What CMMC Level 2 Actually Requires: A Plain-English Breakdown for DIB Contractors

If your company touches Controlled Unclassified Information (CUI) for the Department of War (formerly the Department of Defense), you have probably heard the term “CMMC Level 2” more times than you’d like. What gets lost in the acronyms is a plain answer to a simple question: what does CMMC Level 2 actually require you to do? Not the politics, not the phase suspensions — the actual controls, documents, and proof.

Here is the plain-English version, current as of September 2026.

CMMC Level 2 Is NIST SP 800-171, Not a New Standard

This is the single most important thing to understand: CMMC Level 2 did not invent a new set of cybersecurity requirements. The CMMC Program rule at 32 CFR Part 170 defines Level 2 security requirements as identical to NIST SP 800-171, Revision 2 — the same 110 security requirements the Department of War has required under DFARS 252.204-7012 since December 2017. The Department has said it intends to adopt NIST SP 800-171 Revision 3 through future rulemaking, but assessments are still conducted against Revision 2 today, and no effective date for Rev 3 has been set. If you have already implemented NIST SP 800-171, you have already done the substantive work of CMMC Level 2. CMMC’s job is to verify and score that work, not replace it.

The 110 Controls, Organized Into 14 Families

NIST SP 800-171 groups its 110 requirements into 14 control families. You do not need to memorize all 110 to understand the shape of the standard — understanding the families tells you what areas of your business are in scope:

• Access Control — who can reach CUI and systems, and under what conditions
• Awareness and Training — making sure employees understand security responsibilities
• Audit and Accountability — logging who did what, and reviewing those logs
• Configuration Management — controlling how systems are set up and changed
• Identification and Authentication — verifying users and devices, including multi-factor authentication
• Incident Response — detecting, reporting, and recovering from security incidents
• Maintenance — controlling how systems are serviced and by whom
• Media Protection — protecting CUI on removable media and at disposal
• Personnel Security — screening and off-boarding people with access to CUI
• Physical Protection — controlling physical access to facilities and equipment
• Risk Assessment — periodically identifying and evaluating risk
• Security Assessment — testing that your controls actually work, and fixing what doesn’t
• System and Communications Protection — boundary protection, encryption, network architecture
• System and Information Integrity — patching, malware defense, monitoring for flaws

Every one of the 110 requirements falls into one of these families, and every requirement has one or more assessment objectives defined in NIST SP 800-171A that an assessor (or you, in a self-assessment) checks off individually. A control is not “met” because you have a policy that mentions it — it is met only when every assessment objective under it has evidence behind it.

How You Prove It: Self-Assessment Today, C3PAO Later (Maybe)

This is the part that has changed the most in 2026, and where the most confusion lives. CMMC’s original design called for three certification levels, with Level 2 requiring third-party certification from an accredited C3PAO (Certified Third-Party Assessment Organization) for most contractors handling CUI. On July 13, 2026, the Department suspended Phase 2 — the milestone that would have made that third-party certification a condition of contract award — and launched a review of the entire program.

What remains in force is Phase 1: CMMC Level 1 and Level 2 self-assessments. A qualified individual inside your company assesses your environment against the 110 controls, the score is entered into the Supplier Performance Risk System (SPRS), and a senior company official signs an annual affirmation that the score is accurate. Third-party C3PAO assessment is currently optional rather than mandatory for most contractors, though some primes still require it contractually, and some contractors pursue it voluntarily because an independent certificate carries more weight with customers and reduces exposure if the government later questions a self-reported score.

Do not read “self-assessment” as “less work.” The 110 controls and their assessment objectives are identical either way. The only thing that changes is who is checking your evidence.

The SPRS Score: How the Math Actually Works

The scoring model behind your SPRS number is the DoD’s 2020 Assessment Methodology, and it has not changed. You start at a maximum of 110 points. For every requirement you have not fully implemented, you lose points — 5, 3, or 1 point depending on how heavily that particular control is weighted, reflecting how much risk it carries if left unaddressed. A company with several unimplemented higher-weighted controls can end up with a low or even negative score despite having a reasonably mature program on paper.

A Plan of Action and Milestones (POA&M) lets you document requirements you have not yet fully implemented, with a timeline to close the gap — but POA&Ms come with real limits. Current guidance requires an overall score of at least 88 out of 110 before a POA&M is allowed at all, prohibits putting any of the most heavily weighted controls on a POA&M, and requires open items to be closed out within 180 days. A POA&M is a bridge for a small number of remaining gaps in an otherwise mature environment, not a way to defer the bulk of your implementation.

What You Actually Need to Build

Strip away the acronyms and CMMC Level 2 compliance comes down to a handful of concrete deliverables:

• A System Security Plan (SSP) that describes your environment, where CUI lives, flows, and is stored, and how each of the 110 requirements is implemented
• A Plan of Action and Milestones (POA&M) for any requirements not yet fully in place, within the limits described above
• Written policies and procedures covering each control family, and evidence that you actually follow them, not just that they exist in a binder
• A defined CUI boundary — knowing precisely which systems, users, and facilities touch CUI, since that scope is what an assessment actually covers
• A current SPRS score, calculated honestly against the methodology above, entered into SPRS, and affirmed annually by a senior official
• An incident response capability that can meet the 72-hour cyber incident reporting requirement under DFARS 252.204-7012

Common Misconceptions Worth Correcting

Two misunderstandings cause the most wasted time and money. The first is treating CMMC as separate from NIST SP 800-171 — buying a “CMMC product” or “CMMC training” that doesn’t map back to the 110 requirements and their assessment objectives is money spent on the wrong thing. The second is assuming the Phase 2 suspension means the requirement itself went away. It did not. DFARS 252.204-7012 has required NIST SP 800-171 implementation since 2017, independent of anything CMMC does, and Phase 1 self-assessment and SPRS reporting obligations remain firmly in place today.

The Bottom Line

CMMC Level 2, stripped of the acronyms and the program politics, is 110 specific security requirements organized into 14 families, each broken into assessment objectives that need real evidence behind them, scored against a defined methodology, and documented in an SSP and (where applicable) a POA&M. Whether the final proof comes from a self-assessment or a C3PAO, the underlying work is the same work. Contractors who build to the actual 110 requirements, rather than to whatever the news cycle says about CMMC’s status this month, are the ones who are ready regardless of how the program’s certification mechanics get reformed.

Need Help Turning This Into a Real Plan?

Custom Cybersecurity Solutions helps defense contractors map their environment against all 110 NIST SP 800-171 requirements, build a defensible System Security Plan, and prepare an accurate SPRS score they can stand behind. Schedule a consultation or browse our SSP and policy templates to get started.