What Boeing’s CMMC Requirement Means for Subcontractors

Boeing has been telling suppliers who handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) that Cybersecurity Maturity Model Certification (CMMC) will be a condition of winning future contract awards. Boeing set that expectation itself, as several other major primes have, and it doesn’t follow the government’s CMMC rollout. If you handle FCI or CUI under a government contract, the federal rules behind Boeing’s letter apply to you whether or not a letter ever arrives.

If you’ve heard that Boeing is asking suppliers about CMMC, you’re not imagining it. Boeing has told suppliers it’s assessing their cybersecurity practices and identifying gaps that need to be closed for CMMC readiness. Suppliers handling FCI or CUI will need the CMMC certification level specified in the applicable solicitation as a condition of winning the award.

That requirement is Boeing’s own, separate from the government’s phased CMMC rollout, and the difference is easy to miss.

Below, we cover how the two timelines differ, who’s in scope, what applies to you now, and where the federal rollout stands.

Two Separate Timelines, Often Confused

Two different clocks are running here, and mixing them up leads to bad decisions in either direction.

The government’s timeline phases CMMC into Department of Defense (DoD) contracts and solicitations directly. Phase 1 (self-assessment) took effect in November 2025 and remains in force. Phase 2 would have required certification by a Certified Third-Party Assessment Organization (C3PAO). DoD suspended it on July 13, 2026.

A prime contractor’s own supplier requirements are a separate business decision, and Boeing isn’t the only prime making it. Lockheed Martin tells suppliers that unmet CMMC controls put their place in the supply chain at risk. RTX tells suppliers on defense contracts that include the CMMC clause that they’ll need an active CMMC certification at the level the contract specifies, as a condition of award. Each prime sets these rules because a non-compliant supplier is a contractual and reputational risk to them, whatever the federal timeline says.

That means Boeing’s messaging to its suppliers didn’t stop when the government suspended Phase 2, and nothing suggests it will. If you supply Boeing, Lockheed Martin, RTX, or another prime, the deadline that applies to you is the one your prime sets.

Where the Obligation Comes From

The obligation behind Boeing’s letters comes from federal contract clauses. It applies to any company processing, storing, or transmitting FCI or CUI under a government contract, at any tier, whether or not that company works with Boeing. What it requires depends on which of the two you handle:

• FCI is information provided by or generated for the government that isn’t intended for public release. It’s protected under the 15 basic safeguarding controls in Federal Acquisition Regulation (FAR) 52.204-21, which maps to CMMC Level 1 (self-assessment).
• CUI  is more sensitive and carries a much higher bar: the 110 controls in National Institute of Standards and Technology Special Publication (NIST SP) 800-171. These are required under Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, the clause that requires safeguards for CUI, and map to CMMC Level 2.

CMMC is the process for verifying that you meet either standard, and which prime sits above you in the chain doesn’t change what you owe.

That puts far more companies in scope than Boeing’s subcontractors, including:

• Any tier of supplier to Boeing, Lockheed Martin, RTX, Northrop Grumman, or other primes
• Companies working directly with the DoD on contracts involving FCI or CUI
• Manufacturers and service providers handling FCI or CUI passed down through multiple subcontract layers

Not having a notice from a prime yet doesn’t put you out of scope. It may only mean your prime hasn’t reached your tier.

What Applies to You Now

The practical requirements depend on which type of information you handle:

• If you only handle FCI, you need a CMMC Level 1 self-assessment against the 15 FAR 52.204-21 controls, documented and affirmed. The Phase 2 suspension doesn’t change this.
• If you handle CUI, you need a self-assessment against the 110 NIST SP 800-171 controls. This also stays in force during the suspension.
• A documented System Security Plan (SSP) and Plan of Action & Milestones (POA&M) are required for CUI handlers to score themselves in the Supplier Performance Risk System (SPRS). A missing or outdated SSP results in an incomplete assessment score.
• Third-party (C3PAO) certification for CUI handlers is suspended at the federal level, and the suspension doesn’t extend to a prime’s own contractual requirements. A prime can still require certification as a condition of award.

What to Do With This

Wherever the request comes from, the next step is the same. Find out whether you handle FCI, CUI, or both, and check where you stand against the applicable controls (15 for FCI, 110 for CUI). Then get your self-assessment in order, plus your SSP and POA&M if you handle CUI, before a prime or the government asks for proof.

Key Takeaways

• The federal suspension of third-party certification doesn’t affect what primes require of their own suppliers.
• Boeing, Lockheed Martin, and RTX have each set supplier requirements tying CMMC readiness to contract awards or purchase orders, ahead of the government’s timeline.
• FCI and CUI carry different bars: 15 controls under FAR 52.204-21 for FCI (CMMC Level 1) and 110 controls under NIST SP 800-171 for CUI (CMMC Level 2). Know which one applies to you.
• The obligation to protect FCI and CUI applies at every tier of the supply chain, including companies with no direct contract with a prime.
• A current self-assessment, plus an SSP and SPRS score if you handle CUI, is the practical starting point.

Conclusion

The federal requirement for third-party certification has been suspended since July 13, 2026. The rest still stands: Phase 1 self-assessments, the FAR and DFARS safeguarding rules, and any certification your prime requires. Getting your self-assessment in order now, whether that’s the 15 FCI controls or the 110 CUI controls, means you’re ready when your prime asks or the federal rules change again.

Atekro works with defense subcontractors on CMMC assessments and implementation. If you’re not sure where your company stands, or what your prime’s requirements mean for you, let’s talk it through in a free 15-minute call. There’s no cost and no obligation.

FAQ

What If I Only Handle FCI, Not CUI?

You’re still in scope, at a lower bar. FCI-only suppliers need a CMMC Level 1 self-assessment against the 15 controls in FAR 52.204-21. That’s a lighter lift than the 110 NIST SP 800-171 controls for CUI, and it’s required now.

Does Boeing’s CMMC Requirement Only Apply to Direct Suppliers?

No. CMMC and the FAR, DFARS, and NIST requirements behind it flow down through every tier of a supply chain that handles FCI or CUI. A second- or third-tier supplier can be in scope without ever dealing with Boeing directly.

Did Boeing’s CMMC Requirement Go Away When the Government Suspended Phase 2?

No. Boeing’s supplier expectations are a separate business decision from the government’s phased rollout. The federal suspension removed third-party certification as a condition of award in government solicitations and contracts. It didn’t change what individual primes require of their own suppliers.

What If I Haven’t Received Anything From My Prime Yet?

That doesn’t mean you’re out of scope. Primes are working through their supply chains in stages, and have been since Phase 1 took effect in November 2025. The obligation to protect FCI under FAR 52.204-21 and CUI under DFARS 252.204-7012 applies whether or not a notice has reached you.

Does Any of This Apply While CMMC Phase 2 Is Suspended?

Yes. Only the federal third-party certification requirement is suspended. The safeguarding requirements and self-assessment obligations still apply, and any certification your prime requires stays in place even though the government’s timeline moved. Companies that keep that work going now won’t be starting from scratch when Phase 2 returns or a prime asks for proof.

Note: This is general guidance based on current public compliance documentation and supplier communications, not legal advice. Confirm specific requirements and deadlines directly with your prime contractor and against your own contract language.