CMMC Level 2: Requirements and Assessment Guide

Published Date: November 4, 2026 Author: Nikhil Raj

Category: Blogs Tags: CMMC

Learn about CMMC Level 2 requirements, all 110 NIST SP 800-171 controls, self-assessment vs. C3PAO certification, scoring, and 2026 updates.

TL;DR

CMMC Level 2 requires all 110 NIST SP 800-171 Rev. 2 requirements, scored out of 110. A score of 88 or higher can earn Conditional status with a POA&M that must be closed within 180 days.
A self-assessment is posted to SPRS by the contractor. A C3PAO assessment is independently verified. Both cover the same 110 requirements, last three years and need an annual affirmation.
The Department of War suspended Phase 2 C3PAO requirements on July 13, 2026. Level 2 security obligations, self-assessments, SPRS scoring and False Claims Act exposure all remain.

Defense contractors that handle Controlled Unclassified Information (CUI) have spent the past year preparing for CMMC Level 2, and 2026 has made planning harder. Phase 1 of the Cybersecurity Maturity Model Certification program took effect on November 10, 2025, bringing self-assessment requirements into new contracts.

Then, on July 13, 2026, the Department of War suspended Phase 2, which would have required third-party certification by a C3PAO in many solicitations starting November 10, 2026. For contractors, the practical question is what CMMC Level 2 still requires today, and whether a self-assessment or a C3PAO assessment is the right path.

What Is CMMC Level 2?

CMMC Level 2 is the certification level for defense contractors and subcontractors that store, process, or transmit CUI. It requires implementing all 110 security requirements of NIST SP 800-171 Revision 2.

The CMMC program is codified at 32 CFR Part 170 and applied to contracts through the DFARS acquisition rule. It has three levels:

Level	Information Protected	Requirements	Assessment Type
Level 1	Federal Contract Information (FCI)	15 requirements from FAR 52.204-21	Annual self-assessment
Level 2	Controlled Unclassified Information (CUI)	110 requirements from NIST SP 800-171 Rev. 2	Self-assessment or C3PAO, every three years
Level 3	CUI in high-priority programs	Level 2 plus selected NIST SP 800-172 requirements	Government-led (DIBCAC)

If your company handles Controlled Unclassified Information under a defense contract, Level 2 is the level that applies.

What Are the CMMC Level 2 Requirements?

CMMC Level 2 requires all 110 NIST SP 800-171 Rev. 2 security requirements across 14 control families, assessed against approximately 320 assessment objectives defined in NIST SP 800-171A.

The 14 families are as follows:

Access Control
Awareness and Training
Audit and Accountability
Configuration Management
Identification and Authentication
Incident Response
Maintenance
Media Protection
Personnel Security
Physical Protection
Risk Assessment
Security Assessment
System and Communications Protection
System and Information Integrity

How CMMC Level 2 Is Scored

Each requirement is scored as met or not met. Scoring starts at 110, and each unmet requirement deducts 1, 3, or 5 points depending on its weight. A passing score of at least 88 can earn Conditional status, with eligible gaps documented in a Plan of Action and Milestones (POA&M). Final status requires all 110 requirements to be met.

POA&M Rules

POA&Ms are allowed at Level 2 with strict limits. Generally, only lower-weighted requirements can be placed on a POA&M, and certain requirements, including the system security plan (3.12.4), cannot be deferred. All POA&M items must be closed within 180 days. If they are not, the CMMC status expires.

Documentation Expectations

Assessors expect a current system security plan (SSP), a clearly defined CUI boundary, network diagrams, asset inventories, policies and procedures, and evidence that each control operates as described. Contractors using cloud services for CUI should also confirm their providers meet FedRAMP Moderate or equivalent requirements under DFARS 252.204-7012.

What Is the Difference Between a CMMC Level 2 Self-Assessment and a C3PAO Assessment?

A CMMC Level 2 self-assessment is performed by the contractor itself and posted to the Supplier Performance Risk System (SPRS), while a C3PAO assessment is an independent certification performed by a Certified Third-Party Assessment Organization authorized by the Cyber AB.

Attribute	Level 2 Self-Assessment	Level 2 C3PAO Assessment
Who performs it	The contractor	An authorized C3PAO
Where results go	SPRS, with annual affirmation	SPRS via the CMMC eMASS system, with annual affirmation
Frequency	Every three years	Every three years
Requirements assessed	All 110	All 110
Cost	Internal effort and advisory support	Assessor fees plus internal effort
Assurance to primes and DoD	Lower, self-attested	Higher, independently verified

Both paths require the same 110 requirements and the same scoring. The difference is who validates the results. A senior affirming official must submit an annual affirmation of continued compliance in SPRS in either case.

Self-Assessment Accuracy Still Matters

A self-assessment is not a lighter standard. Inaccurate SPRS scores can create False Claims Act exposure under the Department of Justice’s Civil Cyber-Fraud Initiative, and DoD can still conduct government-led audits through DIBCAC. Contractors should assess with the same rigor a C3PAO would apply.

How Does the CMMC Phase 2 Suspension Affect Level 2?

The suspension pauses mandatory C3PAO assessments as a condition of contract award, but it does not pause Level 2 security obligations. Contractors handling CUI must still implement NIST SP 800-171 and maintain accurate self-assessments.

On July 13, 2026, the Department of War announced the immediate suspension of Phase 2 requirements and launched a 60-day review by a CMMC Reform Task Force. Contracting officers were directed to remove Phase 2 and Phase 3 requirements from existing contracts at the next option period or administrative modification. As of mid-October 2026, no revised timeline for third-party assessments had been announced.

What remains in effect:

Phase 1 Level 1 and Level 2 self-assessment requirements.
DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 implementation.
SPRS score posting and annual affirmations.
Government-led assessments and False Claims Act enforcement.
Flow-down obligations to subcontractors.

Contractors can still choose a C3PAO assessment voluntarily. Our analysis of why the C3PAO readiness window is still open explains why continuing preparation still makes sense.

Should You Choose a Self-Assessment or a C3PAO Assessment?

Choose based on contract requirements first, then on customer expectations and risk tolerance. During the suspension, solicitations may require only Level 1 or Level 2 self-assessments, but a voluntary C3PAO assessment can still offer a competitive advantage.

A self-assessment may be enough when:

Your contracts and primes accept self-assessed Level 2 status
Your CUI environment is small and well documented
You need time to remediate before independent validation

A C3PAO assessment may be worth pursuing when:

Prime contractors ask subcontractors for independent verification
You want to be ready when third-party requirements return
You compete for programs where assurance is a differentiator
You want to reduce False Claims Act risk from self-attestation errors

As a hypothetical example, a machining subcontractor supplying several primes might complete a self-assessment now, then schedule a voluntary C3PAO assessment once remediation is complete, so it is not competing for limited assessor capacity later.

What Are the Most Common CMMC Level 2 Gaps?

The most common gaps involve unclear CUI scope, incomplete documentation, and controls that exist on paper but lack evidence.

CUI boundary not defined, which expands scope and cost
System security plan outdated or missing implementation detail
Multifactor authentication not enforced for all required access
FIPS-validated encryption not used to protect CUI
Audit logs collected but not reviewed
Cloud services used for CUI without verified FedRAMP Moderate equivalency
SPRS scores that do not match the actual state of controls

What Should Defense Contractors Do Next?

Start by defining your CUI boundary and completing an honest NIST SP 800-171 gap assessment, then close the gaps that cannot be placed on a POA&M.

Identify where CUI is received, stored, processed, and transmitted.
Define the assessment scope and enclave options to limit it.
Update the system security plan and supporting policies.
Perform a gap assessment against all 110 requirements and 320 objectives.
Remediate high-weighted and non-deferrable requirements first.
Post an accurate SPRS score and plan the annual affirmation.
Decide whether to pursue a voluntary C3PAO assessment.

Ampcus Cyber’s CMMC services support CUI scoping, NIST SP 800-171 gap assessments, remediation planning, and C3PAO readiness, so contractors can submit accurate scores now and be prepared when third-party assessments resume.

Preparing for CMMC Level 2 With Confidence

CMMC Level 2 requirements remain in force even while the C3PAO mandate is paused. Contractors that scope CUI carefully, document controls thoroughly, and assess with C3PAO-level rigor will protect their contracts today and be ready for whatever the reformed program requires next.

Make sure your SPRS score holds up to scrutiny. Connect with Ampcus Cyber’s experts for CMMC Level 2 gap assessment and test your environment against all 110 NIST SP 800-171 requirements and 320 objectives.