CMMC Penetration Testing Requirements: 2026 Guide

WarBrief Live | October 13, 2026 | Cybersecurity

Penetration testing requirements for CMMC are one of the most misunderstood parts of defense-contractor cybersecurity. Compliance firms tell contractors that a penetration test is mandatory; the regulation itself never uses the word. With CMMC Phase II suspended on July 13, 2026, and the future of third-party assessments under review, whether a penetration test is needed — and what it proves — matters more than ever.

This guide answers it in plain language: what the Cybersecurity Maturity Model Certification actually requires at each level, what assessors expect to see as evidence, how a penetration test differs from a vulnerability scan, and how the 2026 pause changed contractors’ timelines.

Does CMMC Require Penetration Testing?

The short answer is no — not at Level 1 or Level 2, where almost every defense contractor lives. Section 170.14(c)(3) of the CMMC program rule makes Level 2 identical to the 110 requirements of NIST Special Publication 800-171 Revision 2, and the word “penetration” does not appear in that publication at all. What the regulation requires is outcomes, not methods: periodically assess security controls, scan for vulnerabilities, monitor systems continuously, and fix flaws. How a contractor proves those outcomes is left to the contractor — and, crucially, to the judgment of the assessor.

That distinction is why the confusion persists. NIST SP 800-171A, the companion assessment procedures guide, lists penetration testing among the typical actions an assessor might take under its TEST examination method. Industry analysis of the Level 2 assessment objectives notes that verifying vulnerability scanning “may require a penetration tester” — again, an assessor option, not a contractor obligation. In practice, contractors commission penetration tests anyway, because a test report is the single strongest artifact demonstrating that the controls are effective in real application rather than merely documented on paper.

The exception is CMMC Level 3, which aligns with NIST SP 800-172 and applies to contracts protecting the most sensitive controlled unclassified information (CUI) against advanced persistent threats. Level 3 contains CMMC’s only explicit penetration-testing mandate, requirement CA.L3-3.12.1e, calling for penetration testing at least annually or when a significant security change occurs. Its assessment objectives require both automated scanning tools and expert-driven ad hoc tests — a direct statement that scanning alone is insufficient.

” alt=”Penetration testing requirements CMMC: editorial illustration of a server room with red scanning beams and a magnifying glass examining network nodes” width=”1200″ />

What Do CMMC Level 2 Assessments Actually Test?

A CMMC Level 2 assessment measures implementation of all 110 NIST SP 800-171 Revision 2 requirements across 14 control families, scored to a maximum of 110 points. A score of at least 88 out of 110 is the passing threshold for a Level 2 assessment. Four requirements carry five points each and are treated as especially consequential because they cannot be placed on a Plan of Action and Milestones (POA&M) — they must be met outright:

• RA.L2-3.11.2 — scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities potentially affecting those systems are identified or reported.
• CA.L2-3.12.1 — periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
• CA.L2-3.12.3 — monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
• SI.L2-3.14.1 — identify, report, and correct information and information system flaws in a timely manner.

These four are exactly the controls a penetration test maps to most cleanly. A vulnerability scan proves that scanning happens; a penetration test proves that the controls the scan relies on — and the remediation processes behind them — actually resist an attacker. Assessors reviewing a System Security Plan and its evidence artifacts look for precisely that demonstration of effectiveness, and a dated, scoped penetration-test report with mapped findings is among the artifacts they consistently accept. The same logic applies beyond the contractor boundary: scanning the internet-facing systems contractors expose to the world is a recognized discipline in its own right, as WarBrief’s comparison of Censys and Shodan for threat hunting teams details.

Penetration Testing vs Security Assessment: What’s the Difference?

The terms are often used interchangeably, but they describe different things, and the difference matters for CMMC evidence. A vulnerability scan is automated: software inventories systems, checks configurations against known vulnerability databases, and produces a list of findings. A penetration test is expert-driven: a tester attempts to exploit vulnerabilities the way an adversary would, chaining weaknesses to demonstrate real impact — for example, turning an exposed service into access to CUI.

A security assessment is the broader category. It is the evaluation of whether security controls are implemented and effective, and it can use multiple methods: examine documentation, interview personnel, and test the systems themselves. Under NIST’s assessment-method framework, a penetration test is one technique inside the TEST method — one way to answer the question a security assessment asks.

For contractors, the consequence is practical: scanning validates coverage, while expert-driven testing validates effectiveness — and effectiveness is what earns full credit on the five-point controls. That is why advisors recommend annual penetration testing for Level 2 contractors even though no rule mandates it.

How Do Contractors Prepare Penetration Test Evidence for an Assessor?

Whether facing a C3PAO or, under the current Phase I regime, defending a self-attestation, contractors should treat a penetration test as an evidence package, not a checkbox. Several practices recur in assessor guidance:

• Scope the test to the CUI boundary. The test should cover the systems, enclaves, and cloud environments where CUI actually lives — the authorization boundary the assessment will examine. Findings mapped to specific 800-171 controls (rather than generic severity ratings) translate directly into assessment artifacts.
• Time it before the assessment window. Under CMMC rules, assessment artifacts must be frozen and hashed before an assessment begins. Industry practice is to run the test three to four months before a C3PAO visit — or, for self-assessments, eight to twelve weeks before the SPRS score is posted — so findings can be remediated and retested first.
• Keep remediation records. A test that finds flaws is normal; an assessor cares about the identify-report-correct cycle of SI.L2-3.14.1. Retain the original report, the remediation tickets, and the retest confirmation together.
• Confirm tester independence. The test carries more weight when performed by a party other than the team that built the controls — the same separation of duties the assessment itself applies.

One more caution: a failed self-attestation carries legal weight. The Department of Justice’s Civil Cyber-Fraud Initiative has continued bringing False Claims Act cases over cybersecurity misrepresentations in defense contracts, including a September 2026 settlement with Honeywell Aerospace and a March 2025 settlement with MORSECORP, and DOJ cyber-related settlements totaled a reported $52 million in fiscal year 2025. An annual affirmation backed by real testing evidence is materially stronger than one backed by paper alone — particularly given the department’s own breach history, including the Pentagon DMDC breach, which showed that even the department’s internal systems are targets.

” alt=”Penetration testing evidence preparation for CMMC: editorial illustration of an assessment timeline with shield milestones and a magnifying glass” width=”1200″ />

What Did the 2026 CMMC Phase II Pause Change?

On July 13, 2026, the Department of War — the administration’s name for the Department of Defense — suspended CMMC Phase II, the milestone that would have required C3PAO third-party assessments as a condition of contract award starting November 10, 2026. A CMMC Reform Task Force was created to run a 60-day top-to-bottom review of the program, drawing more than 1,100 industry comments. On September 3, 2026, the department reissued a class deviation (2026-O0025 Revision 3) directing contracting officers to remove third-party CMMC requirements from solicitations and allowing only Level 1 (Self) or Level 2 (Self) designations.

What the pause did not change is the longer list: Phase I self-assessment requirements remain in force, the underlying DFARS 252.204-7012 obligation to safeguard covered defense information is unchanged, SPRS score submissions and annual affirmations continue, and prime contractors’ flow-down requirements in subcontracts are untouched. The Task Force’s report, due to the department’s chief information officer in mid-September 2026, had not been made public as of late September; the Cyber AB estimated public release in the back half of October at the earliest.

For penetration testing, the pause shifts the audience but not the logic. With C3PAO assessments suspended indefinitely, the immediate evidence consumer is the contractor’s own affirming official, the prime contractor’s audit team, or the department’s DIBCAC assessors. The evidentiary value of a penetration test — proof that controls work — is unchanged. As compliance advisors have put it, contractors should hold their remediation course: the 800-171 baseline did not move, and third-party assessment could be restored on short notice if the task-force review recommends it.

Background and Timeline: How CMMC Got Here

The Pentagon’s contractor-cybersecurity regime has been rewritten several times, and the current state only makes sense against that history:

• November 2013 — DFARS 252.204-7012 takes effect, requiring contractors to implement the NIST SP 800-171 controls and report cyber incidents to the department within 72 hours.
• January 2020 — CMMC 1.0 launches with five levels and mandatory third-party certification.
• November 2021 — CMMC 2.0 announced: five levels compressed to three; Levels 1 and 2 allow self-assessments.
• December 2024 — The CMMC program rule (32 CFR Part 170) takes effect, establishing the regulatory foundation.
• November 10, 2025 — The acquisition rule takes effect; DFARS 252.204-7021 requires contractors to maintain a current CMMC status in SPRS and affirm it annually. Phase I self-assessment obligations begin.
• July 13, 2026 — CMMC Phase II suspended; CMMC Reform Task Force created; Phases III and IV also placed on hold.
• September 3, 2026 — Class Deviation 2026-O0025 Revision 3 issued, removing C3PAO and DIBCAC requirements from new solicitations.

The pattern is familiar to anyone who watched the 2021 pause that produced CMMC 2.0: a review that narrows and streamlines the program rather than abandoning it. Whether the 2026 review follows that script is the central open question.

What This Means for US and Allied Contractors

For American contractors, the practical message of the pause is the opposite of what the headline suggests. The independent audit is gone; the liability is not. Phase I self-assessments, SPRS postings, and annual affirmations are now the primary compliance mechanism, and a self-attestation signed under the False Claims Act is, if anything, riskier to get wrong than a third-party certificate. Penetration testing fits this environment well: it is a defensible, repeatable way to back an affirmation with evidence, and it satisfies prime contractors whose flow-down clauses often demand more than the federal floor.

For allied suppliers — Canadian, British, Australian, and other firms in the U.S. defense supply chain — nothing about the pause changes the underlying obligation. Foreign subcontractors handling CUI remain subject to the same 800-171 controls and the same self-assessment regime, and Canadian manufacturers such as Protocase have been publicly advised to keep building their compliance posture through the review period. The department’s parallel focus on operational and manufacturing technology, flagged by the CIO at the September Billington Cybersecurity Summit, suggests OT security may gain weight in whatever framework emerges — a signal for firms in aerospace, shipbuilding, and munitions. Contractors building the full picture can also consult WarBrief’s guide to internet intelligence for military cybersecurity and the broader WarBrief intelligence desk.

What to Watch Next

Three developments will decide what penetration testing means under CMMC: the Task Force report’s recommendations on assessment and scope; whether contracting officers reintroduce assessment requirements under revised guidance; and enforcement — the DOJ False Claims Act pipeline and DIBCAC activity will show how seriously self-attestations are tested. Every path leads back to the same requirement: prove your controls work.

Metric	Figure	Source
CMMC Phase II suspension date	July 13, 2026	Department of War memo; reported by Sikich, SC Media
Original Phase II start date	November 10, 2026	CMMC program phased rollout; Wipfli
Level 2 passing score	≥ 88 out of 110	Reported by Aprio
Industry comments to the RFI	More than 1,100	Covington/Lexology; Cyber AB Town Hall
Level 3 penetration-testing frequency	At least annually or on significant change	NIST SP 800-172, CA.L3-3.12.1e
Honeywell False Claims settlement (cyber)	$2,042,518 (September 1, 2026)	Reported by Centre Law
Typical penetration-test cost (vendor estimate)	$15,000–$40,000 depending on scope	Lorikeet Security (Orlando-area contractors, vendor-reported)

Caveat: suspension dates, contract-award figures, and settlement amounts are confirmed from named sources above. Penetration-test cost ranges are vendor-reported estimates that vary widely by scope and region, not regulatory figures.

Frequently asked questions

Does CMMC Level 2 require penetration testing?
No. CMMC Level 2 mirrors NIST SP 800-171 Revision 2, which never uses the word “penetration.” It requires periodic security assessments, vulnerability scanning, and continuous monitoring — outcomes a penetration test helps prove but does not itself mandate. Assessors nevertheless treat penetration-test evidence as the strongest demonstration that the key five-point controls are effective.

What is the difference between penetration testing and vulnerability scanning for CMMC?
Vulnerability scanning is automated and produces a list of known weaknesses; penetration testing is expert-driven and attempts to exploit those weaknesses the way an adversary would. Scanning proves coverage; testing proves effectiveness. NIST SP 800-171A lists penetration testing as a typical assessor action under the TEST method, which is why tests carry more evidentiary weight for controls like CA.L2-3.12.1.

Does CMMC Level 3 require penetration testing?
Yes. CMMC Level 3, aligned to NIST SP 800-172, contains CMMC’s only explicit penetration-testing mandate: requirement CA.L3-3.12.1e calls for penetration testing at least annually or whenever a significant security change occurs, combining automated scanning tools with expert-driven ad hoc tests.

When should a contractor schedule a penetration test?
Industry practice is to run the test eight to twelve weeks before posting a self-assessed SPRS score, or three to four months before a scheduled C3PAO assessment window, so findings can be remediated and retested first. Assessment artifacts must be frozen before an assessment begins, so last-minute testing is unusable as evidence.

Did the July 2026 pause remove the need for penetration testing?
No. The July 13, 2026 suspension paused the Phase II third-party assessment milestone; Phase I self-assessments, DFARS 252.204-7012, SPRS scores, and annual affirmations all remain in force. The evidentiary value of a penetration test for defending self-attestations and satisfying prime flow-down requirements is unchanged.

Related reading

• ITAR Cybersecurity Requirements: Contractor Guide (2026)
• DFARS 252.204-7012 Checklist: Compliance Explained
• Vulnerability Assessment Tools for Defense Contractors

Sources

• Sikich: The CMMC Phase II suspension — what changed, what didn’t
• Wipfli: CMMC 2.0 compliance requirements (2026)
• SC Media: CMMC Phase 2 suspended — what defense contractors need to know
• StingRai: CMMC penetration testing requirements by level (2026)
• CMMC.com: September 2026 Cyber AB Town Hall recap