# CMMC Phase 2, explained: Requirements, deadlines, and who's affected

DevFeed: [CMMC Phase 2, explained: Requirements, deadlines, and who's affected](<https://devfeed.tech/articles/cmmc-phase-2-explained-requirements-deadlines-and-who-s-affected-13009.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/cmmc-phase-2-explained>)

Published: 2026-04-29T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Security & Privacy](<https://devfeed.tech/topics/security-privacy.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [vulnerability scanning](<https://devfeed.tech/topics/vulnerability-scanning.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [MFA](<https://devfeed.tech/topics/mfa.md>)

Tags: [certificates](<https://devfeed.tech/tags/certificates.md>), [cmmc](<https://devfeed.tech/tags/cmmc.md>), [cmmc-container-images](<https://devfeed.tech/tags/cmmc-container-images.md>), [cmmc-phase-2](<https://devfeed.tech/tags/cmmc-phase-2.md>), [cmvp](<https://devfeed.tech/tags/cmvp.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cybersecurity-maturity-model-certification](<https://devfeed.tech/tags/cybersecurity-maturity-model-certification.md>), [fips](<https://devfeed.tech/tags/fips.md>), [nist](<https://devfeed.tech/tags/nist.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [stig](<https://devfeed.tech/tags/stig.md>), [stigs](<https://devfeed.tech/tags/stigs.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [u-s-dod](<https://devfeed.tech/tags/u-s-dod.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>), [vulnerability-scanning](<https://devfeed.tech/tags/vulnerability-scanning.md>)

## AI overview

This article explains the requirements, deadlines, and scope of CMMC Phase 2. It describes the CMMC Level 2 certification requirements for organizations handling Controlled Unclassified Information or supporting Department of Defense and certain civilian agency contracts, including MFA, encryption, vulnerability scanning, supported systems, independent assessments, and compliance documentation.

## Source excerpt

CMMC Phase 2 and NIST 800-171 are here. Learn how Chainguard helps teams meet compliance with FIPS, STIGs, and zero-CVE containers.