Level 2 (C3PAO)	Same 110 requirements	Authorized or accredited C3PAO	Permitted under 170.21(a)(2)	Every three years	At each assessment, then annually
Conditional or Final Level 3 (DIBCAC)	24 selected requirements of NIST SP 800-172 (February 2021)	DCMA DIBCAC	Permitted under 170.21(a)(3)	Every three years, plus a new Level 2 (C3PAO) assessment	At each assessment, then annually

Assessment artefacts must be kept for six years from the CMMC Status Date (170.15(c)(2) and 170.16(c)(4)). Affirmations are made in SPRS by an Affirming Official, the senior representative responsible for compliance (170.22).

Level 1

Level 1 applies when only FCI is handled. Its 15 requirements come from FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems; 32 CFR 170.15 maps them onto 17 NIST SP 800-171 requirements, because the physical access requirement is split into three phrases. They cover access limited to authorized users, control of external connections and of publicly posted information, identification and authentication, sanitizing media before disposal, physical access with visitor escort and access logs, boundary protection, separation of publicly accessible systems, flaw remediation, malicious code protection and scanning. Every requirement must be MET; no POA&M is allowed.

Level 2

Level 2 applies when CUI is handled. It uses the 110 requirements of NIST SP 800-171 Rev. 2 (February 2020, including updates as of January 28, 2021), organised in 14 families: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.

Scoring under 32 CFR 170.24 starts from 110 and subtracts the value of each NOT MET requirement (5, 3 or 1 points), so a score can be negative. The solicitation states whether Level 2 (Self) or Level 2 (C3PAO) is required. Both statuses are valid for three years with an annual affirmation. A subcontractor handling CUI under a prime contract that requires Level 2 (C3PAO) or Level 3 must hold at least Level 2 (C3PAO) (170.23).

Scoping (170.19(c)) sorts assets into CUI assets, security protection assets, contractor risk managed assets, specialized assets and out-of-scope assets. For electronics companies, the specialized assets category matters: IoT and IIoT devices, operational technology and test equipment that can handle CUI but cannot be fully secured must be listed in the asset inventory and the SSP, shown to be managed under the contractor's risk-based policies, and are not assessed against the other requirements.

Level 3

Level 3 adds 24 selected requirements from NIST SP 800-172 (February 2021), listed in table 1 to 32 CFR 170.14(c)(4). The assessor is DCMA DIBCAC (Defense Contract Management Agency, Defense Industrial Base Cybersecurity Assessment Center). A Final Level 2 (C3PAO) status on the Level 3 scope is a prerequisite, and recertification at Level 3 also requires a new Level 2 (C3PAO) assessment (170.18).

POA&M and conditional status: the exact rules

32 CFR 170.21 sets precise conditions for a Conditional status:

Level	Minimum score	What may be on the POA&M	Never on the POA&M
Level 1	Not applicable	Nothing	All requirements
Level 2 (Self or C3PAO)	Score divided by 110 at least 0.8	Only 1-point requirements, plus SC.L2-3.13.11 when encryption is used but not FIPS-validated (3 points)	AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4 (System Security Plan), PE.L2-3.10.3, PE.L2-3.10.4, PE.L2-3.10.5
Level 3 (DIBCAC)	Score divided by 24 at least 0.8	Other Level 3 requirements	IR.L3-3.6.1e, IR.L3-3.6.2e, RA.L3-3.11.1e, RA.L3-3.11.4e, RA.L3-3.11.6e, RA.L3-3.11.7e, SI.L3-3.14.3e

A POA&M close-out assessment must confirm remediation within 180 days of the Conditional CMMC Status Date. If it does not, the Conditional status expires; during a contract, standard contractual remedies apply and the contractor is ineligible for new awards at that level until it obtains a new status. DFARS 204.7502(b)(2) confirms that award may occur with a Conditional status at Levels 2 and 3, but Level 1 requires a Final status.

SPRS and the existing NIST SP 800-171 self-assessment

Since November 30, 2020, DFARS 252.204-7019 and 252.204-7020 have required contractors subject to 252.204-7012 to post a current NIST SP 800-171 assessment score in SPRS (Supplier Performance Risk System). CMMC Level 2 uses the same 110 requirements and the same point values, but adds the status categories, the POA&M limits, the annual affirmation and, where the contract says so, third-party assessment. Under 32 CFR 170.20, a DCMA DIBCAC High Assessment completed before December 16, 2024 with a perfect score and no open POA&M is converted into a Final Level 2 (C3PAO) status, valid three years from the original assessment date. That is the only equivalence the rule grants.

CMMC cost: where to look

The DoD published its own cost estimates, by level and assessment type, in the regulatory analysis of the final rule (89 FR 83092). Actual cost depends on the size of the CUI environment, the existing security posture and the assessment type the contract requires. Refer to the published DoD analysis rather than to figures quoted for a single scoping case.

UK Cyber Essentials: the UK baseline

Institutional anchor: NCSC and IASME

The scheme belongs to the NCSC (National Cyber Security Centre, part of GCHQ), which publishes the technical requirements. Since April 1, 2020 the IASME Consortium has been the single NCSC Cyber Essentials partner; NCSC now calls it the official Cyber Essentials Delivery Partner. IASME licenses the Certification Bodies whose assessors verify self-assessments and run the Plus tests. Before 2020, several bodies delivered the scheme.

Where Cyber Essentials is required

• UK central government: PPN 014 (February 17, 2025), for procurements commenced from February 24, 2025 under the Procurement Act 2023, and PPN 09/23 (September 19, 2023) for earlier ones, apply to central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. Suppliers must hold Cyber Essentials or Cyber Essentials Plus, or demonstrate equivalent controls, for contracts that handle citizens' or government employees' personal information, supply ICT systems designed to store or process OFFICIAL data, or deal with information on the day-to-day business of government. Where certification is required, it must be renewed annually for the duration of the contract. The PPN also says the scheme must not be applied to all contracts as a matter of course.
• UK Ministry of Defence: Def Stan 05-138 Issue 4 (May 14, 2024) replaced the five Cyber Risk Profiles (N/A, Very Low, Low, Moderate, High) with four levels:

Def Stan 05-138 Issue 4 level	Number of controls	Cyber Essentials (control 0001)	Cyber Essentials Plus (control 0002)
Level 0, Basic	3	Required	Not required
Level 1, Foundational	101	Required	Not required
Level 2, Advanced	139	Required	Required
Level 3, Expert	144	Required	Required

In each case the certification must cover the scope required for all aspects of the contract and be maintained for the contract duration.

Five technical controls (requirements v3.3)

Cyber Essentials: Requirements for IT Infrastructure v3.3, effective April 27, 2026, organises the requirements under five controls:

1. Firewalls: every in-scope device protected by a correctly configured firewall or network device with firewall functionality; default administrative passwords changed or remote administration disabled; administrative interface not reachable from the internet unless there is a documented business need and MFA or an IP allow list; unauthenticated inbound connections blocked by default; inbound rules approved and documented.
2. Secure configuration: unnecessary accounts and software removed or disabled; default passwords changed; auto-run that executes files without user authorization disabled; device unlocking protected against brute force (no more than 10 guesses in 5 minutes, or lock after no more than 10 attempts); a PIN or password of at least 6 characters when it only unlocks the device.
3. Security update management: software licensed and supported, removed when unsupported, automatic updates enabled where possible, and updates installed within 14 days of release when they fix vulnerabilities the vendor rates critical or high risk, have a CVSS v3 base score of 7 or above, or come without severity details.
4. User access control: account creation and approval process, unique credentials, separate accounts for administration, MFA where available and always for cloud services; passwords protected by MFA, or at least 12 characters, or at least 8 characters with a deny list of common passwords.
5. Malware protection: anti-malware software (for Windows and macOS devices, including servers) configured to prevent malware running and block connections to malicious websites, or application allow listing restricted by code signing.

Scope rules worth checking early: a scope without end-user devices is not acceptable; cloud services hosting organisational data cannot be excluded; BYOD devices that access organisational data or services are in scope, except devices used only for native voice, native text or MFA applications; home routers supplied by the organisation are in scope.

What changed in 2025 and 2026

Version	Applies from	Question set	Main changes in the texts
Requirements v3.2	April 28, 2025	Willow	"Plug-ins" renamed "extensions"; home working broadened to home and remote working; passwordless authentication added; "vulnerability fixes" defined; Plus test specification renamed and requires scope, sub-set segregation and sample size to be verified
Requirements v3.3	April 27, 2026 (accounts created after April 26, 2026)	Danzell	Cloud service defined; cloud services cannot be excluded from scope; FIDO2 authenticators treated as passwordless and MFA; Software Security Code of Practice referenced; backups emphasised (recommended, not required); IASME makes MFA on cloud services and the 14-day update questions A6.4 and A6.5 automatic failures

IASME states that organisations with an assessment account created before the change have six months to certify under the previous requirements.

Cyber Essentials, self-assessment tier

The applicant answers the IASME question set for the agreed scope (whole organisation or a well-defined, separately managed sub-set), and an independent Certification Body verifies the answers. PPN 014 describes it as a self-assessment that "offers a basic level of assurance". The certificate records the state of the organisation at a point in time; the Danzell update clarified that this point is the certificate issue date.

Cyber Essentials Plus, tested tier

The Cyber Essentials Plus Test Specification v3.2 requires the assessor first to check that the Plus scope matches a valid Cyber Essentials self-assessment certificate, verify sub-set segregation by technical means, and calculate the device sample with the Delivery Partner method. The test cases are:

Test case	What is tested	Fail condition (summary)
1. Remote vulnerability assessment	All internet-facing IP addresses, including IaaS, with an approved scanner	An exploitable internet-accessible service
2. Authenticated vulnerability scan	Sampled end-user devices, servers and IaaS instances	A critical, high-risk, CVSS 7+ or unrated vulnerability with a fix available for more than 14 days
3. Malware protection	Test files by email and by browser, or checks of application allow listing	A malware test file reaches the user unblocked, or an executable runs without an extra prompt
4. Multi-factor authentication	Each authentication service for cloud services, for user and administrator access, from an untrusted device or incognito session	The user or administrator is not prompted for MFA before access
5. Account separation	A standard user attempts an administrative process on every sampled device	The process runs without an additional administrative login

Any single failed sub-test fails the assessment as a whole, unless the specification states an exception. Under Danzell, IASME also requires new random samples when Plus tests are repeated.

IASME Cyber Assurance

IASME also runs a separate scheme, IASME Cyber Assurance. Neither PPN 014 nor Def Stan 05-138 Issue 4 lists it as a substitute for Cyber Essentials.

CMMC and Cyber Essentials side by side

Criterion	CMMC	Cyber Essentials / Plus
Legal basis	32 CFR Part 170; DFARS 252.204-7021 and 252.204-7025	NCSC scheme; PPN 014 or PPN 09/23; Def Stan 05-138 for MOD
Governance	DoD CIO, Cyber AB, C3PAOs, DCMA DIBCAC	NCSC, IASME as Delivery Partner, Certification Bodies
Levels	Level 1, Level 2 (Self or C3PAO), Level 3 (DIBCAC)	Cyber Essentials, Cyber Essentials Plus
Requirement set	FAR 52.204-21 (L1), NIST SP 800-171 Rev. 2 (L2), 24 requirements of NIST SP 800-172 (L3)	Requirements for IT Infrastructure v3.3, five controls
Assessment	Self-assessment, C3PAO or DIBCAC as stated in the solicitation	Verified self-assessment; technical tests for Plus
Cycle	L1 annual; L2 and L3 every three years; affirmation every year	Annual renewal required by PPN 014 for the contract duration
Information in scope	FCI (L1), CUI (L2, L3)	All IT used for the business, or a defined sub-set
Conditional pass	POA&M with 180-day close-out at L2 and L3	None: any failed Plus sub-test fails the assessment
Recognition of other schemes	Only DIBCAC High assessments (170.20)	Equivalent controls may be accepted by a buyer under the PPN

Neither scheme recognizes the other. A supplier bidding on both US DoD and UK government contracts handles both.

Cross-program considerations

ISO/IEC 27001 helps with evidence, but is not equivalence

ISO/IEC 27001 is a risk-based management system standard. A mature ISMS supplies policies, risk assessments, incident response and access review records that both schemes ask for. 32 CFR 170.20 grants equivalence only to prior DCMA DIBCAC High assessments, and the Cyber Essentials technical requirements are prescriptive controls checked against the agreed scope. An ISO/IEC 27001 certificate therefore does not deliver a CMMC status or a Cyber Essentials certificate.

NIS 2 and DORA: adjacent EU regimes

• NIS 2, Directive (EU) 2022/2555, entered into force on January 16, 2023; Member States had to adopt their measures by October 17, 2024 and apply them from October 18, 2024. It covers essential and important entities in the sectors listed in its annexes, including some manufacturing and digital infrastructure activities.
• DORA, Regulation (EU) 2022/2554, applies from January 17, 2025 to financial entities and sets an oversight framework for critical ICT third-party service providers.

Both regimes impose organisational cybersecurity obligations with their own supervision, and neither recognizes CMMC or Cyber Essentials as compliance.

Product cyber versus corporate cyber

PPN 014 states plainly that the Cyber Essentials scheme "does not assure specific products or services being supplied", and 32 CFR Part 170 scopes contractor information systems. Product-side cybersecurity for radio-enabled and connected products comes from other regimes:

• in the EU, the Radio Equipment Directive (RED) Article 3(3)(d), (e), (f) delegated act, applicable from August 1, 2025, with harmonised standard EN 18031 cited with restrictions (see RED Article 3(3)(d-f) cybersecurity),
• in the EU, the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847), with reporting obligations from September 11, 2026 and full application from December 11, 2027, covered in Cyber Resilience Act (CRA),
• for industrial automation, the IEC 62443 series, covered in IEC 62443,
• for consumer IoT, ETSI EN 303 645, covered in EN 303 645 IoT cybersecurity,
• for cryptographic modules, FIPS 140-3, covered in FIPS 140-3 cryptographic modules,
• for higher-assurance product evaluation, Common Criteria (ISO/IEC 15408), covered in Common Criteria ISO 15408, and the French CSPN scheme in CSPN ANSSI.

A defense supplier addresses both axes: corporate cyber through CMMC or Cyber Essentials, and product cyber through the regime that applies to what it ships. See Product cybersecurity explained for the product side.

Claims the texts contradict

Common claim (including earlier versions of this page)	What the text says
"CMMC 2.0" is the name of the regulation	32 CFR Part 170 is titled "Cybersecurity Maturity Model Certification (CMMC) Program" and does not use "2.0"
The DFARS clause is phased in "through 2027"	Phase 4, full implementation, starts one year after Phase 3, which gives November 10, 2028 (32 CFR 170.3(e))
A Level 2 self-assessment is valid for one year	Level 2 (Self) is reassessed every three years, with an affirmation each year (170.16)
NIST SP 800-171 Rev. 2 has 11 families	It has 14 families of requirements
Level 3 takes "about 24 of the 35" NIST SP 800-172 practices	Table 1 to 170.14(c)(4) lists exactly 24 requirements, and Level 3 requires Final Level 2 (C3PAO) first
POA&M is allowed if the score reaches "typically 80%" and only 5-point practices are excluded	The threshold is a ratio of at least 0.8; only 1-point requirements are eligible (plus SC.L2-3.13.11 when encryption is not FIPS-validated), and six named Level 2 requirements are always excluded (170.21)
An unclosed POA&M "invalidates a certificate" and forces a full reassessment	The Conditional status expires after 180 days; the contractor is ineligible for new awards at that level until it achieves a new status (170.16, 170.17)
CMMC moved to NIST SP 800-171 Rev. 3	The rule incorporates Rev. 2 and SP 800-172 (February 2021) by reference, although NIST has withdrawn both (May 14, 2024 and May 13, 2026)
IASME is the "sole accreditation body" whose own assessors certify companies	NCSC describes IASME as its Cyber Essentials Delivery Partner; certification is awarded by Certification Bodies licensed by IASME
Cyber Essentials malware protection can rely on sandboxing	Requirements v3.3 list two options only: anti-malware software and application allow listing
Cyber Essentials Plus includes a "browser and email client configuration test"	The v3.2 test specification has five test cases: remote vulnerability assessment, authenticated scan, malware protection, MFA and account separation
MOD requires Plus only for "more sensitive tiers" without a defined rule	Def Stan 05-138 Issue 4 requires Cyber Essentials at all four levels and Plus at Levels 2 and 3
Cyber Essentials is required for every UK government contract	PPN 014 limits it to contracts with defined characteristics, accepts equivalent controls and forbids a blanket approach
An ISO/IEC 27001 certificate, or a CMMC status, satisfies the other scheme	32 CFR 170.20 recognizes only DIBCAC High assessments; neither PPN nor Def Stan lists CMMC or ISO/IEC 27001 as a substitute

See also

• PSA Certified: Arm-led IoT security baseline
• SESIP: IoT platform security evaluation methodology
• TPM 2.0 and TCG hardware security
• Cyber Resilience Act (CRA): EU baseline for digital
• IEC 62443 industrial cybersecurity
• Product cybersecurity explained

Working through this on a real product? AESTECHNO can audit your design and certification plan. Get in touch

Recurring pitfalls

1. Treating CMMC as product cybersecurity. CMMC assesses the contractor information systems that handle FCI or CUI. Implementing IEC 62443 on a product line does not produce a CMMC status, and vice versa.
2. A missing or weak System Security Plan. CA.L2-3.12.4 (System Security Plan) can never be placed on a POA&M under 170.21, so a Level 2 assessment cannot reach Conditional status without one. The SSP also has to document specialized assets such as test equipment and IoT devices.
3. Letting the 180-day window run out. The Conditional status expires if the close-out assessment is not completed within 180 days of the Conditional CMMC Status Date.
4. Forgetting the annual affirmation. Even with a three-year Level 2 or Level 3 status, the DFARS definition of "current" requires an affirmation of continuous compliance not older than one year.
5. Ignoring Phase 2. From November 10, 2026, solicitations are intended to require Level 2 (C3PAO) as a condition of award where applicable. Assessment capacity and remediation time need to be planned before the bid, not after.
6. Leaving cloud services or end-user devices out of the Cyber Essentials scope. Requirements v3.3 make both exclusions unacceptable.
7. Missing MFA on a cloud service, or a 14-day update. Under the Danzell question set, these answers are automatic failures.
8. Assuming a Plus test can be passed by patching only the sampled devices. The assessor scans a representative sample, and under Danzell repeated tests use new random samples.
9. Underestimating BYOD. Personal devices accessing organisational data or services are in scope unless they are used only for native voice, native text or MFA applications.
10. Letting certificates lapse. PPN 014 and Def Stan 05-138 require Cyber Essentials to be maintained or renewed annually for the contract duration; a CMMC status that is not current in SPRS blocks award and option exercise (DFARS 204.7503).

Key takeaways

• CMMC is codified in 32 CFR Part 170 (effective December 16, 2024) and enforced through DFARS 252.204-7021 and 252.204-7025 (effective November 10, 2025). Phase 2 starts November 10, 2026; full implementation from November 10, 2028.
• Level 1: 15 FAR 52.204-21 requirements, annual self-assessment, no POA&M. Level 2: 110 NIST SP 800-171 Rev. 2 requirements, self or C3PAO every three years. Level 3: 24 NIST SP 800-172 requirements, DIBCAC, after Final Level 2 (C3PAO). Affirmation every year at all levels.
• POA&M: score ratio at least 0.8, 1-point requirements only (one exception), named exclusions, 180-day close-out.
• Cyber Essentials runs on requirements v3.3 (Danzell) since April 27, 2026; Plus adds five test cases. IASME is the NCSC Delivery Partner since April 1, 2020.
• UK buyers: PPN 014 for central government (annual renewal, equivalent controls accepted, no blanket use); Def Stan 05-138 Issue 4 for MOD (Cyber Essentials at all levels, Plus at Levels 2 and 3).
• Both schemes cover the supplier's own IT, not the product. Product cyber falls under RED Article 3(3)(d-f), CRA, IEC 62443, EN 303 645, FIPS 140-3 or Common Criteria.
• For a wider map, see Cyber Resilience Act (CRA), EN 303 645 IoT cybersecurity, FIPS 140-3 cryptographic modules, Common Criteria ISO 15408, CSPN ANSSI, RED checklist, and the Glossary for definitions.

A 30-minute audit with AESTECHNO engineers.

AESTECHNO is the electronics design house that edits spilma. We help product teams scope their certification effort and avoid the common mistakes.

Book a free audit

Sources & references

1. 32 CFR Part 170, Cybersecurity Maturity Model Certification (CMMC) Program (eCFR), Office of the Federal Register www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-170
2. CMMC Program final rule, 89 FR 83092, October 15, 2024 (effective December 16, 2024), Federal Register, Department of Defense www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program
3. DFARS Case 2019-D041 final rule, 90 FR 43560, September 10, 2025 (effective November 10, 2025), Federal Register, Department of Defense www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of
4. DFARS subpart 204.75, Cybersecurity Maturity Model Certification (eCFR), Office of the Federal Register www.ecfr.gov/current/title-48/chapter-2/subchapter-A/part-204/subpart-204.75
5. DFARS Part 252, solicitation provisions and contract clauses (252.204-7021 and 252.204-7025), Defense Acquisition Regulations System www.acquisition.gov/dfars/part-252-solicitation-provisions-and-contract-clauses
6. NIST SP 800-171 Rev. 2 (February 2020, updated January 28, 2021), withdrawn May 14, 2024, National Institute of Standards and Technology csrc.nist.gov/pubs/sp/800/171/r2/upd1/final
7. NIST SP 800-171 Rev. 3 (May 2024), National Institute of Standards and Technology csrc.nist.gov/pubs/sp/800/171/r3/final
8. NIST SP 800-172 (February 2021), withdrawn May 13, 2026, National Institute of Standards and Technology csrc.nist.gov/pubs/sp/800/172/final
9. NIST SP 800-172 Rev. 3 (May 2026), National Institute of Standards and Technology csrc.nist.gov/pubs/sp/800/172/r3/final
10. DoD CIO, CMMC Program Resources, Department of Defense Chief Information Officer dodcio.defense.gov/CMMC/
11. NCSC Cyber Essentials scheme, National Cyber Security Centre www.ncsc.gov.uk/cyberessentials/overview
12. NCSC Cyber Essentials help and resources (v3.3 effective April 27, 2026; v3.2 from April 28, 2025), National Cyber Security Centre www.ncsc.gov.uk/cyberessentials/resources
13. Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), National Cyber Security Centre www.ncsc.gov.uk/sites/default/files/2026-08/IT%20Requirements%20v3.3.pdf
14. Cyber Essentials Plus Test Specification v3.2 (April 2025), National Cyber Security Centre www.ncsc.gov.uk/sites/default/files/2026-05/cyber-essentials-plus-test-specification-v3-2%20english.pdf
15. IASME Consortium, Cyber Essentials delivery partner, IASME Consortium iasme.co.uk/cyber-essentials/
16. IASME, Important update: changes to Cyber Essentials for April 2026 (Danzell), IASME Consortium iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/
17. IASME, launch of the IASME and NCSC Cyber Essentials partnership (April 1, 2020), IASME Consortium iasme.co.uk/articles/cyber-essentials-and-the-launch-of-a-new-partnership-between-iasme-and-the-national-cyber-security-centre-a-part-of-gchq/
18. PPN 014: Cyber Essentials scheme (February 17, 2025), Cabinet Office www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme
19. PPN 09/23: Updates to the Cyber Essentials Scheme (September 19, 2023), Cabinet Office www.gov.uk/government/publications/ppn-0923-updates-to-the-cyber-essentials-scheme
20. Def Stan 05-138 Issue 4, Cyber security for defence suppliers (May 14, 2024), Ministry of Defence www.gov.uk/government/publications/cyber-security-for-defence-suppliers-def-stan-05-138-issue-4
21. Directive (EU) 2022/2555 (NIS 2), Official Journal of the European Union eur-lex.europa.eu/eli/dir/2022/2555/oj
22. Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union eur-lex.europa.eu/eli/reg/2022/2554/oj