If your company sells to the Department of Defense and your work touches Controlled Unclassified Information (CUI), the CMMC Level 2 requirements now sit squarely between you and your next contract award. Since November 10, 2025, contracting officers have been inserting CMMC clauses into new solicitations, and the days of promising compliance "later" are over. Yet 2026 has also brought real turbulence: the Pentagon suspended part of the program's rollout in July 2026 while a reform task force reviews it, and many contractors are unsure what still applies. The short answer: the security requirements themselves never went anywhere, and the contracts flowing down to you right now still demand proof.
At Petronella Technology Group, Inc., our team, led by Craig Petronella, CMMC-RP (CMMC Registered Practitioner) and Amazon #1 best-selling author of more than 14 cybersecurity books, has spent years walking defense contractors through NIST 800-171 requirements and the CMMC program built on top of them. This guide lays out everything that CMMC 2.0 Level 2 demands in 2026: the two federal rules that created the program, the 110 security requirements and their 14 control families, self-assessment versus third-party certification, SPRS score mechanics, POA&M rules, and the practical steps to get ready. For a deeper look at how we help contractors get there, see our CMMC Level 2 compliance services overview.
What Are the CMMC Level 2 Requirements?
The CMMC Level 2 requirements are the 110 security requirements of NIST Special Publication 800-171 Revision 2, adopted wholesale as the assessment baseline for any defense contractor or subcontractor that processes, stores, or transmits CUI. Level 2 is the middle tier of the three-level CMMC 2.0 model. Level 1 covers 15 basic safeguarding requirements from FAR 52.204-21 for companies that handle only Federal Contract Information, while Level 3 adds a subset of enhanced requirements from NIST SP 800-172 for contractors supporting the most sensitive programs. Level 2 is where the bulk of the defense industrial base lands, because most defense work involving drawings, specifications, technical orders, or export-controlled data involves CUI.
Meeting the CMMC Level 2 requirements means three things in practice. First, you must actually implement all 110 requirements, or document any allowable shortfalls in a tightly constrained Plan of Action and Milestones (POA&M). Second, you must produce the assessment artifacts that prove it: a System Security Plan (SSP), policies, procedures, and technical evidence mapped to the assessment objectives in NIST SP 800-171A. Third, you must obtain the required assessment type for your contract, either a self-assessment or a certification assessment by a C3PAO (CMMC Third-Party Assessment Organization), then affirm your compliance annually in the Supplier Performance Risk System (SPRS).
The Two Rules Behind CMMC: 32 CFR Part 170 and the 48 CFR DFARS Clause
CMMC became enforceable through two separate rulemakings, and understanding the split helps you read the news correctly. The first is the CMMC Program rule at 32 CFR Part 170, published in the Federal Register on October 15, 2024 and effective December 16, 2024. This rule defines the program itself: the three levels, the assessment types, scoping, the scoring methodology, POA&M limits, and the roles of C3PAOs and the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
The second is the acquisition rule, DFARS Case 2019-D041, published September 10, 2025 and effective November 10, 2025. This 48 CFR rule is what actually puts CMMC into contracts through the DFARS 252.204-7021 clause. Once the clause appears in your solicitation, you must hold the required CMMC status at the required level, for every information system that processes, stores, or transmits FCI or CUI in performance of the contract, before award. The rule contemplated a three-year phased rollout so that requirements would appear in progressively more solicitations over time.
The dfars cmmc pairing matters for one more reason: DFARS 252.204-7012, the older safeguarding clause that has required NIST SP 800-171 compliance since 2017, remains in force and operates independently of CMMC. Even where no CMMC clause appears, a contractor holding CUI under a 7012 clause is already contractually obligated to implement the same 110 requirements. CMMC did not create new security controls; it created a verification layer on top of obligations most contractors already had.
Where CMMC Stands in 2026: Phase 1 in Effect, Phase 2 Suspended
Here is the current state of play as of this writing in August 2026. Phase 1 of the CMMC rollout began November 10, 2025. Under Phase 1, procuring activities include CMMC Level 1 or Level 2 self-assessment requirements in solicitations and contracts when the contractor will handle FCI or CUI. That part of the program is active today and is the reason self-assessments and SPRS submissions are showing up as conditions of award.
Phase 2, which had been scheduled to begin November 10, 2026 and would have expanded mandatory third-party C3PAO certification assessments, was suspended by the Department of Defense on July 13, 2026. During the suspension, new Level 2 (C3PAO) and Level 3 (DIBCAC) status designations are paused while a newly established CMMC Reform Task Force conducts a review and collects industry feedback through a public request for information. Two things did not change: the Phase 1 self-assessment requirements still apply to covered solicitations, and the underlying obligation to protect CUI under DFARS 252.204-7012 and NIST SP 800-171 was never suspended. Contractors who treat the pause as a reason to stop working on cmmc level 2 controls are misreading it; the 110 requirements remain contractually binding wherever a 7012 clause exists, and assessment obligations can resume once the review concludes.
The 14 Control Families Behind the CMMC Level 2 Requirements
All 110 security requirements come from NIST SP 800-171 Revision 2, organized into 14 families. Assessors evaluate each requirement against the objectives in NIST SP 800-171A, so a single requirement often breaks into several discrete things you must demonstrate. Here is what each family covers, with representative requirements.
Access Control (AC) - 22 requirements
The largest family governs who can reach systems and CUI and what they can do once inside. It includes limiting system access to authorized users (3.1.1), enforcing least privilege (3.1.5), controlling remote access sessions (3.1.12), verifying and controlling connections to external systems (3.1.20), and controlling CUI posted on publicly accessible systems (3.1.22). Expect assessors to test session locking, privileged account separation, and mobile device controls here as well.
Awareness and Training (AT) - 3 requirements
Personnel must be made aware of security risks and trained for their duties (3.2.1, 3.2.2), and users must be trained to recognize and report potential indicators of insider threat (3.2.3). Small family, but assessors want records: completion logs, training content, and role-based assignments.
Audit and Accountability (AU) - 9 requirements
You must create and retain system audit logs sufficient to enable monitoring and investigation (3.3.1), ensure actions trace to individual users (3.3.2), review and correlate log data (3.3.5), protect audit information from tampering (3.3.8), and alert when logging fails (3.3.4). Centralized log collection is the practical backbone of this family.
Configuration Management (CM) - 9 requirements
Establish baseline configurations and inventories (3.4.1), track and approve changes (3.4.3), enforce least functionality by disabling nonessential ports and services (3.4.6), and apply deny-by-exception policies to unauthorized software (3.4.8). Assessors commonly ask for hardening standards and change tickets.
Identification and Authentication (IA) - 11 requirements
Identify users and devices (3.5.1, 3.5.2) and use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts (3.5.3). Passwords must be cryptographically protected in storage and transit (3.5.10), with complexity and reuse rules (3.5.7, 3.5.8). MFA gaps are among the most common and most costly findings.
Incident Response (IR) - 3 requirements
Maintain an operational incident-handling capability spanning preparation, detection, analysis, containment, recovery, and user response (3.6.1); track, document, and report incidents to designated officials (3.6.2); and test your incident response capability (3.6.3). Remember that DFARS 252.204-7012 separately requires reporting cyber incidents to the DoD within 72 hours.
Maintenance (MA) - 6 requirements
Perform and control system maintenance (3.7.1), control the tools and media used for it (3.7.2, 3.7.4), require multifactor authentication for nonlocal maintenance sessions (3.7.5), and supervise maintenance personnel who lack authorization (3.7.6).
Media Protection (MP) - 9 requirements
Protect and control paper and digital media containing CUI (3.8.1, 3.8.2), sanitize or destroy media before disposal or reuse (3.8.3), mark media with CUI markings (3.8.4), control media during transport (3.8.5), control removable media (3.8.7), and protect the confidentiality of backup CUI at storage locations (3.8.9).
Personnel Security (PS) - 2 requirements
Screen individuals before authorizing access to systems containing CUI (3.9.1) and protect CUI during personnel actions such as terminations and transfers (3.9.2). Offboarding checklists and background screening records carry this family.
Physical Protection (PE) - 6 requirements
Limit physical access to systems and operating environments to authorized individuals (3.10.1), escort visitors and monitor their activity (3.10.3), maintain physical access audit logs (3.10.4), and manage physical access devices such as keys and badges (3.10.5). Alternate work sites need safeguarding too (3.10.6).
Risk Assessment (RA) - 3 requirements
Periodically assess risk to operations and individuals from processing CUI (3.11.1), scan for vulnerabilities in systems and applications on a schedule and when new flaws are identified (3.11.2), and remediate vulnerabilities in accordance with risk (3.11.3).
Security Assessment (CA) - 4 requirements
Periodically assess your controls for effectiveness (3.12.1), develop and implement plans of action to correct deficiencies (3.12.2), monitor controls on an ongoing basis (3.12.3), and develop, document, and update the System Security Plan (3.12.4). The SSP is the single document an assessment cannot proceed without.
System and Communications Protection (SC) - 16 requirements
Monitor and protect communications at system boundaries (3.13.1), deny network traffic by default (3.13.6), prevent split tunneling (3.13.7), and, critically, employ FIPS-validated cryptography when used to protect the confidentiality of CUI (3.13.11). The FIPS validation requirement, not just "encryption," trips up more contractors than almost any other line item.
System and Information Integrity (SI) - 7 requirements
Identify and correct system flaws in a timely manner (3.14.1), protect against malicious code at designated locations (3.14.2), update protection mechanisms (3.14.4), monitor system communications for attacks and indicators of compromise (3.14.6), and identify unauthorized use of systems (3.14.7).
Self-Assessment vs C3PAO Certification: Which Contracts Need Which
CMMC 2.0 Level 2 splits into two assessment types, and the DoD program office designates which one a given procurement requires. Level 2 (Self) means your own organization conducts the assessment against all 110 requirements using the NIST SP 800-171A objectives, enters the results in SPRS, and a senior company official affirms continuing compliance. Level 2 (C3PAO) means an accredited third-party assessment organization conducts the assessment and the resulting certification is recorded for contracting officers to verify.
Under the program rule, the DoD selects the assessment type based on the sensitivity of the CUI involved in the effort, and the department has stated that most contracts involving CUI will ultimately require third-party certification rather than self-assessment. In practice during 2026, Phase 1 solicitations are invoking self-assessments, and new C3PAO status designations are paused during the Phase 2 suspension. Both paths use identical requirements and identical scoring; the difference is who performs the assessment and how much independent scrutiny your evidence receives. Either way, a Level 2 status is valid for three years, with an annual affirmation of continuing compliance required in SPRS in the interim years. Budgeting differs meaningfully between the two paths; our breakdown of what CMMC Level 2 certification really costs walks through the cost drivers for each.
SPRS Scores and DFARS 252.204-7019/-7020
Before CMMC clauses existed, the DoD built an interim verification layer that is still fully in force. DFARS 252.204-7019 requires offerors handling CUI to have a current NIST SP 800-171 self-assessment score, no more than three years old, posted in SPRS to be considered for award. Its companion clause, DFARS 252.204-7020, gives the government the right to conduct higher-level assessments of your implementation, requires you to provide access for them, and flows the requirement down to subcontractors who handle CUI.
The score comes from the DoD Assessment Methodology. You start at 110, a perfect score, and subtract a weighted value for every requirement not fully implemented. Weights are 1, 3, or 5 points depending on the requirement's impact, which is why the scale runs from negative 203 to positive 110 and why a handful of missing high-weight items like multifactor authentication or FIPS-validated encryption can drag a score down fast. The 7019 clause itself sets no minimum passing score; it demands a current, accurate score. Accuracy is the trap: misstated scores have already produced False Claims Act liability for contractors, so the number in SPRS needs to match reality. Run your own numbers with our free SPRS score calculator before an assessor or a DIBCAC reviewer does it for you.
POA&M Rules: Minimum Score, 180-Day Closeout, Conditional Status
CMMC allows a limited Plan of Action and Milestones at Level 2, but the constraints in 32 CFR 170.21 are strict, and they surprise contractors who assume a POA&M is a general-purpose IOU. To achieve a Conditional Level 2 status, your assessment score must be at least 88 out of 110, which is 80 percent. Below 88, there is no conditional status and no award eligibility at Level 2.
Not every unmet requirement can go on the POA&M. Only requirements worth 1 point under the scoring methodology are eligible, with a single exception: SC.L2-3.13.11, CUI encryption, may be included if encryption is actually employed but is not yet FIPS-validated. On top of that, six specific 1-point requirements can never be deferred: external connections (3.1.20), CUI on public systems (3.1.22), the System Security Plan (3.12.4), visitor escort (3.10.3), physical access logs (3.10.4), and management of physical access devices (3.10.5). Every 3-point and 5-point requirement, including multifactor authentication, must be fully implemented on assessment day.
The clock is unforgiving. A Conditional status lasts 180 days from the conditional status date, and a POA&M closeout assessment must confirm that every deferred item is fully implemented within that window. Close it out and your status converts to Final Level 2, good for three years with annual affirmations. Miss the window and the conditional status expires, putting eligibility for awards that require Level 2 at risk until you reassess. Treat the POA&M as a short runway for a few 1-point stragglers, not as a remediation strategy.
NIST 800-171 Revision 3 Exists, But CMMC Assesses Against Revision 2
NIST published SP 800-171 Revision 3 in May 2024, reorganizing the catalog and introducing organization-defined parameters. It has caused enormous confusion, so let us be precise: under the current rules, CMMC assessments and DFARS self-assessments are conducted against Revision 2. A DoD class deviation issued in May 2024 directs contractors covered by DFARS 252.204-7012 to continue using Revision 2, and the CMMC program rule at 32 CFR Part 170 incorporates Revision 2 as its Level 2 baseline. The DoD has signaled movement toward Revision 3, including publishing proposed values for its organization-defined parameters in 2025, but until the department amends its rules, building your program to Revision 2 is both correct and required. Track Revision 3 as a future migration, not a current obligation.
Practical Readiness Steps for 2026
Here is the sequence we use with contractors preparing for the nist 800-171 requirements that underpin cmmc 2.0 level 2, refined across engagements with manufacturers, engineering firms, and IT service providers in the defense supply chain:
- Scope your CUI environment first. Identify every system, user, facility, and service provider that processes, stores, or transmits CUI. Most cost overruns come from assessing an environment far larger than necessary; a properly scoped enclave shrinks the assessment boundary dramatically.
- Run an honest gap assessment. Score yourself against all 110 requirements using the NIST SP 800-171A objectives and the DoD scoring methodology, not a vendor's simplified checklist. Our CMMC Level 2 checklist breaks the requirements into an evidence-oriented working list.
- Fix the heavy weights before the long tail. Multifactor authentication, FIPS-validated encryption, boundary protection, and logging carry the biggest score penalties and the longest lead times. Sequence remediation by point value and dependency, not alphabetically.
- Write the SSP as you go. The System Security Plan cannot be POA&M'd and is the first artifact any assessor requests. Keep it current with your actual environment, not your intended one.
- Submit and maintain your SPRS score. Post an accurate score, update it as remediation lands, and calendar the annual affirmation. An inaccurate score is a legal liability, not a formality.
- Prepare evidence, not just controls. For each requirement, know which policy, configuration export, screenshot, or log will demonstrate it. Assessments are evidence exercises; implementation without proof scores the same as no implementation.
- Watch the rulemaking, not the rumor mill. The Phase 2 suspension changed assessment scheduling, not your security obligations. Contractors who keep building now will be first in line when third-party assessment designations resume.
Find your gaps before an assessor does: Start your CMMC Level 2 self-assessment. It walks you through the same 110 requirements an assessor will test, and shows you exactly where your score stands today.
FAQ
What are the CMMC Level 2 requirements?
CMMC Level 2 requires implementing all 110 security requirements of NIST SP 800-171 Revision 2 across 14 control families, documenting them in a System Security Plan, undergoing either a self-assessment or a C3PAO certification assessment depending on the contract, submitting results to SPRS, and affirming compliance annually. A limited POA&M is allowed only for certain 1-point requirements and only with a score of at least 88 out of 110.
Does CMMC Level 2 use NIST 800-171 Revision 2 or Revision 3?
Revision 2. Although NIST published Revision 3 in May 2024, the CMMC program rule at 32 CFR Part 170 and a DoD class deviation under DFARS 252.204-7012 both keep Revision 2 as the assessment baseline until the DoD formally updates its rules.
Do I need a C3PAO assessment or a self-assessment?
The DoD designates the assessment type per procurement based on CUI sensitivity. During Phase 1, which began November 10, 2025, solicitations invoke Level 1 and Level 2 self-assessments. The broader rollout of mandatory third-party C3PAO assessments was suspended in July 2026 pending a program review, so check each solicitation's stated requirement.
What is the minimum SPRS score for CMMC Level 2?
A perfect 110 earns Final status outright. A Conditional Level 2 status requires a minimum score of 88, with every unmet item being POA&M-eligible and closed out within 180 days. Separately, DFARS 252.204-7019 requires a current score in SPRS regardless of its value, and that score must be accurate.
How long is a CMMC Level 2 status valid?
Three years from the assessment, whether self-assessed or C3PAO-certified, provided the company submits its annual affirmation of continuing compliance in SPRS. A Conditional status is a temporary state that expires if the POA&M is not closed out within 180 days.
Do the CMMC Level 2 requirements apply to subcontractors?
Yes. Safeguarding and assessment requirements flow down the supply chain to subcontractors that process, store, or transmit CUI in performance of the contract. A small machine shop holding CUI drawings for a prime carries the same 110 requirements as the prime itself, scoped to the systems that touch that data.
Free, practical, and specific to regulated environments. We will email it to you.
No spam. Unsubscribe anytime.
