In September 2026, 809 out of 40,534 contract opportunity notices posted on SAM.gov mentioned CMMC requirements, representing 2.0% of all published notices. Every single notice mentioning CMMC came from a Department of Defense component, with zero civilian agency notices citing the requirement. Understanding these numbers helps defense contractors track how requirements are being integrated into federal solicitations.
September 2026 By the Numbers
During September 2026, SAM.gov published 40,534 total contract opportunity notices. Of those, 809 notices contained explicit references to CMMC terms or related clauses. For comparison, the August 2026 baseline showed 937 CMMC notices out of 44,340 total notices (2.1%). September had 128 fewer CMMC notices than August, while total notices also fell, from 44,340 to 40,534.
When examining specific search terms within the September notices:
- 703 notices used the full title Cybersecurity Maturity Model Certification.
- 284 notices used the acronym CMMC.
- 144 notices cited DFARS clause 252.204-7021.
Additionally, 74 notices cited NIST SP 800-171 without directly mentioning CMMC (compared to 169 in August). One notice can match several terms.
Who Is Asking: DoD Components
All 809 September CMMC notices originated from the Department of Defense. Breakdowns by DoD sub-tier components show where these requirements appeared most frequently:
- Department of the Navy: 483 notices (down from 560 in August)
- Department of the Air Force: 133 notices (down from 156 in August)
- Defense Logistics Agency: 121 notices (down from 130 in August)
- Department of the Army: 66 notices (down from 86 in August)
- Defense Information Systems Agency: 3 notices
- Missile Defense Agency: 2 notices
- US Special Operations Command: 1 notice
CMMC Levels Named in Solicitations
Most contract notices on SAM.gov do not specify a CMMC level in the main text description. However, among the notices that explicitly named a level:
- 153 notices named CMMC Level 1.
- 71 notices named CMMC Level 2.
- 0 notices named Level 3.
In August, the counts were 165 for Level 1, 69 for Level 2, and 3 for Level 3.
Set-Asides, Notice Types, and NAICS Codes
Federal contract opportunity notices cover various solicitation types and acquisition categories. The September CMMC notices broke down as follows:
Notice Types
- Solicitations: 635
- Combined Synopsis/Solicitations: 128
- Special Notices: 17
- Sources Sought: 16
- Presolicitations: 10
- Award Notices: 3
Small Business Set-Asides
- Small Business Set-Asides (Total): 152
- Service-Disabled Veteran-Owned Small Business (SDVOSB) Set-Asides: 17 (up from 4 in August)
- No Set-Aside Used: 68
- No Set-Aside Listed: 572
Top NAICS Codes
- 334412 (Bare Printed Circuit Board Manufacturing): 75 notices
- 332919 (Other Metal Valve and Pipe Fitting Manufacturing): 67 notices
- 333998 (All Other Miscellaneous General Purpose Machinery Manufacturing): 50 notices
- 335931 (Current-Carrying Wiring Device Manufacturing): 39 notices
What This Means During the Phase 2 Suspension
On July 13, 2026, the Department of War suspended the move to CMMC Phase 2. To learn more about this policy change, read our article on the CMMC Phase 2 suspension.
During this suspension, program offices may not require third-party certification or Level 3. For now, new solicitation requirements may only call for Level 1 (Self) or Level 2 (Self). Under 32 CFR 170.16, Level 2 (Self) requires a self-assessment every three years and an annual affirmation.
Even with Phase 2 suspended, DFARS requirements and NIST SP 800-171 Rev 2 remain active, and government-led assessments may still take place. Review common answers in our CMMC FAQ to understand these ongoing duties.
Method and Limits
Data for this report comes from SAM.gov's public Contract Opportunities active-notices file and the FY2026 archive file downloaded on October 20, 2026. A notice counts for the month of its posted date, and any notice appearing in both files is counted only once.
A notice counts as a CMMC notice if its title or description contains "CMMC", "Cybersecurity Maturity Model Certification", or the DFARS clause number 252.204-7021. Standalone mentions of NIST SP 800-171 are excluded from the primary count because older DFARS clauses cite it without CMMC.
These counts represent a baseline floor. The text search covers only the SAM.gov summary fields, not attached PDF solicitations or external documentation. Unique notice IDs are stored so all figures can be verified.
Frequently asked questions
How often is this SAM.gov data updated?
This data note is updated monthly using the same public data sources and search method so readers can compare trends across months.
Does a Level 2 requirement mean I need an external assessment right now?
During the Phase 2 suspension, program offices may only call for Level 1 (Self) or Level 2 (Self). Third-party assessment requirements are currently suspended.
Where can defense contractors review advisory services?
You can review fixed-scope advisory options on our CMMC advisory services page.
If you need help reviewing your self-assessment scope or compliance documentation, feel free to contact our team for a free initial consultation.