CMMC addresses protection of information in the US defense supply chain. The first question is what information the contract requires you to handle and which assessment requirement applies to your systems.
Level 1 and FCI
Level 1 concerns Federal Contract Information, or FCI, and the basic safeguarding requirements in FAR 52.204-21. A documented self assessment and the required affirmation are part of the program. Use the current official assessment guide rather than relying on an informal control count.
Level 2 and CUI
Level 2 addresses Controlled Unclassified Information, or CUI, using the 110 requirements in NIST SP 800-171 Revision 2. Understand the required assessment route and the system boundary. Do not assume that an ISO certificate or a previous security review is equivalent.
Check current implementation
The official program information currently describes implementation as paused in Phase 1, with self assessments at Levels 1 and 2. Contract requirements and implementation policy must be checked at the time of a bid. The pause does not remove existing obligations to protect covered information.
Prepare before buying tools
Confirm FCI or CUI, the applicable clauses, and the required level. Inventory the systems and suppliers handling contract information, then plan the controls and evidence around that scope.