The Cybersecurity Maturity Model Certification (CMMC) program is how the Department of Defense checks that its suppliers protect sensitive information. Requirements are being added to contracts in phases. This guide explains Level 2 and the steps to prepare.
What CMMC is
CMMC has three levels. Level 1 covers basic safeguarding of Federal Contract Information (FCI) and is typically met with an annual self-assessment. Level 2 applies to companies that handle Controlled Unclassified Information (CUI) and aligns with the 110 security requirements in NIST SP 800-171. Many Level 2 contracts require an assessment by an authorized third-party assessment organization, known as a C3PAO. Level 3 is for a small number of high-priority programs.
Scope your environment
Scoping is the most important decision you make. The assessment covers every person, system and location that stores, processes or transmits CUI, plus the systems that protect them. A smaller scope means fewer systems to secure and document.
- Identify where CUI arrives, where it is stored and who works with it.
- Consider an enclave: a separate, tightly controlled environment just for CUI work.
- Document the boundary clearly, with a network diagram and data flow.
Gap review and plan
Compare your current environment against each NIST SP 800-171 requirement. For each gap, record what is missing, who owns the fix and when it will be done. This becomes your Plan of Action and Milestones (POA&M). Your score under the DoD assessment methodology shows how far you have to go.
Policies and controls
Level 2 needs both written policy and working controls:
- System Security Plan (SSP) describing your environment and how each requirement is met.
- Access control: unique accounts, least privilege and MFA.
- Encryption of CUI at rest and in transit, using validated cryptography where required.
- Logging and monitoring of security events, with logs kept and reviewed.
- Configuration management and patching.
- Incident response plans and reporting procedures.
- Training for everyone in scope.
- Physical protection for the spaces and media where CUI lives.
The assessment
When the controls are in place and the evidence is ready, you schedule an assessment with a C3PAO. Assessors interview staff, review documents and test controls. Your IT provider can help you prepare evidence and answer technical questions, but the provider does not perform the assessment and cannot guarantee the result.
The rollout timeline
The CMMC program rule, 32 CFR Part 170, took effect on December 16, 2024, and the contract rule that puts CMMC clauses into DoD solicitations took effect on November 10, 2025. Requirements phase in over three years:
- Phase 1, from November 10, 2025: contracts can require Level 1 or Level 2 self-assessments.
- Phase 2, from November 10, 2026: contracts can require Level 2 certification assessments by a C3PAO.
- Phase 3, from November 10, 2027: Level 3 assessments begin for selected programs.
- Phase 4, from November 10, 2028: CMMC requirements apply across applicable contracts.
Contracting officers can require a higher level earlier, so watch your solicitations and talk to your prime contractors.
Your SPRS score
Under DFARS 252.204-7019 and 7020, suppliers that handle CUI post a NIST SP 800-171 self-assessment score in the Supplier Performance Risk System (SPRS). The maximum score is 110, and each missing requirement subtracts one, three or five points, so a score can be negative. An honest score is better than an optimistic one: primes and assessors compare your score with your evidence, and a senior official must affirm compliance.
Conditional certification and POA&Ms
CMMC allows some gaps at assessment time, within limits. For a conditional Level 2 status, you generally need a score of at least 88 of 110, and only certain lower-weighted requirements may remain on your Plan of Action and Milestones. Those items must be closed and verified within 180 days. Some requirements, such as MFA and FIPS-validated encryption for CUI, cannot be left open, so fix those first.
Which version of NIST SP 800-171
NIST published Revision 3 of SP 800-171 in May 2024, but CMMC Level 2 assessments are currently based on Revision 2 and its 110 requirements, under the current rule and a DoD class deviation. Build your System Security Plan around Revision 2 for now and keep an eye on Revision 3, since the requirements will eventually move.
Cloud services and outside providers
If a cloud service stores or processes your CUI, DFARS 252.204-7012 requires it to meet the FedRAMP Moderate baseline or its equivalent. That usually points to government cloud offerings, such as Microsoft 365 GCC High, or to services with a FedRAMP authorization. Managed service providers that can reach your CUI environment are in scope too, so their tools, access and processes will be part of your assessment.
Flow-down to subcontractors
Primes must flow CMMC requirements down to subcontractors that handle FCI or CUI. If you are a subcontractor, expect your prime to ask for your SPRS score, your planned CMMC level and evidence of progress. Being ready early can win work from primes that are cleaning up their supply chains.
Keeping it in place
Certification is not the finish line. Level 2 certificates last three years, with an annual affirmation in SPRS that you still meet the requirements. Logs must be reviewed, access checked, patches applied, staff trained and evidence kept, month after month. Plan who owns each of those tasks before the assessment, not after.
Common preparation mistakes
Companies that struggle with Level 2 usually make the same few mistakes:
- Scoping too broadly. Letting CUI spread into every mailbox and file share makes the whole company part of the assessment.
- Buying tools before writing policies. Tools help, but assessors check that written procedures exist and that people follow them.
- Forgetting the shop floor. Drawings on CNC machines, inspection stations and shared printers are in scope if CUI touches them.
- Ignoring personal phones. If staff read CUI email on their own phones, those phones are in scope or the practice must stop.
- Treating the SSP as a one-time document. The System Security Plan must match the environment as it is today, not as it was last year.
- Overlooking physical security. Visitor logs, locked rooms and escorted guests are part of Level 2.
What evidence looks like
Assessors look for proof that controls work, not just that they exist. Typical evidence includes access review records with dates and names, screenshots or exports of MFA and encryption settings, patch reports, log review notes, training completion records, incident response test results and visitor logs. Keep evidence organized by requirement so you can find it quickly during interviews.
How we help
We help defense suppliers prepare for CMMC Level 1 and Level 2 with scoping, a gap review, policies and the security controls themselves, then manage those controls so they stay in place. We do not certify companies. See IT for defense contractors.