Published October 26, 2026
What CMMC Level 2 is
The Cybersecurity Maturity Model Certification (CMMC) Program is set out in 32 CFR part 170, effective December 16, 2024. It applies to DoD contractors and subcontractors that process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on their own information systems. Contracts solely for commercially available off-the-shelf (COTS) items are excluded.
Level 2 is the level for CUI. Its requirements are identical to the 110 security requirements in NIST SP 800-171 Revision 2, across 14 families.
The DFARS rule that puts CMMC into contracts took effect on November 10, 2025. Clause 252.204-7021 requires the contractor to hold the required CMMC status for the life of the contract. Contracting officers check SPRS, the Supplier Performance Risk System, before award and before exercising an option.
Where the rollout stands
The CMMC rule sets four phases. Phase 1 began on November 10, 2025, the effective date of the DFARS rule. In Phase 1, DoD intended to require Level 1 (Self) or Level 2 (Self) as a condition of award. Under the rule, Phase 2 would begin one calendar year later and add Level 2 (C3PAO) certification as a condition of award.
On July 13, 2026, the Department of War, a secondary name for DoD under Executive Order 14347, suspended the transition to Phase 2, which had been scheduled for November 10, 2026. It also put later CMMC milestones on hold. It set up a CMMC Reform Task Force to review the program. Phase 1 remains in effect, with SPRS scores and annual affirmations. Program managers may still include Level 1 (Self) or Level 2 (Self) requirements, and active solicitations that require Level 2 (C3PAO) or Level 3 are to be amended to remove them.
As of October 17, 2026, no amendment to 32 CFR part 170 or the DFARS rule has been published in the Federal Register. The DFARS text still requires the CMMC clause from November 10, 2028 in contracts involving FCI or CUI, except COTS-only buys. Check the solicitation for the level it names.
Self-assessment or certification
The program office or requiring activity sets the level, and the solicitation names Level 2 (Self) or Level 2 (C3PAO).
Both cover the same 110 requirements, the same scope rules and the same scoring. The difference is who assesses. A Level 2 (C3PAO) status also satisfies Level 1 (Self) and Level 2 (Self) for the same scope.
C3PAOs are authorized or accredited by the CMMC Accreditation Body, The Cyber AB. It runs the CMMC Marketplace at https://cyberab.org/Catalog.
| Level 2 (Self) | Level 2 (C3PAO) | |
|---|---|---|
| Assessor | The contractor | An authorized or accredited C3PAO |
| Results go to | SPRS, entered by the contractor | eMASS, entered by the C3PAO, which transmits to SPRS |
| POA&M closeout | Closeout self-assessment within 180 days | Closeout assessment by a C3PAO within 180 days |
| Repeated | Every 3 years | Every 3 years |
| Affirmation | At each assessment and annually | At each assessment and annually |
The order of the work
- Find the CUI. List the contracts that involve CUI, what CUI each one delivers, and where it is stored, processed and sent. This sets the assessment scope.
- Decide the boundary. Assess the whole enterprise network, or build an enclave that holds the CUI. The rule allows a CMMC status for an enterprise network or for one or more enclaves.
- Categorize every asset. Label each as a CUI asset, Security Protection Asset, Contractor Risk Managed Asset, Specialized Asset or out of scope. Record it in the asset inventory, the system security plan (SSP) and the network diagram.
- Write the SSP. A current SSP is required at assessment. Without one, the assessment cannot be completed.
- Assess against NIST SP 800-171A (June 2018). Score each requirement using the 32 CFR 170.24 method and fix the gaps with the highest point values first.
- Confirm cloud and service providers. A cloud service holding CUI must be FedRAMP Moderate or equivalent. Its customer responsibility matrix goes in the SSP.
- Assess, post and affirm. Enter the result in SPRS or schedule the C3PAO. The affirming official then affirms in SPRS.
Scoring and POA&M rules
The maximum score is 110. Each requirement is worth 1, 3 or 5 points. A requirement NOT MET subtracts its value, and the score can go negative. Two requirements give partial credit: multifactor authentication (3.5.3) and FIPS-validated encryption (3.13.11).
A plan of action and milestones (POA&M) gives Conditional status if the score is at least 0.8 of the maximum, which is 88 of 110. Only 1-point requirements may be on the POA&M. The exception is 3.13.11, when encryption is used but is not FIPS-validated.
Six requirements may never be on a Level 2 POA&M: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4 (the SSP), PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5.
All POA&M items must be closed within 180 days of the Conditional status date. If they are not, Conditional status expires. The contractor is then ineligible for new awards at that level for that scope, and standard contractual remedies apply to existing contracts.
Where the time goes
- Finding all the CUI. Trace every path CUI takes, including email, file shares and supplier portals. Every asset that processes, stores or transmits it is in scope.
- Evidence. For a C3PAO assessment, artifacts are hashed with a NIST-approved algorithm, and the names, hash values and algorithm go to the assessor. Artifacts are kept for 6 years.
- Scheduling a C3PAO. Leave time for the closeout assessment as well as the first one.
- Subcontractors. The prime must confirm each subcontractor that handles FCI or CUI has a current CMMC status before awarding the subcontract.
Scoping detail
- Security Protection Assets provide security functions to the assessed environment. They are assessed against the requirements relevant to what they do, even if they never hold CUI.
- Contractor Risk Managed Assets can process CUI but are kept from it by policy and practice. They need no separation from CUI assets, but they must be documented, and the assessor may check them.
- Specialized Assets cover IoT, operational technology, government-furnished equipment, restricted systems and test equipment. They are documented and handled in the SSP.
- Out-of-scope assets cannot process, store or transmit CUI, provide no security to CUI assets, and are physically or logically separated. An endpoint running a VDI client is out of scope if it is configured to allow no CUI beyond the keyboard, video and mouse data sent to the client.
- External service providers that are not cloud providers are assessed within the contractor's scope.
SPRS, affirmations and the contract
SPRS holds the CMMC level, status date, assessment scope, the CAGE codes in scope, the score and any POA&M. Each assessed system gets a CMMC unique identifier (UID), which the offeror gives the contracting officer with its proposal.
The affirming official is a senior person responsible for CMMC compliance. They affirm in SPRS after each assessment, after POA&M closeout and every year. The affirmation states that the contractor has implemented and will maintain the requirements. A Final Level 2 status counts as current for 3 years; an affirmation, for 1 year.
DoD's rule estimates the 3-year cost of a Level 2 certification at $104,670 for a small entity and $117,768 for a larger one, and a self-assessment at $37,196 and $48,827. Those figures exclude the cost of implementing the requirements.
Skills and operations
Clause 252.204-7021 allows FCI and CUI only on systems with a CMMC status at the required level. Assign an owner for the SSP, the asset inventory and the evidence.
Name the affirming official early, and give them evidence that the controls still operate before each annual affirmation.
Settle these first
- Which contracts involve CUI, and what level does each solicitation name?
- Enterprise scope or an enclave, and which users need access to CUI?
- What is your current score out of 110, and are any 3- or 5-point requirements unmet?
- Who is the affirming official, and what evidence will they rely on?
Questions
- Does CMMC Level 2 use NIST SP 800-171 Revision 2 or 3?
- Revision 2. 32 CFR 170.14 makes the Level 2 requirements identical to the requirements in NIST SP 800-171 Rev. 2. NIST superseded Rev. 2 with Rev. 3 on May 14, 2024. CMMC still uses Rev. 2.
- Is CMMC Phase 2 in effect?
- No. Phase 1 began November 10, 2025. On July 13, 2026, the Department of War suspended the transition to Phase 2, which had been due November 10, 2026. Phase 1 self-assessment requirements remain.
- What score do we need for Conditional status?
- At least 88 of 110, with only 1-point requirements on the POA&M, plus 3.13.11 where encryption is not FIPS-validated. Every POA&M item must close within 180 days.
- How long does a Level 2 status last?
- 3 years, with an affirmation in SPRS every year and after each assessment.
- Can we certify only an enclave?
- Yes. A CMMC status applies only to the assessed scope, which can be an enclave instead of the whole enterprise network. Out-of-scope assets must be unable to handle CUI, give no security to CUI assets, and be physically or logically separated.