Last reviewed October 13, 2026. For the current status of the program, see our update on the CMMC Phase 2 suspension.
CMMC Level 2 is the level of the Cybersecurity Maturity Model Certification that applies to contractors handling Controlled Unclassified Information (CUI) for the Department of Defense. Its core requirement is simple to state and demanding to meet: implement all 110 security requirements in NIST SP 800-171 Rev. 2 and be able to prove it.
The three CMMC levels
- Level 1 (Foundational). The 15 basic safeguarding requirements in FAR 52.204-21, for contractors that handle only Federal Contract Information. Assessed by annual self-assessment.
- Level 2 (Advanced). The 110 requirements of NIST SP 800-171 Rev. 2, for contractors that handle CUI. Assessed by self-assessment or by a C3PAO, depending on what the solicitation specifies.
- Level 3 (Expert). Level 2 plus selected requirements from NIST SP 800-172, for the most sensitive programs. Assessed by the government.
Who needs Level 2
You need Level 2 if you store, process or transmit CUI on your systems under a DoD contract, or if you are a subcontractor in that chain. In practice, if your contract includes DFARS 252.204-7012, you are already required to implement NIST SP 800-171. CMMC adds the requirement to demonstrate it. The level required is set by DoD based on the sensitivity of the CUI and is stated in the solicitation.
The 110 requirements
The requirements are organized into 14 families, from Access Control (22 requirements) to System and Communications Protection (16) and Incident Response (3). Each requirement is assessed against its determination statements in NIST SP 800-171A, which break the 110 requirements into 320 assessment objectives. Meeting a requirement means having the policy, the procedure and the working technical control, plus evidence of each. Our NIST SP 800-171 checklist walks through every family.
How Level 2 is assessed and scored
Assessors score using the DoD Assessment Methodology. The score starts at 110, and each requirement not fully implemented deducts 1, 3 or 5 points. A full pass is 110. The lowest possible score is -203. Self-assessment scores are posted to SPRS. Our guide to calculating your SPRS score covers the steps.
A limited number of unmet requirements can be carried on a plan of action and milestones (POA&M), but only above a minimum score and only for specific requirements. See CMMC POA&M rules for the details.
A Level 2 certification is valid for three years, with an annual affirmation by a senior company official that the requirements remain met.
Where the program stands
DoD originally scheduled third-party Level 2 certification to become a condition of award starting November 10, 2026. On July 13, 2026, it suspended that phase and launched a review. Self-assessment requirements and NIST SP 800-171 obligations remain in force. The details are in our Phase 2 suspension update.
How to prepare
- Identify where CUI lives. Map every system, person and process that stores, processes or transmits it.
- Draw a tight boundary. Isolating CUI in a defined enclave usually reduces both cost and risk.
- Run a gap assessment. Score each requirement honestly against the objectives in NIST SP 800-171A.
- Write the system security plan. It documents how each requirement is met and anchors your score.
- Remediate in order of risk and point value. Multi-factor authentication, logging and encryption carry the most weight.
- Operate the controls continuously. Monitoring, vulnerability management and incident response must run every day, not only at audit time.
Cyberix supports each step through our CMMC and NIST SP 800-171 compliance services, and runs the 24/7 monitoring that several requirements depend on through our Virtual SOC.
What counts as CUI
Controlled Unclassified Information is information the government creates or possesses, or that an organization creates or receives on its behalf, that must be safeguarded under law, regulation or government-wide policy. In defense work it commonly includes controlled technical information, export-controlled data and certain engineering or procurement records. Your contract and the markings on the information tell you what you hold, and the National Archives CUI Registry lists the official categories.
How assessors check a requirement
NIST SP 800-171A defines three assessment methods. Assessors examine documents, configurations and records, interview the people who run the controls, and test the controls in operation. A requirement is met only when all of its assessment objectives are met, so a policy on paper is never enough on its own.
Primes and subcontractors
Requirements flow down the supply chain. A prime contractor must pass the applicable requirements to subcontractors, and a subcontractor that handles CUI carries the same obligations for the systems that hold it. The level a subcontractor needs depends on the information it handles, so ask your prime what applies before you scope the work.
Common misconceptions
- “We use a compliant cloud provider, so we are covered.” A qualifying cloud service helps, but you remain responsible for your own configuration, access, logging and the rest of the requirements that apply to your side of the boundary.
- “Policies are enough.” Assessors examine, interview and test. Each requirement needs a policy, a working control and evidence.
- “This is an IT project.” Physical security, personnel screening, training and leadership sign-off are all in the 110 requirements.
- “CMMC replaces NIST SP 800-171.” CMMC Level 2 is built on it. The standard is the same, and the program verifies it.
Talk to a Cyberix compliance expert about your NIST SP 800-171 and CMMC readiness.
Frequently Asked Questions
What is CMMC Level 2?
The level of CMMC for contractors that handle CUI. It requires implementing all 110 security requirements in NIST SP 800-171 Rev. 2 and demonstrating them through a self-assessment or a third-party assessment, as the solicitation specifies.
What is the difference between NIST SP 800-171 and CMMC Level 2?
They use the same 110 requirements. NIST SP 800-171 is the standard. CMMC is the program that verifies that contractors have met it.
Who performs a CMMC Level 2 certification assessment?
A Certified Third-Party Assessor Organization (C3PAO), authorized to assess contractors against the CMMC requirements.
How long does a Level 2 certification last?
Three years, with an annual affirmation in between.
Is CMMC Level 2 required right now?
Third-party certification as a condition of award was suspended on July 13, 2026. Self-assessment requirements and the NIST SP 800-171 obligations under DFARS 252.204-7012 still apply. Check your contract for the clauses that apply to you.
This article is general information, not legal advice. Confirm which clauses apply to your contracts with qualified counsel or your contracting officer.
To see how many of the 110 requirements you meet, try the free SPRS score calculator.