CMMC Level 2 Explained for Defense Contractors

Level 2 is where CMMC gets real for most contractors. It is the level tied to Controlled Unclassified Information, and it is the one that asks for proof, not promises. Here is what it requires, how it is assessed, and what to get right before someone checks.

Who Needs Level 2

If your company stores, processes, or transmits Controlled Unclassified Information for the Department, Level 2 is the level that applies. That includes prime contractors and the subcontractors who handle CUI on their behalf. If you only handle Federal Contract Information, Level 1 is the match.

Most contractors in this group already have an obligation under DFARS 252.204-7012 to protect covered information. CMMC adds verification on top of it. The requirements are not new. The proof is.

Level 1, Level 2, and Level 3 Compared

Most small and mid-size contractors land at Level 2. Level 3 applies to a much smaller group working on the highest priority programs. For the complete requirement list, see our guide to CMMC compliance requirements.

Self-Assessment or C3PAO Certification

Level 2 comes in two forms. One is a self-assessment, where you score yourself against the 110 requirements and enter the result in SPRS. The other is a certification assessment by a Certified Third-Party Assessment Organization, known as a C3PAO. Sentinel Blue is one, and you can read more about how that works on our C3PAO certification page.

You do not choose between them. The solicitation states which one applies to the contract. Read that language early, because it changes your timeline and your budget. A contractor planning for a self-assessment can be caught off guard by a certification requirement, and the reverse costs money for no reason.

Both forms are held to the same standard. Self-assessment is not a lighter version of the same checks. You still need the evidence, the documentation, and a score you can defend, since the affirmation is made by a senior official at your company.

What Assessors Look For

The 110 requirements sit in 14 families, which include access control, audit and accountability, incident response, risk assessment, and system and communications protection. Assessors do not stop at the requirement itself. They test it against the 320 assessment objectives in NIST SP 800-171A, using three methods.

The documents have to agree with each other and with what the assessor sees. Your System Security Plan should describe the environment as it runs today, and your Plan of Action and Milestones should list anything that is not fully met. If you want to see how these documents relate, our post on SSP, POA&M, and SPRS covers it.

Conditional Status and the POA&M

A few unmet requirements do not always mean a failed assessment. Conditional Level 2 status allows certain items to stay open on a POA&M, with limits. You need to reach a minimum score of 80 percent, only some requirements can be left open, and every item on the POA&M has to be closed within 180 days of the status date. If you miss that window, the conditional status expires and you cannot be awarded work that requires Level 2 until you earn a new status.

How to Get Ready for Level 2

1. Scope your environmentDecide where CUI lives, moves, and ends up. A tight boundary shrinks the work. Our post on enterprise versus enclave compares the two common approaches.
2. Run a gap assessmentScore yourself honestly against all 110 requirements. A CMMC readiness assessment gives you an outside view.
3. Fix the high-value gaps firstSome requirements carry more weight in the score than others, so start with the ones that move it most.
4. Write the System Security PlanDescribe how each requirement is met, who owns it, and where the evidence lives.
5. Collect the evidenceScreenshots, configurations, logs, training records, and signed policies. Store them where you can find them in minutes.
6. Prepare your peopleControl owners will be interviewed. Practice walking through their controls out loud.
7. Plan for maintenanceStatus lasts three years and requires an annual affirmation, so the work does not end at the assessment. Our assessment preparation best practices and managed CMMC compliance pages cover that stage.

If your CUI will sit in Microsoft’s government cloud, see our guide to GCC High for CMMC compliance.

Where Contractors Go Wrong

• Assuming the contract only needs a self-assessment without reading the solicitation.
• Setting the scope too wide, which adds systems and cost that did not need to be there.
• Marking a requirement as met because a tool is installed, with no one checking it is configured and in use.
• Letting the SSP, POA&M, and SPRS score drift apart.
• Leaving the control owners out of preparation, then watching them struggle in the interview.
• Skipping the annual affirmation, which lets the status lapse.