CMMC Level 2 Certification Complete Guide to the 110 Controls, Costs, and C3PAO Assessment
CMMC Level 2 requires full implementation of all 110 NIST SP 800-171 security controls, verified through a third-party C3PAO assessment. This guide covers everything defense contractors need to know about achieving certification.
What Is CMMC Level 2 and Who Needs It?
CMMC Level 2 is the "Advanced" tier of the Cybersecurity Maturity Model Certification framework. It applies to any defense contractor or subcontractor that handles, processes, stores, or transmits Controlled Unclassified Information (CUI) as part of a Department of Defense contract. If your organization touches CUI in any capacity, Level 2 is the certification tier you will need.
Unlike CMMC Level 1, which covers only basic cyber hygiene for Federal Contract Information (FCI), Level 2 maps directly to the full set of 110 security requirements defined in NIST Special Publication 800-171 Revision 2. These controls were originally mandated under DFARS clause 252.204-7012 and have been required since 2017. CMMC Level 2 adds a formal verification layer on top of those requirements, meaning you can no longer just self-attest and move on. You must prove it.
The Department of Defense estimates that over 80,000 contractors in the Defense Industrial Base (DIB) will eventually need CMMC Level 2 certification. This includes prime contractors, subcontractors, manufacturers, IT service providers, research institutions, and any other organization that receives CUI through a DoD contract or subcontract. If your contract contains DFARS 252.204-7012 or references NIST 800-171, you should plan for Level 2.
Who Specifically Needs Level 2?
- Prime contractors handling CUI on DoD programs
- Subcontractors at any tier who receive CUI from a prime or another sub
- Cleared defense contractors processing classified information spillover
- Research labs and universities performing DoD-funded research with CUI
- Managed IT service providers who host or manage CUI environments for defense clients
- Manufacturers producing parts, components, or systems under contracts that include technical data marked as CUI
The consequences of not achieving Level 2 certification are straightforward: you will lose eligibility for contracts that require it. As CMMC requirements flow into new solicitations, contractors without the appropriate certification level will be disqualified during the bidding process. For many organizations, this means planning now rather than scrambling later. Learn more about the full CMMC compliance process to understand the broader context.
CMMC Level 1 vs. Level 2 vs. Level 3
Understanding the differences between CMMC levels helps you determine which certification your organization needs and what it takes to get there.
| Criteria | Level 1 (Foundational) | Level 2 (Advanced) | Level 3 (Expert) |
|---|---|---|---|
| Data Protected | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) | CUI + Advanced Persistent Threats |
| Number of Controls | 17 practices | 110 controls (NIST 800-171) | 110 + 24 enhanced (NIST 800-172) |
| Assessment Type | Annual self-assessment | Third-party C3PAO assessment | Government-led (DIBCAC) assessment |
| Assessment Frequency | Annual | Every 3 years + annual affirmation | Every 3 years + annual affirmation |
| Estimated Cost | $5K - $30K | $100K - $500K+ | $500K - $2M+ |
| Preparation Timeline | 1-3 months | 6-18 months | 18-36 months |
| Documentation | Basic policies | SSP, POA&M, full policy suite | SSP, POA&M, advanced threat documentation |
| SPRS Score Required | N/A | 110 (all controls met) | 110 + enhanced requirements |
| Who Needs It | All DoD contractors (FCI only) | Contractors handling CUI | High-priority programs, top-secret adjacent |
The jump from Level 1 to Level 2 is significant. You go from 17 basic practices (things like using antivirus and requiring passwords) to 110 comprehensive security controls that cover everything from multi-factor authentication to incident response planning to media sanitization. For most small and mid-sized contractors, Level 2 preparation is a serious project that requires dedicated resources, budget, and expert guidance. Explore the full breakdown of all CMMC levels explained.
Key Takeaway: Level 2 Is the Standard for CUI
- 110 controls from NIST SP 800-171 must be fully implemented and documented
- Third-party assessment by an accredited C3PAO is required for most contractors
- Certification lasts 3 years with annual affirmation statements required
- No shortcuts. Self-assessment alone does not satisfy the Level 2 requirement for most CUI contracts
The 14 NIST 800-171 Control Families
CMMC Level 2 requires full implementation of 110 security requirements organized across 14 control families. Here is a practical summary of each family and what it demands from your organization.
Access Control (AC)
The largest control family. Covers who can access your systems and data, under what conditions, and with what limitations. Includes requirements for least privilege, session management, remote access controls, wireless access restrictions, mobile device policies, and CUI access enforcement. You need to limit system access to authorized users, control information flow between systems, and separate duties so no single person has unchecked access to sensitive data.
Awareness and Training (AT)
Ensures all employees understand their security responsibilities. You must provide security awareness training to all users, role-based training to those with specialized security duties, and training on recognizing social engineering and insider threats. This is about building a culture of security, not just checking a box with an annual video.
Audit and Accountability (AU)
Requires you to create, protect, and review audit logs that track user activity across your CUI environment. You need to be able to trace actions back to individual users, detect unauthorized activity, generate alerts for audit failures, and protect log data from tampering or deletion. Audit logs must be retained long enough to support incident investigations.
Configuration Management (CM)
Addresses how your systems are configured and how changes are managed. You must establish and maintain baseline configurations for all systems, track and control changes through a formal process, enforce security settings, restrict unnecessary software, and apply the principle of least functionality. Configuration management prevents drift that introduces vulnerabilities over time.
Identification and Authentication (IA)
Requires positive identification of every user, process, or device before granting access. Multi-factor authentication is mandatory for both local and network access to privileged accounts and for network access to non-privileged accounts. You must also manage authenticators (passwords, tokens, certificates) with proper complexity, rotation, and protection policies.
Incident Response (IR)
You must have a documented incident response plan that covers preparation, detection, analysis, containment, recovery, and post-incident review. Your team needs to be able to detect, report, and respond to security incidents rapidly. This also includes tracking and reporting incidents to appropriate authorities, which for DoD contracts means the DIBNet portal within 72 hours of discovery.
Maintenance (MA)
Covers both routine and non-routine maintenance of your information systems. You must perform timely maintenance, control the tools and personnel used for maintenance activities, sanitize equipment before off-site maintenance, and supervise maintenance personnel who do not have appropriate access authorization. Remote maintenance sessions require additional controls including encryption and multi-factor authentication.
Media Protection (MP)
Governs how you handle physical and digital media containing CUI. This includes marking, storing, transporting, sanitizing, and destroying media. USB drives, external hard drives, backup tapes, printed documents, and any other media that holds CUI must be protected throughout their lifecycle. You need documented procedures for media sanitization that align with NIST SP 800-88 guidelines.
Personnel Security (PS)
Requires screening individuals before granting access to systems containing CUI and ensuring that access is promptly revoked when someone transfers or is terminated. While only two requirements, they are foundational. If the wrong people have access to CUI, every other control becomes less effective.
Physical Protection (PE)
Addresses physical access to your facilities, server rooms, and workstations. You must limit physical access to authorized individuals, protect and monitor your physical facility, escort visitors, maintain visitor logs, and control physical access devices like keys and access cards. If someone can physically walk up to a server and pull a hard drive, your digital controls do not matter.
Risk Assessment (RA)
Requires periodic risk assessments to identify threats and vulnerabilities to your CUI environment. You must scan for vulnerabilities regularly and remediate them according to your risk tolerance. Risk assessments should inform your security priorities and resource allocation, not sit in a filing cabinet untouched.
Security Assessment (CA)
Requires you to periodically assess your own security controls to verify they are implemented correctly and operating effectively. You must develop and implement plans of action to address deficiencies, monitor controls on an ongoing basis, and develop system security plans that describe how controls are implemented. This is the self-check that keeps your security program honest between formal assessments.
System and Communications Protection (SC)
The second-largest control family. Covers how data is protected in transit and at rest, network segmentation, cryptographic protections, session authenticity, and boundary protections. You must implement FIPS-validated encryption for CUI, deny network traffic by default (allowing only by exception), separate user functionality from system management, and prevent unauthorized data transfers. This family often requires the most technical investment.
System and Information Integrity (SI)
Requires you to identify, report, and correct system flaws in a timely manner. You must deploy malware protection, monitor security alerts and advisories, update malware signatures, perform regular system scans, and monitor your environment for unauthorized access and anomalies. Integrity means your systems do what they are supposed to do, and nothing else.
CMMC Level 2 Certification Costs
The total cost of achieving CMMC Level 2 varies widely depending on your organization's size, current security posture, and the complexity of your CUI environment. Here is a realistic breakdown.
Cost Breakdown by Component
| Component | Small Organization (25-100 employees) |
Mid-Size Organization (100-500 employees) |
|---|---|---|
| Gap Assessment | $15,000 - $30,000 | $30,000 - $75,000 |
| Remediation (technology, tools, infrastructure) | $50,000 - $150,000 | $100,000 - $300,000 |
| Documentation (SSP, policies, procedures) | $10,000 - $25,000 | $25,000 - $50,000 |
| Consulting and Advisory Services | $20,000 - $50,000 | $40,000 - $100,000 |
| C3PAO Assessment Fee | $25,000 - $50,000 | $50,000 - $120,000 |
| Ongoing Annual Maintenance | $15,000 - $40,000/yr | $40,000 - $100,000/yr |
| Total Initial Investment | $100,000 - $305,000 | $245,000 - $645,000 |
These numbers might seem steep, but consider the alternative. Organizations that lose DoD contracts because they cannot prove compliance face far greater financial consequences. A single mid-size DoD contract can be worth millions annually. The cost of certification is an investment in your ability to compete.
The biggest cost variable is remediation. If your organization already has a solid NIST 800-171 compliance program in place, remediation costs will be on the lower end. If you are starting from scratch with minimal security controls, expect higher costs for technology purchases (SIEM, MFA, endpoint detection, encryption), infrastructure changes (network segmentation, enclave design), and staffing (hiring or contracting security personnel).
One important note: the C3PAO assessment fee is just one piece of the puzzle. Many organizations focus on the assessment cost and underestimate the remediation and documentation costs that must come before the assessment. Think of the assessment fee as the final exam, not the entire semester of coursework.
How Long Does Level 2 Preparation Take?
Most organizations need between 6 and 18 months to prepare for a CMMC Level 2 C3PAO assessment. The timeline depends on your current security maturity.
Typical Preparation Phases
-
Gap Assessment and Scoping (Month 1-2)
Evaluate your current environment against all 110 NIST 800-171 controls. Identify where CUI lives, who accesses it, how it flows through your systems, and which controls you have already implemented versus which ones are missing or partially implemented. This phase also defines your CUI boundary and assessment scope.
-
Remediation Planning (Month 2-3)
Prioritize the gaps you discovered. Create a detailed project plan with timelines, resource assignments, budget allocations, and milestones. Some remediation items will be quick policy updates. Others will require significant technology purchases, infrastructure changes, or process redesigns.
-
Technology and Infrastructure Remediation (Month 3-12)
This is typically the longest phase. It includes deploying or upgrading security tools (SIEM, EDR, MFA, vulnerability scanning), redesigning network architecture for proper segmentation, implementing FIPS-validated encryption, configuring audit logging, and establishing secure remote access solutions. Learn more about CMMC remediation services.
-
Documentation Development (Month 6-14)
Write or update your System Security Plan (SSP), Plan of Action and Milestones (POA&M), security policies, procedures, incident response plan, configuration management plan, and all supporting documentation. Documentation should run in parallel with remediation, not after it.
-
Internal Testing and Mock Assessment (Month 12-15)
Conduct internal security assessments to validate that your controls work as documented. Run tabletop exercises for incident response. Test your audit logging. Verify MFA enrollment. A mock assessment conducted by an experienced RPO like PTG can identify remaining issues before the formal C3PAO assessment.
-
C3PAO Assessment (Month 14-18)
Schedule and complete the formal third-party C3PAO assessment. The assessment team will review documentation, interview personnel, examine technical configurations, and test controls. Results are submitted to the Cyber AB for final certification.
Organizations with mature security programs and prior NIST 800-171 compliance efforts can compress this timeline to 6-9 months. Organizations starting from a baseline of minimal security should plan for 12-18 months. Rushing the process almost always leads to failed assessments and wasted money.
The C3PAO Assessment Process for Level 2
A CMMC Level 2 assessment is conducted by a Certified Third-Party Assessment Organization, known as a C3PAO. These organizations are accredited by the Cyber AB (formerly the CMMC Accreditation Body) and employ Certified CMMC Assessors (CCAs) who perform the actual evaluation. You can learn more about what a CCA does in our detailed guide.
Before the Assessment
Your organization selects a C3PAO from the Cyber AB Marketplace. The C3PAO assigns an assessment team (typically a lead assessor and one or more additional CCAs). Before the on-site or virtual assessment begins, you provide the assessment team with your System Security Plan, network diagrams, CUI boundary documentation, and a list of assets in scope. The assessment team reviews this documentation to plan their assessment activities.
During the Assessment
The assessment typically takes 3 to 5 days for small organizations and up to 2 weeks for larger, more complex environments. The assessment team evaluates all 110 controls using three methods.
- Document review: The assessors examine your SSP, policies, procedures, and evidence artifacts to verify that controls are documented and that documentation accurately reflects your environment.
- Technical testing: Assessors verify that technical controls are actually in place by examining system configurations, reviewing audit logs, testing access controls, verifying encryption, and checking security tool deployments.
- Personnel interviews: Team members at various levels are interviewed to confirm they understand their security responsibilities and that policies are actually followed in day-to-day operations.
Assessment Outcomes
Each of the 110 controls receives one of three ratings: MET, NOT MET, or NOT APPLICABLE. To achieve certification, all applicable controls must be rated as MET, though limited POA&M items may be allowed under certain conditions. The C3PAO submits its findings to the Cyber AB through the CMMC Enterprise Mission Assurance Support Service (eMASS). The Cyber AB conducts a quality assurance review before issuing certification.
If your organization does not pass, you will receive a detailed report identifying which controls were rated NOT MET. You can remediate those specific issues and schedule a reassessment, though this adds cost and delays your certification timeline.
SPRS Scoring and Self-Assessment Requirements
The Supplier Performance Risk System (SPRS) score is your organization's self-reported compliance score against NIST 800-171. Every contractor handling CUI is already required to submit an SPRS score under DFARS 252.204-7019 and 252.204-7020. This score reflects how many of the 110 controls you have implemented.
How SPRS Scoring Works
Your SPRS score starts at 110 (perfect score, meaning all controls are fully implemented). For each control that is not implemented, points are subtracted based on the control's weighted value. The minimum possible score is -203. Your score, along with the date of your assessment and anticipated completion date for any POA&M items, is submitted to the SPRS portal.
To achieve CMMC Level 2 certification, your target SPRS score should be 110, meaning all controls are implemented. However, the reality is that most organizations begin their journey with scores well below that. Use our free SPRS calculator to estimate your current score and identify which controls have the highest point values.
SPRS Score as a Starting Point
Your current SPRS score serves as a useful baseline when planning your Level 2 journey. It tells you how far you need to go and which controls are responsible for the largest point deductions. However, keep in mind that SPRS scores are self-reported and often do not reflect the actual state of your controls. The C3PAO will not take your word for it during the assessment. They will verify every control independently.
Many organizations discover during a professional gap assessment that their actual compliance posture is significantly different from their reported SPRS score. This is common and not something to be embarrassed about. It is better to discover the gaps before the C3PAO assessment than during it.
Plan of Action and Milestones: Allowances and Limitations
A Plan of Action and Milestones (POA&M) documents the specific security controls that are not yet fully implemented, along with the steps, resources, and timeline to close those gaps. Under CMMC 2.0, limited use of POA&Ms is permitted during the Level 2 assessment process, but with strict conditions.
What the Rules Allow
- A POA&M may be used for controls that are partially implemented but not yet fully met at the time of assessment.
- POA&M items must be closed within 180 days of the conditional certification date.
- The total point value of controls on POA&M must not bring your SPRS score below a defined threshold (currently proposed at 80% of the maximum score).
- Your organization receives a conditional certification status until all POA&M items are remediated and verified.
What the Rules Do Not Allow
- You cannot place certain high-impact controls on POA&M. Specific controls related to FIPS-validated encryption, multi-factor authentication, and other critical security measures must be fully implemented at the time of assessment.
- POA&Ms are not a workaround for poor planning. If a C3PAO sees too many open items, it signals that your organization is not ready for assessment.
- You cannot use the same POA&M items indefinitely across multiple assessments. The intent is that POA&Ms are a short-term bridge, not a permanent accommodation.
The best approach is to minimize your POA&M items before scheduling a C3PAO assessment. Every open POA&M item introduces risk. If you fail to close items within the 180-day window, your conditional certification can be revoked. Talk to your consulting team about which controls are worth pushing to get done before the assessment versus which ones are reasonable POA&M candidates.
CUI Boundary Scoping and Enclave Strategies
One of the most impactful decisions you will make during your CMMC Level 2 journey is defining your CUI boundary. The CUI boundary determines which systems, networks, people, and facilities are "in scope" for the assessment. Everything inside the boundary must meet all 110 controls. Everything outside the boundary does not. This means that a well-designed CUI boundary can dramatically reduce the cost, complexity, and time required for certification.
What Is a CUI Enclave?
A CUI enclave is a segmented portion of your network specifically designed to handle CUI. Rather than applying all 110 controls to your entire enterprise network, you create a separate, hardened environment where CUI lives. Only the systems and users that need access to CUI operate within the enclave. Your general corporate network, marketing systems, HR applications, and other non-CUI systems remain outside the boundary.
Enclave Design Strategies
- Physical enclave: A separate physical network with dedicated hardware, separate internet connection, and distinct physical access controls. Most secure but most expensive.
- Logical enclave: Uses VLANs, firewalls, and network segmentation to create a virtually separate environment within your existing infrastructure. More cost-effective but requires careful configuration and monitoring.
- Cloud enclave: Leverages a FedRAMP Moderate (or higher) authorized cloud service provider to host CUI. Microsoft GCC High, AWS GovCloud, and Google Cloud for Government are common choices. The cloud provider handles many infrastructure controls, but you remain responsible for user-level controls, access management, and data handling.
- Hybrid enclave: Combines on-premises and cloud components. For example, you might use GCC High for email and document storage while keeping certain engineering systems on a segmented on-premises network.
The key principle is: the smaller your CUI boundary, the lower your compliance burden. This does not mean you should cut corners on protection. It means you should be deliberate about where CUI goes and limit its spread. Data flow mapping, marking policies, and employee training all contribute to keeping CUI contained within the enclave.
Working with an experienced RPO helps you design a CUI boundary that balances security requirements with operational reality. The wrong boundary design can either leave you overexposed (too large a scope) or create operational bottlenecks that frustrate your workforce (too restrictive).
Common Mistakes That Cause Level 2 Failure
After working with dozens of defense contractors on their compliance journeys, we have seen the same patterns lead to failed or delayed assessments. Knowing these pitfalls can save you months of rework and significant expense.
1. Treating Compliance as a Checklist
CMMC is not a checkbox exercise. Assessors look for controls that are genuinely implemented, consistently followed, and producing measurable results. Having a policy document that says "we use MFA" means nothing if your assessor tests your VPN and finds single-factor authentication. Documentation must match reality.
2. Ignoring Evidence Collection
Every control needs evidence. Screenshots, log exports, configuration files, training records, signed policies, vulnerability scan reports. Organizations that do not collect evidence throughout the year are forced to scramble before the assessment. Build evidence collection into your routine operations.
3. Underscoping or Overscoping the CUI Boundary
Defining too broad a boundary makes compliance unnecessarily expensive and complex. Defining too narrow a boundary and missing systems where CUI actually resides will result in assessment findings. Accurate data flow mapping is essential.
4. Skipping the System Security Plan
The SSP is the single most important document in your CMMC assessment. It describes your CUI environment, system boundaries, data flows, interconnections, and how each of the 110 controls is implemented. A weak or incomplete SSP signals to assessors that your program is not mature. Invest the time to make it thorough and accurate.
5. Assuming Cloud Equals Compliant
Moving to GCC High or another FedRAMP-authorized cloud does not automatically make you CMMC compliant. The cloud provider is responsible for infrastructure-level controls, but your organization is still responsible for dozens of controls related to access management, training, incident response, configuration, and data handling. Shared responsibility means shared work.
6. Not Training Your People
When a CCA interviews your help desk technician and they cannot explain your incident reporting process, that is a finding. Every person with access to CUI should understand the basics of your security program. Role-specific training is required for IT staff, security personnel, and anyone with elevated privileges.
7. Waiting Too Long to Start
Organizations that wait until a contract solicitation requires CMMC certification before starting their compliance journey are almost always too late. With 6 to 18 months of preparation required and limited C3PAO availability, starting early is the single best thing you can do. The organizations winning contracts now are the ones that started their CMMC journey two years ago.
8. Using the Wrong Consultant
Be wary of any firm that offers to both prepare you for the assessment and then assess you. This is a conflict of interest that CMMC explicitly prohibits. The consulting firm (RPO) and the assessment organization (C3PAO) must be separate entities. PTG is a Registered Provider Organization. We prepare and advise. We then coordinate with independent C3PAOs for your formal assessment. This separation protects the integrity of the process and your certification.
How PTG Helps You Achieve CMMC Level 2
Petronella Technology Group is a CMMC Registered Provider Organization (RPO) with a CMMC Registered Practitioner (RP) on staff. We guide defense contractors through every phase of preparation.
Our role is consulting and remediation, not formal assessment. There is an important reason for this. The CMMC ecosystem intentionally separates the organizations that help you prepare (RPOs like PTG) from the organizations that assess you (C3PAOs). Combining both roles would be a conflict of interest, and it is prohibited under CMMC rules. This separation exists to protect you. It ensures that your assessor has no financial incentive to overlook gaps, and that your consultant has no incentive to understate your readiness.
Our Level 2 Services
-
Comprehensive Gap Assessment
We evaluate your current environment against all 110 NIST 800-171 controls and identify exactly where you stand. This includes technical testing, documentation review, data flow mapping, and CUI boundary analysis. You receive a detailed report with specific findings and prioritized remediation recommendations. See our gap assessment services.
-
CUI Boundary Design and Scoping
We help you design the optimal CUI enclave for your organization, balancing security requirements with operational needs and budget constraints. We identify where CUI enters, where it lives, where it moves, and where it exits. This scoping work directly determines the cost and complexity of your entire compliance program.
-
Technology Remediation
We implement or upgrade the security tools and infrastructure needed to satisfy the 110 controls. This includes SIEM deployment, endpoint detection and response, multi-factor authentication, FIPS-validated encryption, network segmentation, vulnerability management, and secure configuration baselines. Learn more about our remediation services.
-
Documentation Development
We build your complete documentation package: System Security Plan, Plan of Action and Milestones, security policies, procedures, incident response plan, configuration management plan, and all supporting artifacts. Every document is tailored to your environment, not a generic template filled with placeholder text.
-
Mock Assessment
Before your formal C3PAO assessment, we conduct a mock assessment that simulates the real thing. Our team reviews documentation, tests controls, interviews staff, and identifies any remaining gaps. This gives you confidence going into the formal assessment and eliminates surprises.
-
C3PAO Coordination
We help you select an appropriate C3PAO, coordinate scheduling, prepare your team for interviews, and organize your evidence artifacts. While we do not participate in the formal assessment itself (maintaining the ethical separation), we ensure you are fully prepared for it. After the assessment, we help address any findings or POA&M items.
Craig Petronella
CEO, CMMC Registered Practitioner (CMMC-RP)Craig Petronella is a CMMC Registered Practitioner and the founder of Petronella Technology Group. With over 25 years of experience in cybersecurity and IT compliance, Craig leads PTG's CMMC consulting practice and has guided dozens of defense contractors through the compliance process. He is the author of How to Achieve CMMC Certification and hosts the PTG Podcast covering cybersecurity and compliance topics.
Craig holds the CMMC-RP credential, meaning he has been vetted and authorized by the Cyber AB to provide CMMC consulting services. As an RP, Craig provides expert guidance on preparing for CMMC assessments, but he does not perform formal assessments. That ethical distinction is central to how PTG operates.
Frequently Asked Questions About CMMC Level 2
Answers to the questions defense contractors ask most often about achieving Level 2 certification.
What is the difference between CMMC Level 2 and NIST 800-171 compliance?
CMMC Level 2 is built directly on NIST SP 800-171, using the same 110 security requirements. The difference is verification. Under DFARS 252.204-7012, contractors were required to implement NIST 800-171 controls and self-attest to their compliance. CMMC Level 2 adds a formal third-party assessment by an accredited C3PAO. In practical terms, CMMC Level 2 makes NIST 800-171 compliance auditable and enforceable rather than self-reported.
Can I self-assess for CMMC Level 2 instead of using a C3PAO?
In limited cases, yes. The CMMC 2.0 rule includes a provision for Level 2 self-assessment for certain contracts that involve CUI but are not considered critical to national security. However, the DoD has indicated that the majority of contracts involving CUI will require a C3PAO assessment. Your specific contract requirements will dictate which path applies to you. Even if self-assessment is allowed, the bar for compliance remains the same: all 110 controls must be fully implemented.
How long does CMMC Level 2 certification last?
CMMC Level 2 certification is valid for three years from the date of certification. During that period, you must submit an annual affirmation confirming that your security controls remain in place and effective. If material changes occur to your environment (such as a major system migration or acquisition), you may need to undergo a reassessment before the three-year mark.
What happens if I fail the C3PAO assessment?
If the C3PAO determines that your organization does not meet the requirements, you will receive a report detailing which controls were rated NOT MET. You can then remediate those specific controls and schedule a reassessment. There is no mandatory waiting period, but you will need to pay for the additional assessment. Working with an experienced RPO like PTG before your assessment significantly reduces the risk of failure. Our gap assessments and mock assessments are designed to catch issues before the C3PAO does.
How much does a C3PAO assessment cost?
C3PAO assessment fees for Level 2 typically range from $25,000 to $120,000 depending on the size and complexity of your organization. Factors that influence cost include the number of employees, the size of your CUI boundary, the number of locations, and the complexity of your IT environment. The CMMC marketplace allows you to compare C3PAOs, but pricing is negotiated directly between your organization and the C3PAO. Learn more in our C3PAO assessment guide.
Do subcontractors need CMMC Level 2?
Yes, if a subcontractor handles CUI. CMMC requirements flow down through the supply chain. If a prime contractor passes CUI to a subcontractor, that subcontractor must achieve the same CMMC level required by the contract. This applies at every tier of the supply chain. If you are a subcontractor and your prime tells you that CUI is involved, start planning for Level 2 now.
What is the difference between an RPO and a C3PAO?
A Registered Provider Organization (RPO) like PTG provides consulting, advisory, and remediation services to help you prepare for CMMC certification. A Certified Third-Party Assessment Organization (C3PAO) conducts the formal assessment that determines whether you pass or fail. These roles are deliberately separated. An RPO cannot assess the same organization it prepared, and a C3PAO should not consult on remediation for clients it will later assess. This separation prevents conflicts of interest and protects the credibility of the certification.
Can I use a cloud service to meet CMMC Level 2 requirements?
Yes, and many organizations do. However, the cloud service must be FedRAMP Moderate (or equivalent) authorized if it will host CUI. Popular choices include Microsoft 365 GCC High, AWS GovCloud, and Google Cloud for Government. Using a qualified cloud provider can help you inherit certain infrastructure controls, but you remain responsible for user access management, configuration, data handling, training, incident response, and many other controls. Cloud is a tool, not a shortcut.
What is a System Security Plan (SSP) and do I need one?
Yes, absolutely. The SSP is a required document under NIST 800-171 (control 3.12.4) and is central to the CMMC Level 2 assessment. It describes your system boundaries, how CUI flows through your environment, what security controls are in place, and how each of the 110 requirements is satisfied. Think of it as the master reference document that tells your entire security story. The C3PAO will use your SSP as a starting point for their assessment. A well-written SSP demonstrates maturity and makes the assessment smoother for everyone involved.
How does CMMC affect small businesses?
Small businesses face the same 110-control requirement as large enterprises, which is a significant challenge. However, small businesses can reduce their burden by tightly scoping their CUI boundary (using an enclave strategy), leveraging FedRAMP-authorized cloud services to inherit infrastructure controls, and working with an experienced RPO to prioritize remediation efforts. The DoD has indicated interest in providing small business accommodations, but as of now, the requirements are the same regardless of size. The good news is that a smaller organization typically has a smaller scope, which can make compliance more manageable.
When will CMMC Level 2 be required in contracts?
The CMMC 2.0 final rule was published in late 2024, with phased implementation beginning in 2025. The DoD is rolling CMMC requirements into new contracts through a phased approach. During Phase 1, Level 2 self-assessment may appear in select contracts. During later phases, C3PAO assessments become mandatory for contracts involving CUI. The exact timeline for your contracts depends on the specific program and contracting office. The safest approach is to begin preparation now so you are ready when the requirement appears in your solicitations.
Can PTG perform our CMMC assessment?
No, and that is by design. PTG is a Registered Provider Organization (RPO), not a C3PAO. We provide consulting, gap assessments, remediation, documentation, and mock assessments. We do not perform formal CMMC assessments. This is an intentional ethical separation in the CMMC ecosystem. The organization that helps you prepare should never be the same organization that grades you. We will help you select an appropriate C3PAO and coordinate the assessment process, but the formal assessment must be conducted by an independent, accredited C3PAO. Read our full CMMC compliance services overview for details.
Explore Our CMMC Resources
Continue learning about CMMC certification with these guides and tools.
Ready to Start Your CMMC Level 2 Journey?
Our CMMC Registered Practitioners will evaluate your current posture, design a clear path to certification, and walk beside you every step of the way.