CMMC Compliance Requirements for RTX Suppliers

RTX required all suppliers supporting applicable DoD contracts to maintain an active CMMC certification with final DFARS clause 252.204-7021 effective November 10, 2025. Suppliers must report certification status in the DoD SPRS, maintain six years of evidence, and keep annual registrations current. Level 1 requires full implementation of 15 controls; Levels 2 & 3 protect CUI with POA&M accepted for certain requirements but must be closed within 180 days.