CMMC Phase 2 begins November 10, 2026. From that day, contracts can require a third-party Level 2 assessment before award. If your plant handles Controlled Unclassified Information, your CMMC facility services exposure is real: your custodial and maintenance vendors sit inside that assessment, whether their contract mentions CMMC or not.
Most compliance teams scope CMMC around networks, laptops, and cloud accounts. That makes sense. However, an assessor will also walk your floor. They will ask who holds keys to the server room, who empties the trash in the program office, and who repaired the door reader last month.
In most plants, those answers point to your facility services vendors. So the real question isn’t whether your IT is ready. It’s whether the people who clean, fix, and maintain your plant will help you pass or hand you a finding.
What Changes on November 10, 2026?
Phase 2 is when third-party Level 2 assessments, performed by a certified assessor organization (called a C3PAO), start appearing in solicitations as a condition of award. The Department of Defense can push that requirement into an option period on some contracts. Even so, the direction is set, and Phase 3 follows on November 10, 2027.
The requirement also flows down your supply chain. Under 32 CFR 170.23, a subcontractor that handles only Federal Contract Information needs at least Level 1 (Self). A subcontractor that handles Controlled Unclassified Information needs at least Level 2 (Self), and Level 2 (C3PAO) when your prime contract requires it.
Do Facility Services Vendors Fall Under CMMC?
First, it depends on what information they touch. Either way, the physical controls in your assessment apply to them.
For example, a custodial crew that never sees program data may not need its own certification. But your Level 2 assessment still checks whether you limit physical access, escort visitors, keep access logs, control badges and keys, and supervise maintenance by people who lack access authorization. Those are requirements 3.10.1, 3.10.3, 3.10.4, 3.10.5, and 3.7.6 in NIST SP 800-171 Rev. 2, the standard behind CMMC Level 2.
In other words, your vendors either help you meet those controls or they create the gaps. There is no neutral position.
The Three Doors Test
Every CMMC facility services review comes down to three doors at your plant. Each one is a place where risk either stays out or walks in.
Door 1: The Badge Door
Who holds badges, keys, or door codes to rooms with CUI systems or documents? Facility services is a high-turnover field, and every badge that stays active after someone leaves is an access-control gap.
Here’s how it happens. A night custodian quits on a Friday. The vendor’s HR team doesn’t tell your security office until the next invoice cycle. For three weeks, an active badge belongs to someone who no longer works there. Nobody broke a rule on purpose, yet your assessor will still write it up.
Ask your vendor: How fast do you report a departure, and can you show me the record?
Door 2: The Data Door
Meanwhile, facility vendors handle more information than most teams realize. Think floor plans, equipment lists, work orders with room numbers, and photos taken for inspection reports. If any of that counts as Federal Contract Information or CUI, then the vendor’s phones, email, and work-order system come into scope.
Ask your vendor: Where do your work orders and photos live, who can see them, and what CMMC level do you hold?
Door 3: The Escort Door
Visitors must be escorted and monitored. Maintenance by anyone without access authorization must be supervised. Every escort pulls one of your employees off their real job, which is the hidden cost of escort-dependent maintenance. Likewise, every gap in supervision is a potential finding.
Ask your vendor: How many of your technicians can work in controlled areas without an escort, and who supervises the rest?
Your CMMC Facility Services Checklist
Before your assessment, use this list with every facility vendor that enters a controlled area. Each answer should come with evidence, not a verbal promise.
| Question for your vendor | Why it matters | Evidence to request |
|---|---|---|
| Which of your people hold badges or keys to CUI areas? | Physical access must be limited to authorized people (3.10.1, 3.10.5) | A current roster that matches your badge system |
| How fast do you report a departure or role change? | Active badges for departed workers are an access gap | Departure-to-deactivation records for the last 90 days |
| Where do your work orders, floor plans, and photos live? | Their systems may fall into your CMMC scope | System name, who can access it, and how it’s protected |
| What CMMC level do you hold or plan to hold? | Flow-down rules set their minimum level | Their current self-assessment score or certificate |
| Who supervises your uncleared technicians in controlled areas? | Maintenance by unauthorized people must be supervised (3.7.6) | Escort and supervision logs |
| Can you produce access logs for your staff? | Physical access must be logged (3.10.4) | A 90-day log extract |
Why One Vendor Makes CMMC Facility Services Easier
Unfortunately, every vendor you add brings its own badge roster, its own HR process, and its own work-order system. Three vendors means three rosters to reconcile, three departure processes to chase, and three sets of records to collect before an assessment. That’s the same structural risk we covered in why fragmented facility vendors increase risk.
One self-performed team flips that math and makes CMMC facility services far simpler to prove. You get one roster, one departure process, and one records system to check. As a result, your security office spends less time chasing paperwork and more time protecting the program.
How IH Services Approaches CMMC Facility Services
IH Services holds a facility clearance and self-performs custodial, grounds, and cleared maintenance and repair work under one team. Our Facility Security Officer, Racheal Prutch, oversees the security programs that govern who works where.
Questions Buyers Ask About CMMC Facility Services
Does my janitorial vendor need CMMC certification?
Only if it processes, stores, or sends Federal Contract Information or CUI on its own systems. Even if it doesn’t, your plant’s physical access, escort, and supervision controls still apply to that vendor’s people, so their practices affect your assessment.
What CMMC level does a subcontractor need?
Under 32 CFR 170.23, at least Level 1 (Self) if it handles only Federal Contract Information. If it handles CUI, at least Level 2 (Self), or Level 2 (C3PAO) when the prime contract requires a third-party assessment.
When does CMMC Phase 2 start?
November 10, 2026. From that date, solicitations can require a Level 2 third-party assessment as a condition of award. Phase 3 begins November 10, 2027.
Can facility staff cause a CMMC finding?
Yes. Active badges for departed workers, unescorted visitors, missing access logs, and unsupervised maintenance all map to NIST SP 800-171 physical protection and maintenance requirements in a Level 2 assessment.
Before Your Assessor Walks the Floor, Walk It Yourself
CMMC Phase 2 doesn’t stop at the server room, and CMMC facility services risk doesn’t either. It reaches every door your facility vendors open. Start with the checklist above, ask for evidence, and see where the gaps sit while you still have time to close them.
Want a second set of eyes? Contact our team to talk through how your facility services line up with your CMMC scope.
This article is general information, not legal advice. Confirm your specific obligations with your compliance team or counsel.