New DoD contracts that involve federal contract information or controlled unclassified information now carry a CMMC Level 1 or Level 2 self-assessment as a condition of award. The rule flows down to subcontractors and service providers handling that information.
What to do: Know whether you touch CUI. If you do, the 110 NIST 800-171 controls apply and your score must be in SPRS.