Prioritized Acquisition

A prioritized acquisition is a Department of Defense contract that has been designated as requiring third-party CMMC certification by an authorized C3PAO, rather than allowing the contractor to self-assess. Most contracts involving Controlled Unclassified Information are prioritized acquisitions.

The distinction matters because CMMC 2.0 introduced a small carve-out for non-prioritized acquisitions where annual self-assessment is permitted. In practice, the carve-out is narrow and most contractors handling CUI will face the third-party C3PAO assessment requirement.

A contractor should treat any CUI-handling contract as prioritized unless the contracting officer has explicitly indicated otherwise. Planning for a third-party assessment is the conservative and correct default.