CMMC Penetration Testing in 2026: Requirements & Evidence

Executive Answer

As of November 2026, CMMC penetration testing is not an explicit requirement at Level 1 or Level 2. Level 2 requires periodic vulnerability scanning and security-control assessment under NIST SP 800-171 Revision 2; a well-scoped pentest can support those activities but does not replace the CMMC assessment. The CMMC Level 3 model explicitly requires penetration testing at least annually and after significant system changes under CA.L3-3.12.1e. However, the Department has paused Phase II and currently permits only Level 1 and Level 2 self-assessment requirements in solicitations and contracts. US defense contractors can shortlist providers from the top US cybersecurity companies.

2026 Implementation Update

2026 implementation update: On July 13, 2026, the Department of War suspended CMMC Phase II and future milestones. Phase I self-assessments remain in place. The official CMMC program page should be treated as the source of truth for further implementation changes. As of November 4, 2026, that page still describes Phase II as suspended, and the Department had not announced the outcome of its CMMC Reform Task Force review or a new Phase II date.

That distinction matters. The underlying CMMC model still defines three levels, but the assessment level that a contracting officer may currently place in a solicitation or contract is narrower during the suspension. Older regulations and contract materials may still use “Department of Defense” or “DoD,” while the current program site uses “Department of War” or “DoW.”

CMMC Timeline: Rules, Phases and the 2026 Suspension

Two rules make CMMC enforceable. The program rule, 32 CFR Part 170, was published on October 15, 2024 and took effect on December 16, 2024. It defines the three levels, the assessment types, scoring, POA&M limits and four implementation phases. The acquisition rule, the 48 CFR DFARS CMMC rule (DFARS Case 2019-D041), was published on September 10, 2025 and took effect on November 10, 2025. That date started Phase 1, because 32 CFR § 170.3(e) ties Phase 1 to the DFARS rule and starts each later phase one calendar year after the one before it.

The 2027 and 2028 dates come from the one-year rule in § 170.3(e). The Department's July 13, 2026 announcement suspended "pending and future" implementation milestones along with Phase 2, so none of those later dates is currently scheduled. The same announcement set up a CMMC Reform Task Force with a 60-day review. As of November 4, 2026, the Department had not published the review's results or a new Phase 2 date.

Trade press has reported options under discussion, such as restarting Phase 2 for a narrower group of contractors, but none is an official decision. Treat any restart date as unconfirmed until it appears on the DoW CIO CMMC page or in the Federal Register.

The September 3 class deviation matters for contract language. Class Deviation 2026-O0025, Revision 3 tells contracting officers to use a revised DFARS Part 240 in place of the codified text and to remove or revise CMMC requirements in line with the July 13 memorandum. It keeps baseline NIST SP 800-171 Rev 2 compliance under DFARS 252.204-7012, and it keeps the SPRS check before award and before an option is exercised when a contract requires a CMMC level.

Does CMMC Require Penetration Testing?

Only at Level 3. CMMC Level 1 and Level 2 contain no explicit penetration-testing requirement, although a pentest can support Level 2 evidence, while Level 3 requires a pentest at least annually and after significant security changes. Level by level:

• CMMC Level 1: No explicit penetration-testing requirement.
• CMMC Level 2: No explicit penetration-testing requirement. Periodic vulnerability scanning is required, and a pentest may provide useful supporting evidence for selected technical objectives.
• CMMC Level 3: Yes. The model explicitly requires a pentest at least annually and when significant security changes are made.

A pentest and a CMMC assessment answer different questions. A pentest asks whether an authorized tester can exploit weaknesses in a defined scope. A CMMC assessment asks whether the organization has implemented every applicable practice and can demonstrate that implementation through sufficient evidence. One activity can inform the other, but they are not interchangeable.

For organizations deciding whether testing is appropriate, it helps to begin with the difference between a vulnerability assessment and a penetration test. A scanner identifies potential weaknesses at scale; a pentest uses controlled human analysis to validate exploitability, attack paths, and business impact.

CMMC Levels and Penetration-Testing Requirements in 2026

The current model language appears in 32 CFR § 170.14. It identifies the Level 3 requirement as CA.L3-3.12.1e: conduct penetration testing at least annually or when significant security changes are made, using automated scanning tools and ad hoc tests performed by subject-matter experts.

The Level 3 requirement remains in the regulation even though Level 3 assessment designation is currently suspended. Organizations pursuing high-value programs should therefore separate near-term contract obligations from longer-term architecture and readiness planning.

CMMC 2.0 Level 2 Requirements: 110 Practices by Family

CMMC Level 2 requires all 110 security requirements in NIST SP 800-171 Revision 2, grouped into 14 families. CMMC gives each one a family code, the level and the NIST number, so NIST requirement 3.11.2 becomes RA.L2-3.11.2. Assessors judge each requirement against its assessment objectives in NIST SP 800-171A, 320 objectives in all, and a requirement is MET only when every applicable objective is satisfied.

Level 1 is much smaller: 15 basic safeguarding requirements from FAR 52.204-21 for systems that handle Federal Contract Information only. Level 3 keeps the full Level 2 set and adds 24 selected requirements from NIST SP 800-172, including the penetration-testing requirement CA.L3-3.12.1e.

Level 2 Assessment Types and Scoring

A Level 2 requirement in a contract names an assessment type as well as a level. The rule defines two Level 2 paths, and the current suspension allows only one of them in new DoW solicitations.

Scoring starts at 110. Each NOT MET requirement subtracts 1, 3 or 5 points under 32 CFR § 170.24. RA.L2-3.11.2, CA.L2-3.12.1 and CA.L2-3.12.3 are 5-point requirements, CA.L2-3.12.2 is worth 3 and RA.L2-3.11.3 is worth 1. Under 32 CFR § 170.21, Conditional status needs a score of at least 88 (0.8 × 110), POA&M items worth no more than 1 point (encryption that is in place but not FIPS-validated is the one 3-point exception), and none of six excluded requirements on the POA&M. One of the six is the system security plan, CA.L2-3.12.4.

What the Phase II Suspension Changes and What It Does Not

The July 2026 suspension is an implementation change, not a cancellation of CMMC or the defense industrial base’s security obligations.

During the suspension:

• Program managers may designate only CMMC Level 1 Self or Level 2 Self in new solicitations and contracts.
• They may not designate Level 2 C3PAO or Level 3 DIBCAC assessments.
• Active solicitations must be amended when they contain a now-suspended designation.
• Existing contracts are to remove Level 2 C3PAO or Level 3 requirements at the next option period or through an administrative modification.

The Department’s implementation memorandum also makes clear that NIST SP 800-171 Revision 2 and DFARS 252.204-7012 obligations remain. Contractors should verify the actual language in each solicitation, contract, option, and amendment rather than assuming that a general announcement has already changed a particular instrument.

Self-assessment does not mean “no evidence.” Level 1 and Level 2 organizations still need an accurate scope, implemented requirements, defensible assessment results, and the required affirmation. A pentest can expose implementation weaknesses before those weaknesses undermine the organization’s own assessment, but it does not make the self-assessment complete by itself.

How Penetration Testing Can Support CMMC Level 2

CMMC Level 2 contains no blanket instruction to hire a pentest provider. Its explicit technical requirement is vulnerability scanning under RA.L2-3.11.2: scan periodically and when new vulnerabilities affecting the system are identified. The Level 2 Assessment Guide also notes that analyzing custom-developed software may require a penetration tester to test or validate findings when automated scanners are insufficient.

That nuance is documented in the official CMMC Level 2 Assessment Guide. The guide is clarifying assessment guidance rather than a substitute for the regulation, but it is a useful source for understanding possible evidence and assessment methods.

A practical way to express the value is:

Useful Level 2 evidence = correct scope + authorized testing + attributable evidence + owned remediation + retest

Even when all five elements are present, the result is supporting evidence, not a CMMC certificate, a guaranteed score, or a substitute for evaluating every applicable objective.

For teams that need the testing work to be repeatable across remediation cycles, a structured penetration testing as a service program can help. The organization should still document how that service fits its vulnerability-management, control-assessment, and evidence-retention processes.

RA.L2-3.11.2 and CA.L2-3.12.x Explained: Where Pentest Evidence Helps

The table above gives the short version. This section goes one level deeper, objective by objective, because that is how an assessor reads the evidence.

RA.L2-3.11.2: Vulnerability Scanning

The requirement reads: scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. NIST SP 800-171A splits it into five objectives, and all five must be met:

• [a] The scanning frequency for systems and applications is defined.
• [b] Systems are scanned at that frequency.
• [c] Applications are scanned at that frequency.
• [d] Systems are scanned when new vulnerabilities are identified.
• [e] Applications are scanned when new vulnerabilities are identified.

It is a 5-point requirement, so it cannot go on a Level 2 POA&M. The CMMC Level 2 Assessment Guide expects every in-scope asset to be scanned, including laptops that rarely connect to the network. It also says custom-developed software may need a penetration tester to test and validate findings, because automated scanners are less thorough on custom applications.

Where a pentest helps with RA.L2-3.11.2:

• Applications, objectives [c] and [e]. Manual testing of custom web applications and APIs that handle CUI covers ground a network scanner does not reach.
• Scan coverage. Testers often find hosts, services or cloud assets that never appear in scan results. Each one is a gap in objective [b] or [d] to close in the asset inventory and the scanner configuration.
• Scan quality. Comparing validated findings with the latest scan shows whether scans are authenticated and current. NIST's discussion of 3.11.2 notes that security assessments such as red team exercises are another source of vulnerabilities to scan for.
• Remediation, RA.L2-3.11.3. Validated, risk-ranked findings and retest results show that fixes follow the risk assessment, which is the core of a working vulnerability management program.

A pentest does not satisfy RA.L2-3.11.2 on its own. A yearly test is not scanning at a defined frequency, and it is not event-driven scanning when a new CVE affects your systems. Keep the scan schedule, the scan reports and the records of out-of-cycle scans as the primary evidence.

CA.L2-3.12.1 to CA.L2-3.12.4: Security Assessment

The Security Assessment family has four requirements. A pentest feeds the first three directly and depends on the fourth.

• CA.L2-3.12.1, assess controls (5 points). Define how often controls are assessed, then assess them at that frequency to see whether they work. A pentest report is a dated, independent assessment of the technical controls it covered. It does not assess policy, training or physical requirements, so it is one input to this requirement, not the whole assessment.
• CA.L2-3.12.2, plans of action (3 points). Identify deficiencies, develop plans of action to correct them and carry those plans out. Each validated finding with an owner, a due date and a retest result is evidence for all three steps.
• CA.L2-3.12.3, monitor controls (5 points). Monitor controls on an ongoing basis so they stay effective. Repeat testing after material changes adds human checks to monitoring that is mostly automated.
• CA.L2-3.12.4, system security plan. The SSP describes the boundary, the environment, how each requirement is implemented and connections to other systems. It cannot go on a POA&M, and § 170.24 says an assessment cannot be completed without a current SSP. Take the pentest scope from the SSP, and update the SSP when findings show a wrong boundary or an undocumented connection.

One rule in § 170.24 is easy to miss. A temporary deficiency that is addressed in an operational plan of action, with reviews and progress toward the fix, is assessed as MET. A requirement that was never implemented is NOT MET whether or not it appears on a POA&M. So a newly found flaw in a working control, tracked properly, is handled very differently from a control that does not exist. Agree with your assessor before the assessment how open pentest findings will be treated.

Evidence Pack for an Assessor

Map each artifact to the requirement it supports:

• RA.L2-3.11.2: scan policy with the defined frequency, scan reports for systems and applications, records of out-of-cycle scans after new advisories, and pentest coverage of custom applications.
• RA.L2-3.11.3: risk-ranked findings, remediation tickets and retest results from the penetration testing report.
• CA.L2-3.12.1: the assessment schedule, the dated pentest report with scope and method, and the results of other control assessments.
• CA.L2-3.12.2: a plan-of-action entry for each finding with owner, milestone and status.
• CA.L2-3.12.3: monitoring records and repeat test or retest results over time.
• CA.L2-3.12.4: the current SSP that the pentest scope references.

Under § 170.24, evidence must be in final form. Working papers, drafts and unapproved policies do not count, so hand over the final, signed report rather than a draft.

Vulnerability Scanning vs. Pentesting vs. a CMMC Assessment

Running a scanner and calling the output a pentest weakens both security and evidence quality. Conversely, asking a pentester to “test all of CMMC” creates an undefined engagement: many CMMC objectives concern governance, policy, training, physical protection, and repeatable processes that cannot be established through offensive testing.

How to Scope a CMMC-Focused Penetration Test

The CMMC assessment scope and the pentest scope should inform each other, but they are not automatically identical. Start with the system security plan, asset inventory, network and data-flow diagrams, external service-provider responsibilities, and the paths through which CUI is stored, processed, or transmitted.

The regulation’s CMMC scoping requirements distinguish CUI assets, security protection assets, contractor risk-managed assets, specialized assets, and out-of-scope assets. Those categories affect assessment treatment. The pentest should prioritize CUI assets and security protection assets while also considering credible paths from other reachable systems into the CUI environment.

A useful scoping workshop should answer these questions:

1. Where does CUI enter, move through, and leave the environment?
2. Which identities, endpoints, applications, networks, and cloud services protect that flow?
3. Which internet-facing or internal paths could lead into the CUI enclave?
4. Which security protection assets could fail in a way that exposes CUI?
5. What is owned by an external service provider, and who is authorized to test it?
6. Which systems are excluded, why are they excluded, and is segmentation effective?
7. What techniques, testing hours, data-handling rules, and stop conditions are authorized?

DeepStrike’s penetration-testing scope guide explains how to turn objectives, boundaries, exclusions, and rules of engagement into a testable statement of work. For a CMMC-focused engagement, that scope should also map each major test path to the relevant system boundary and asset owner.

The test type should follow the attack surface. That may include internal or external network testing, identity and Active Directory paths, web applications and APIs, cloud control planes, remote access, segmentation, or a focused review of custom-developed software. It does not follow that every organization needs every test type.

If CUI-facing applications are central to the boundary, a web application penetration test may be more useful than a broad external network test.

If the enclave relies on cloud identity, storage, or managed services, a separately authorized cloud penetration test may be necessary because provider policies and shared-responsibility boundaries can limit techniques.

How Often Should a CMMC Organization Pentest?

Only CMMC Level 3 sets a pentest cadence: at least annually and when significant security changes are made. CMMC does not specify a frequency for Levels 1 and 2 because they do not explicitly require penetration testing, so those organizations should set a risk-based cadence using their threat model, contract language, architecture, change rate, and findings.

For CMMC Level 3, the model supplies the cadence: at least annually and when significant security changes are made.

For Levels 1 and 2, CMMC does not specify a pentest cadence because it does not explicitly require the activity. The organization should set a risk-based frequency based on its threat model, contract language, customer commitments, architecture, change rate, and findings. An annual test may be a reasonable program choice, but it should not be presented as a universal Level 2 rule.

Consider an additional test after material changes such as:

• A new CUI enclave, identity provider, remote-access path, or major cloud migration.
• A substantial application release or new internet-facing API.
• Significant segmentation or firewall redesign.
• A merger, acquisition, or infrastructure integration that changes trust boundaries.
• A serious incident, newly credible attack path, or remediation program that needs validation.

Between larger tests, focused validation can reduce the time that important findings remain unresolved. A continuous penetration-testing service may fit fast-changing environments, but it still needs a defined scope, authorization, triage process, and evidence-retention plan.

What Evidence Should the Engagement Produce?

A CMMC-focused pentest report should be useful to engineers, control owners, executives and, when appropriate, the assessment team. At minimum, retain:

• The signed authorization, rules of engagement, dates, scope, exclusions, and limitations.
• The tested systems and their relationship to the CMMC boundary.
• Methods and tools used, with enough context to reproduce or understand material findings.
• Evidence for each validated finding, handled according to its sensitivity.
• Severity and business impact, including chained attack paths where relevant.
• Remediation recommendations, assigned owners, target dates, and status.
• Retest evidence distinguishing fixed, partially fixed, accepted, and unresolved items.
• A carefully qualified mapping to relevant CMMC requirements or assessment objectives.

The mapping should say “supports evidence for” rather than “proves compliance with.” An assessor may need only the portions relevant to a particular objective, while sensitive exploit detail may require controlled handling. Agree on evidence access and redaction before testing starts.

A clear penetration-testing contract should define authorization, confidentiality, data retention, third-party approvals, deliverables, and retesting. For CUI environments, those terms are part of risk management, not administrative boilerplate.

Do Pentest Findings Belong on a CMMC POA&M?

Not automatically.

CA.L2-3.12.2 expects an organization to develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities. A contractor can use an operational remediation plan to manage pentest findings under that practice.

A CMMC assessment POA&M is a separate mechanism governed by 32 CFR § 170.21. It applies to eligible NOT MET assessment requirements, is subject to scoring and eligibility constraints, and must be closed within the applicable period. Level 1 does not allow an assessment POA&M; Level 2 permits only a limited one under the rule.

Therefore, do not automatically label every pentest issue a “CMMC POA&M item.” First determine whether the finding indicates that a specific assessment objective is NOT MET. Then document and handle it through the appropriate operational or assessment process.

Preparing for a Cybersecurity Audit as a Defense Contractor

Most defense contractors meet CMMC in one of three audit settings: their own Level 2 self-assessment, a C3PAO certification assessment, or a DCMA DIBCAC assessment, which DoD can run under DFARS 252.204-7020 even for a contractor that self-assessed. All three use the NIST SP 800-171A objectives and the same three methods: examine documents and records, interview people, and test the controls.

A pentest is not an audit, but it is a useful rehearsal for the test part. Before any of the three, check that:

1. The SSP matches reality. Boundary, asset categories under § 170.19 and every connection to other systems are current.
2. Records are final and dated. Scan, pentest and remediation records are signed-off versions, not drafts or working papers.
3. Gaps are fixed or POA&M-eligible. Every NOT MET item is either remediated or eligible under § 170.21, and the score is at least 88.
4. Cloud services are covered. Services that handle CUI are FedRAMP Moderate authorized or equivalent, and the customer responsibility matrix is in the SSP. Our FedRAMP penetration testing guide explains how cloud providers are tested.
5. SPRS and the affirmation are current. The score, scope, CAGE codes and annual affirmation are posted.
6. Control owners can explain their controls. Interviews test people as well as paperwork, so each family owner should be able to describe and demonstrate how the control works.

For a broader comparison of audits and tests, see our IT security audit guide and the overview of penetration testing for compliance.

How to Select a Pentest Provider for a CUI Environment

Choose the provider for its ability to test the actual attack surface safely and produce defensible evidence, not because it promises to “make you CMMC compliant.” A pentest company does not award a CMMC status unless it is separately authorized for the relevant assessment role, and those roles should not be casually conflated.

Evaluate:

• Experience with the technologies inside the CUI boundary and the attack paths you need tested.
• A manual testing methodology that goes beyond scanner output.
• Named rules of engagement, escalation paths, and proof of authorization.
• Secure collection, storage, transmission, retention, and destruction of sensitive evidence.
• Personnel, location, export-control, and data-residency terms required by your contract or environment.
• Clear findings, affected assets, evidence, business impact, remediation guidance, and retest status.
• Willingness to state limitations and avoid guarantees about certification, scores, or contract awards.

DeepStrike provides penetration-testing services, so this guide has a commercial connection to the subject. Its requirements analysis is based on the cited official sources. Buying any DeepStrike service does not create or guarantee CMMC status.

A Practical CMMC Pentest Readiness Checklist

1. Confirm the governing requirement. Read the solicitation, contract, amendments, and current Department guidance.
2. Validate the CMMC boundary. Reconcile the SSP, inventory, diagrams, CUI flows, and external service providers.
3. Define the security question. Decide which attack paths, controls, or material changes the test needs to validate.
4. Authorize a precise scope. Record included systems, exclusions, techniques, timing, third-party approvals, and stop conditions.
5. Plan evidence handling before testing. Set access, encryption, retention, redaction, and destruction requirements.
6. Remediate and retest. Assign owners, distinguish operational findings from assessment POA&M items, and retain validation evidence.
7. Complete the actual CMMC assessment process. Evaluate every applicable objective; do not treat the pentest report as the assessment.

Frequently Asked Questions

Is penetration testing required for CMMC Level 2?

No. CMMC Level 2 explicitly requires periodic vulnerability scanning and scanning when new vulnerabilities affecting the system are identified, but it does not contain a blanket penetration-testing requirement. A pentest may support selected assessment objectives, particularly where manual validation is valuable, but it does not replace the Level 2 assessment.

Did the 2026 Phase II suspension cancel CMMC?

No. Phase I self-assessments remain. During the suspension, new solicitations and contracts may designate Level 1 Self or Level 2 Self, but not Level 2 C3PAO or Level 3 DIBCAC. Other applicable safeguarding and DFARS obligations also remain.

Is the Level 3 pentest requirement still part of CMMC?

Yes. CA.L3-3.12.1e remains in the CMMC model and requires penetration testing at least annually and after significant security changes. What changed is that Level 3 DIBCAC assessment designation is currently suspended during the Phase II pause.

Can vulnerability scanning replace a penetration test?

No. Scanning is broad and repeatable, while a pentest uses authorized human analysis to validate exploitability and combine weaknesses into attack paths. Level 2 explicitly requires vulnerability scanning; adding a pentest does not remove that obligation.

How often should a Level 2 contractor conduct a pentest?

CMMC does not prescribe a Level 2 pentest schedule. Set a defensible cadence based on risk, contractual commitments, architectural change, and exposure. Annual testing and testing after material changes may be reasonable choices, but they are not universal Level 2 requirements.

Must a C3PAO perform the penetration test?

No CMMC rule says a C3PAO must provide an organization’s security pentest. A C3PAO performs authorized CMMC certification assessments when that assessment designation applies. Select a pentest provider based on authorization, technical fit, evidence quality, data handling, and contractual constraints.

Must we give the full pentest report to a CMMC assessor?

Not necessarily. The assessment team needs adequate evidence for the objectives being evaluated, but the exact artifacts and access method should be coordinated with the assessor. Sensitive exploit details should be controlled, and selective evidence must still be sufficient and attributable.

What are the CMMC 2.0 Level 2 requirements?

Level 2 requires all 110 security requirements in NIST SP 800-171 Revision 2, across 14 families such as Access Control (22), System and Communications Protection (16) and Identification and Authentication (11). Contractors are assessed against the 320 objectives in NIST SP 800-171A, scored under 32 CFR § 170.24, and must affirm compliance every year. The assessment repeats every three years, either as a self-assessment or by a C3PAO.

When does CMMC Phase 2 start?

It has no start date right now. Phase 2 was scheduled for November 10, 2026, but the Department of War suspended it on July 13, 2026 together with later milestones. As of November 4, 2026, no new date had been published. Phase 1, which began on November 10, 2025, remains in effect.

What score do you need to pass a CMMC Level 2 assessment?

Final status requires every requirement to be MET, a score of 110. A score of 88 or higher can give Conditional status if the remaining gaps are eligible for a POA&M under 32 CFR § 170.21. Those gaps must be closed and confirmed within 180 days, or the Conditional status expires.

Build Security Evidence Without Confusing It With Certification

CMMC penetration testing is not a universal checklist item. It is an explicit Level 3 model requirement and an optional but potentially valuable security-validation activity at Level 2. In 2026, contractors also need to account for the Phase II suspension without assuming that self-assessment eliminates evidence or security obligations.

Need help defining a CUI-focused scope, validating exploitable attack paths, and producing remediation-ready evidence? DeepStrike can design and execute an authorized penetration test around your actual environment. Your contracting officer, legal counsel, and assessment team should confirm how the resulting evidence fits your specific obligations. Talk to our team about a CMMC-focused test.

This article is general technical information, not legal, procurement, or certification advice. Current official guidance and the terms of each solicitation and contract control.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.